Edit tour

Linux Analysis Report
a-r.m-5.Sakura.elf

Overview

General Information

Sample name:	a-r.m-5.Sakura.elf
Analysis ID:	1575878
MD5:	b6de2503408a3ff75574f6d237fb8ecd
SHA1:	67e23f3e2e26d7c73edfe41dd97b0ff118e673a8
SHA256:	ba157cda68d378aea0842c81d24c4bddabbbcbfa24755569f0e252366c3d0ab8
Tags:	elfGafgytuser-abuse_ch
Infos:

Detection

Gafgyt, Mirai

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Gafgyt

Yara detected Mirai

Connects to many ports of the same IP (likely port scanning)

Contains symbols with names commonly found in malware

Opens /proc/net/* files useful for finding connected devices and routers

Detected TCP or UDP traffic on non-standard ports

Sample contains strings that are user agent strings indicative of HTTP manipulation

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1575878
Start date and time:	2024-12-16 11:50:52 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	a-r.m-5.Sakura.elf
Detection:	MAL
Classification:	mal100.spre.troj.linELF@0/0@0/0

Warnings

VT rate limit hit for: a-r.m-5.Sakura.elf

Runtime Messages

Command:	/tmp/a-r.m-5.Sakura.elf
PID:	6263
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

a-r.m-5.Sakura.elf (PID: 6263, Parent: 6187, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/a-r.m-5.Sakura.elf

a-r.m-5.Sakura.elf New Fork (PID: 6265, Parent: 6263)

a-r.m-5.Sakura.elf New Fork (PID: 6267, Parent: 6265)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
a-r.m-5.Sakura.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
a-r.m-5.Sakura.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
a-r.m-5.Sakura.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xefa0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xefb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xefc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xefdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeff0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf004:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf018:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf02c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf040:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf054:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf068:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf07c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf090:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf0a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf0b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf0cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf0e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf0f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf108:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf11c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf130:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
6263.1.00007f2a34017000.00007f2a34028000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6263.1.00007f2a34017000.00007f2a34028000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xefa0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xefb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xefc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xefdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeff0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf004:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf018:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf02c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf040:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf054:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf068:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf07c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf090:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf0a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf0b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf0cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf0e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf0f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf108:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf11c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf130:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6265.1.00007f2a34017000.00007f2a34028000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6265.1.00007f2a34017000.00007f2a34028000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xefa0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xefb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xefc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xefdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeff0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf004:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf018:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf02c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf040:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf054:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf068:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf07c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf090:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf0a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf0b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf0cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf0e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf0f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf108:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf11c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf130:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: a-r.m-5.Sakura.elf PID: 6263	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: a-r.m-5.Sakura.elf PID: 6263	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xe47:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe5b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe6f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe83:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe97:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeab:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xebf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xefb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf0f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf23:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf37:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf4b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf5f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf73:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf87:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf9b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfaf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfc3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfd7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: a-r.m-5.Sakura.elf PID: 6265	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: a-r.m-5.Sakura.elf PID: 6265	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x10ed:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1101:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1115:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1129:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x113d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1151:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1165:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1179:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11a1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11c9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11dd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1205:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1219:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x122d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1241:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1255:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1269:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x127d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 3 entries

Suricata Signatures

ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T11:51:49.306025+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55686	93.123.85.8	12345	TCP
2024-12-16T11:51:50.483837+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55688	93.123.85.8	12345	TCP
2024-12-16T11:51:51.656930+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55690	93.123.85.8	12345	TCP
2024-12-16T11:51:52.830054+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55692	93.123.85.8	12345	TCP
2024-12-16T11:51:54.005249+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55694	93.123.85.8	12345	TCP
2024-12-16T11:51:55.217093+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55696	93.123.85.8	12345	TCP
2024-12-16T11:51:56.398501+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55698	93.123.85.8	12345	TCP
2024-12-16T11:51:57.573518+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55700	93.123.85.8	12345	TCP
2024-12-16T11:51:58.752717+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55702	93.123.85.8	12345	TCP
2024-12-16T11:51:59.925855+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55704	93.123.85.8	12345	TCP
2024-12-16T11:52:01.099975+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55706	93.123.85.8	12345	TCP
2024-12-16T11:52:02.275910+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55708	93.123.85.8	12345	TCP
2024-12-16T11:52:03.449213+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55710	93.123.85.8	12345	TCP
2024-12-16T11:52:04.624283+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55712	93.123.85.8	12345	TCP
2024-12-16T11:52:05.797808+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55714	93.123.85.8	12345	TCP
2024-12-16T11:52:06.971695+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55716	93.123.85.8	12345	TCP
2024-12-16T11:52:08.166659+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55718	93.123.85.8	12345	TCP
2024-12-16T11:52:09.343609+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55720	93.123.85.8	12345	TCP
2024-12-16T11:52:10.518768+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55722	93.123.85.8	12345	TCP
2024-12-16T11:52:11.694052+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55724	93.123.85.8	12345	TCP
2024-12-16T11:52:12.873466+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55726	93.123.85.8	12345	TCP
2024-12-16T11:52:14.053815+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55728	93.123.85.8	12345	TCP
2024-12-16T11:52:15.228399+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55730	93.123.85.8	12345	TCP
2024-12-16T11:52:16.403990+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55732	93.123.85.8	12345	TCP
2024-12-16T11:52:17.577271+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55734	93.123.85.8	12345	TCP
2024-12-16T11:52:18.750864+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55736	93.123.85.8	12345	TCP
2024-12-16T11:52:19.928027+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55738	93.123.85.8	12345	TCP
2024-12-16T11:52:21.101262+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55740	93.123.85.8	12345	TCP
2024-12-16T11:52:22.278138+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55742	93.123.85.8	12345	TCP
2024-12-16T11:52:23.460429+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55744	93.123.85.8	12345	TCP
2024-12-16T11:52:24.633126+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55746	93.123.85.8	12345	TCP
2024-12-16T11:52:25.818808+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55748	93.123.85.8	12345	TCP
2024-12-16T11:52:26.992782+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55750	93.123.85.8	12345	TCP
2024-12-16T11:52:28.166689+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55752	93.123.85.8	12345	TCP
2024-12-16T11:52:29.341877+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55754	93.123.85.8	12345	TCP
2024-12-16T11:52:30.516923+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55756	93.123.85.8	12345	TCP
2024-12-16T11:52:31.690935+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55758	93.123.85.8	12345	TCP
2024-12-16T11:52:32.879567+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55760	93.123.85.8	12345	TCP
2024-12-16T11:52:34.055654+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55762	93.123.85.8	12345	TCP
2024-12-16T11:52:35.229404+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55764	93.123.85.8	12345	TCP
2024-12-16T11:52:36.403118+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55766	93.123.85.8	12345	TCP
2024-12-16T11:52:37.576289+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55768	93.123.85.8	12345	TCP
2024-12-16T11:52:38.754863+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55770	93.123.85.8	12345	TCP
2024-12-16T11:52:39.931023+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55772	93.123.85.8	12345	TCP
2024-12-16T11:52:41.104566+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55774	93.123.85.8	12345	TCP
2024-12-16T11:52:42.280723+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55776	93.123.85.8	12345	TCP
2024-12-16T11:52:43.454143+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55778	93.123.85.8	12345	TCP
2024-12-16T11:52:44.664590+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55780	93.123.85.8	12345	TCP
2024-12-16T11:52:45.838142+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55782	93.123.85.8	12345	TCP
2024-12-16T11:52:47.012088+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55784	93.123.85.8	12345	TCP
2024-12-16T11:52:48.185544+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55786	93.123.85.8	12345	TCP
2024-12-16T11:52:49.359407+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55788	93.123.85.8	12345	TCP
2024-12-16T11:52:50.533535+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55790	93.123.85.8	12345	TCP
2024-12-16T11:52:51.707347+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55792	93.123.85.8	12345	TCP
2024-12-16T11:52:52.881934+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55794	93.123.85.8	12345	TCP
2024-12-16T11:52:54.054221+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55796	93.123.85.8	12345	TCP
2024-12-16T11:52:55.228317+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55798	93.123.85.8	12345	TCP
2024-12-16T11:52:56.403415+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55800	93.123.85.8	12345	TCP
2024-12-16T11:52:57.577996+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55802	93.123.85.8	12345	TCP
2024-12-16T11:52:58.752745+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55804	93.123.85.8	12345	TCP
2024-12-16T11:52:59.930974+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55806	93.123.85.8	12345	TCP
2024-12-16T11:53:01.104722+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55808	93.123.85.8	12345	TCP
2024-12-16T11:53:02.279925+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55810	93.123.85.8	12345	TCP
2024-12-16T11:53:03.452653+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55812	93.123.85.8	12345	TCP
2024-12-16T11:53:04.628850+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55814	93.123.85.8	12345	TCP
2024-12-16T11:53:05.802658+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55816	93.123.85.8	12345	TCP
2024-12-16T11:53:06.978212+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55818	93.123.85.8	12345	TCP
2024-12-16T11:53:08.151846+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55820	93.123.85.8	12345	TCP
2024-12-16T11:53:30.207508+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55822	93.123.85.8	12345	TCP
2024-12-16T11:53:52.222787+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55824	93.123.85.8	12345	TCP
2024-12-16T11:54:14.237872+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55826	93.123.85.8	12345	TCP
2024-12-16T11:54:36.269192+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55828	93.123.85.8	12345	TCP
2024-12-16T11:54:58.302428+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55830	93.123.85.8	12345	TCP
2024-12-16T11:55:20.334942+0100	2846526	1	A Network Trojan was detected	192.168.2.23	55832	93.123.85.8	12345	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: a-r.m-5.Sakura.elf

Avira: detected

Found malware configuration

Source: a-r.m-5.Sakura.elf

Malware Configuration Extractor: Gafgyt {"C2 url": "93.123.85.8:12345"}

Multi AV Scanner detection for submitted file

Source: a-r.m-5.Sakura.elf

ReversingLabs: Detection: 65%

Spreading

Opens /proc/net/* files useful for finding connected devices and routers

Source: /tmp/a-r.m-5.Sakura.elf (PID: 6263)

Opens: /proc/net/route

Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55746 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55762 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55686 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55798 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55780 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55806 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55816 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55688 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55716 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55822 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55738 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55740 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55712 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55700 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55768 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55784 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55758 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55708 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55782 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55698 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55720 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55694 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55742 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55736 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55714 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55790 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55760 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55704 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55820 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55812 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55786 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55766 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55718 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55776 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55726 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55826 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55830 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55794 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55732 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55808 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55710 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55756 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55750 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55734 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55774 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55792 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55754 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55796 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55810 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55752 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55696 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55702 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55828 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55692 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55722 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55748 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55770 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55730 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55744 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55690 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55778 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55824 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55706 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55772 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55802 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55764 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55814 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55724 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55804 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55832 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55728 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55800 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55788 -> 93.123.85.8:12345
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:55818 -> 93.123.85.8:12345

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 93.123.85.8 ports 1,2,3,4,5,12345

Source: global traffic

TCP traffic: 192.168.2.23:55686 -> 93.123.85.8:12345

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443

Source: unknown	TCP traffic detected without corresponding DNS query: 93.123.85.8
Source: unknown	TCP traffic detected without corresponding DNS query: 93.123.85.8
Source: unknown	TCP traffic detected without corresponding DNS query: 93.123.85.8
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 93.123.85.8
Source: unknown	TCP traffic detected without corresponding DNS query: 93.123.85.8
Source: unknown	TCP traffic detected without corresponding DNS query: 93.123.85.8
Source: unknown	TCP traffic detected without corresponding DNS query: 93.123.85.8
Source: unknown	TCP traffic detected without corresponding DNS query: 93.123.85.8
Source: unknown	TCP traffic detected without corresponding DNS query: 93.123.85.8
Source: unknown	TCP traffic detected without corresponding DNS query: 93.123.85.8
Source: unknown	TCP traffic detected without corresponding DNS query: 93.123.85.8
Source: unknown	TCP traffic detected without corresponding DNS query: 93.123.85.8
Source: unknown	TCP traffic detected without corresponding DNS query: 93.123.85.8
Source: unknown	TCP traffic detected without corresponding DNS query: 93.123.85.8
Source: unknown	TCP traffic detected without corresponding DNS query: 93.123.85.8
Source: unknown	TCP traffic detected without corresponding DNS query: 93.123.85.8
Source: unknown	TCP traffic detected without corresponding DNS query: 93.123.85.8
Source: unknown	TCP traffic detected without corresponding DNS query: 93.123.85.8
Source: unknown	TCP traffic detected without corresponding DNS query: 93.123.85.8
Source: unknown	TCP traffic detected without corresponding DNS query: 93.123.85.8
Source: unknown	TCP traffic detected without corresponding DNS query: 93.123.85.8
Source: unknown	TCP traffic detected without corresponding DNS query: 93.123.85.8
Source: unknown	TCP traffic detected without corresponding DNS query: 93.123.85.8
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 93.123.85.8
Source: unknown	TCP traffic detected without corresponding DNS query: 93.123.85.8
Source: unknown	TCP traffic detected without corresponding DNS query: 93.123.85.8
Source: unknown	TCP traffic detected without corresponding DNS query: 93.123.85.8
Source: unknown	TCP traffic detected without corresponding DNS query: 93.123.85.8
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 93.123.85.8
Source: unknown	TCP traffic detected without corresponding DNS query: 93.123.85.8
Source: unknown	TCP traffic detected without corresponding DNS query: 93.123.85.8
Source: unknown	TCP traffic detected without corresponding DNS query: 93.123.85.8
Source: unknown	TCP traffic detected without corresponding DNS query: 93.123.85.8
Source: unknown	TCP traffic detected without corresponding DNS query: 93.123.85.8
Source: unknown	TCP traffic detected without corresponding DNS query: 93.123.85.8
Source: unknown	TCP traffic detected without corresponding DNS query: 93.123.85.8
Source: unknown	TCP traffic detected without corresponding DNS query: 93.123.85.8
Source: unknown	TCP traffic detected without corresponding DNS query: 93.123.85.8
Source: unknown	TCP traffic detected without corresponding DNS query: 93.123.85.8
Source: unknown	TCP traffic detected without corresponding DNS query: 93.123.85.8
Source: unknown	TCP traffic detected without corresponding DNS query: 93.123.85.8
Source: unknown	TCP traffic detected without corresponding DNS query: 93.123.85.8
Source: unknown	TCP traffic detected without corresponding DNS query: 93.123.85.8
Source: unknown	TCP traffic detected without corresponding DNS query: 93.123.85.8
Source: unknown	TCP traffic detected without corresponding DNS query: 93.123.85.8
Source: unknown	TCP traffic detected without corresponding DNS query: 93.123.85.8
Source: unknown	TCP traffic detected without corresponding DNS query: 93.123.85.8

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: a-r.m-5.Sakura.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6263.1.00007f2a34017000.00007f2a34028000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6265.1.00007f2a34017000.00007f2a34028000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: a-r.m-5.Sakura.elf PID: 6263, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: a-r.m-5.Sakura.elf PID: 6265, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Contains symbols with names commonly found in malware

Source: ELF static info symbol of initial sample

Name: vseattack

Source: a-r.m-5.Sakura.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6263.1.00007f2a34017000.00007f2a34028000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6265.1.00007f2a34017000.00007f2a34028000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: a-r.m-5.Sakura.elf PID: 6263, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: a-r.m-5.Sakura.elf PID: 6265, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.spre.troj.linELF@0/0@0/0

Source: a-r.m-5.Sakura.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: a-r.m-5.Sakura.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: a-r.m-5.Sakura.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: a-r.m-5.Sakura.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: a-r.m-5.Sakura.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: a-r.m-5.Sakura.elf	ELF static info symbol of initial sample: libc/string/arm/_memcpy.S
Source: a-r.m-5.Sakura.elf	ELF static info symbol of initial sample: libc/string/arm/bcopy.S
Source: a-r.m-5.Sakura.elf	ELF static info symbol of initial sample: libc/string/arm/memcpy.S
Source: a-r.m-5.Sakura.elf	ELF static info symbol of initial sample: libc/string/arm/memmove.S
Source: a-r.m-5.Sakura.elf	ELF static info symbol of initial sample: libc/string/arm/memset.S
Source: a-r.m-5.Sakura.elf	ELF static info symbol of initial sample: libc/string/arm/strcmp.S
Source: a-r.m-5.Sakura.elf	ELF static info symbol of initial sample: libc/string/arm/strlen.S
Source: a-r.m-5.Sakura.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/crt1.S
Source: a-r.m-5.Sakura.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/crti.S
Source: a-r.m-5.Sakura.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/crtn.S
Source: a-r.m-5.Sakura.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/sigrestorer.S

Source: /tmp/a-r.m-5.Sakura.elf (PID: 6263)

Queries kernel information via 'uname':

Jump to behavior

Source: a-r.m-5.Sakura.elf, 6263.1.00007ffca8008000.00007ffca8029000.rw-.sdmp, a-r.m-5.Sakura.elf, 6265.1.00007ffca8008000.00007ffca8029000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/a-r.m-5.Sakura.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/a-r.m-5.Sakura.elf
Source: a-r.m-5.Sakura.elf, 6263.1.000055c7d9a53000.000055c7d9b81000.rw-.sdmp, a-r.m-5.Sakura.elf, 6265.1.000055c7d9a53000.000055c7d9b81000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: a-r.m-5.Sakura.elf, 6263.1.000055c7d9a53000.000055c7d9b81000.rw-.sdmp, a-r.m-5.Sakura.elf, 6265.1.000055c7d9a53000.000055c7d9b81000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: a-r.m-5.Sakura.elf, 6263.1.00007ffca8008000.00007ffca8029000.rw-.sdmp, a-r.m-5.Sakura.elf, 6265.1.00007ffca8008000.00007ffca8029000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match

File source: a-r.m-5.Sakura.elf, type: SAMPLE

Yara detected Mirai

Source: Yara match	File source: a-r.m-5.Sakura.elf, type: SAMPLE
Source: Yara match	File source: 6263.1.00007f2a34017000.00007f2a34028000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6265.1.00007f2a34017000.00007f2a34028000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: a-r.m-5.Sakura.elf PID: 6263, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: a-r.m-5.Sakura.elf PID: 6265, type: MEMORYSTR

Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.71 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36

Remote Access Functionality

Yara detected Gafgyt

Source: Yara match

File source: a-r.m-5.Sakura.elf, type: SAMPLE

Yara detected Mirai

Source: Yara match	File source: a-r.m-5.Sakura.elf, type: SAMPLE
Source: Yara match	File source: 6263.1.00007f2a34017000.00007f2a34028000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6265.1.00007f2a34017000.00007f2a34028000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: a-r.m-5.Sakura.elf PID: 6263, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: a-r.m-5.Sakura.elf PID: 6265, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	1 Remote System Discovery	Remote Desktop Protocol	Data from Removable Media	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

Threatname: Gafgyt

{"C2 url": "93.123.85.8:12345"}

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
a-r.m-5.Sakura.elf	66%	ReversingLabs	Linux.Backdoor.Gafgyt
a-r.m-5.Sakura.elf	100%	Avira	LINUX/Gafgyt.opnd

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
93.123.85.8:12345	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
93.123.85.8	unknown	Bulgaria	43561	NET1-ASBG	true
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
93.123.85.8	x-3.2-.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	a-r.m-7.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	i-5.8-6.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	a-r.m-6.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	x-8.6-.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	p-p.c-.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	m-6.8-k.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	m-p.s-l.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	m-i.p-s.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	SwiftSec.mpsl.elf	Get hash	malicious	Mirai	Browse
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.43	a-r.m-7.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	la.bot.arm.elf	Get hash	malicious	Mirai	Browse
	la.bot.sh4.elf	Get hash	malicious	Mirai	Browse
	la.bot.mips.elf	Get hash	malicious	Mirai	Browse
	la.bot.m68k.elf	Get hash	malicious	Mirai	Browse
	m-p.s-l.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	mipsel.elf	Get hash	malicious	Mirai	Browse
	.i.elf	Get hash	malicious	Unknown	Browse
	la.bot.mipsel.elf	Get hash	malicious	Mirai	Browse
	la.bot.arm6.elf	Get hash	malicious	Mirai	Browse
91.189.91.42	a-r.m-7.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	la.bot.arm.elf	Get hash	malicious	Mirai	Browse
	la.bot.sh4.elf	Get hash	malicious	Mirai	Browse
	la.bot.mips.elf	Get hash	malicious	Mirai	Browse
	la.bot.m68k.elf	Get hash	malicious	Mirai	Browse
	m-p.s-l.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	powerpc.elf	Get hash	malicious	Mirai	Browse
	mipsel.elf	Get hash	malicious	Mirai	Browse
	main_arm6.elf	Get hash	malicious	Mirai	Browse
	main_x86.elf	Get hash	malicious	Mirai	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	a-r.m-7.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	armv6l.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	la.bot.arm.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	la.bot.sparc.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	la.bot.sh4.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	main_x86_64.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	la.bot.mips.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	la.bot.m68k.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	m-p.s-l.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	arc.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
CANONICAL-ASGB	a-r.m-7.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	armv6l.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	la.bot.arm.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	la.bot.sparc.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	la.bot.sh4.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	main_x86_64.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	la.bot.mips.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	la.bot.m68k.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	m-p.s-l.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	arc.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
NET1-ASBG	x-3.2-.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse	93.123.85.8
	a-r.m-7.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse	93.123.85.8
	i-5.8-6.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse	93.123.85.8
	a-r.m-6.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse	93.123.85.8
	x-8.6-.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse	93.123.85.8
	p-p.c-.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse	93.123.85.8
	m-6.8-k.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse	93.123.85.8
	m-p.s-l.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse	93.123.85.8
	m-i.p-s.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse	93.123.85.8
	x86.elf	Get hash	malicious	Unknown	Browse	93.123.30.205
INIT7CH	a-r.m-7.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse	109.202.202.202
	la.bot.arm.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	la.bot.sh4.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	la.bot.mips.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	la.bot.m68k.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	m-p.s-l.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse	109.202.202.202
	powerpc.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	mipsel.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	main_arm6.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	main_x86.elf	Get hash	malicious	Mirai	Browse	109.202.202.202

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, with debug_info, not stripped
Entropy (8bit):	5.962878628484677
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	a-r.m-5.Sakura.elf
File size:	100'871 bytes
MD5:	b6de2503408a3ff75574f6d237fb8ecd
SHA1:	67e23f3e2e26d7c73edfe41dd97b0ff118e673a8
SHA256:	ba157cda68d378aea0842c81d24c4bddabbbcbfa24755569f0e252366c3d0ab8
SHA512:	e138fa896a28989117872a124ee82eddbd62b89e8ee5deb1882b20fbe9040b143ae4ba9ea3e10fcee8975527c2d66fd8c91a66b393ab51bb82bcb8e52b6be93d
SSDEEP:	3072:VSx+i6mqaObhNunPNKV+qKmZuqQ4DPwXXtse:y6mRObnunP7qKmZuqQ4DPwXXtse
TLSH:	F9A31A44F841872BC3D327BBE78E479D3B36569467DB33116A386EB42BC17C92E29520
File Content Preview:	.ELF...a..........(.........4....&......4. ...(..........................................................g..........Q.td..................................-...L."....9..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	ARM - ABI
ABI Version:	0
Entry Point Address:	0x8190
Flags:	0x2
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	75400
Section Header Size:	40
Number of Section Headers:	20
Header String Table Index:	17

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x8094	0x94	0x18	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80b0	0xb0	0xe7c4	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x16874	0xe874	0x14	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x16888	0xe888	0x2690	0x0	0x2	A	0	0	4
.eh_frame	PROGBITS	0x18f18	0x10f18	0x4	0x0	0x2	A	0	0	4
.ctors	PROGBITS	0x21000	0x11000	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x21008	0x11008	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x21010	0x11010	0x4	0x0	0x3	WA	0	0	4
.data	PROGBITS	0x21014	0x11014	0x3a0	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x213b4	0x113b4	0x635c	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x113b4	0xa90	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x11e48	0xa0	0x0	0x0		0	0	8
.debug_info	PROGBITS	0x0	0x11ee8	0x30c	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x121f4	0x64	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x12258	0x2e7	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x12540	0xa0	0x0	0x0		0	0	4
.shstrtab	STRTAB	0x0	0x125e0	0xa8	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x129a8	0x3f10	0x10	0x0		19	572	4
.strtab	STRTAB	0x0	0x168b8	0x214f	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8000	0x8000	0x10f1c	0x10f1c	6.0987	0x5	R E	0x8000	.init .text .fini .rodata .eh_frame
LOAD	0x11000	0x21000	0x21000	0x3b4	0x6710	2.7469	0x6	RW	0x8000	.ctors .dtors .jcr .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x8094	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80b0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x16874	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x16888	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x18f18	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x21000	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x21008	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x21010	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x21014	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x213b4	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	19
$a	.symtab	0x8094	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x16874	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8128	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16880	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x8188	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x80a0	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x16838	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1686c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x80a4	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x80a8	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x16884	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x8190	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x81cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x82a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x83d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8438	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x87ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x90e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x956c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9984	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa83c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa9a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xac2c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb328	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb47c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb5e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb758	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc8e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xca4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xca68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcb34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdb60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe400	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xec14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xed24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xedf0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xedf4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xee44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xeeb8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xef08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xef30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xef5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xef88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xefb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xefe0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf00c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf05c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf088	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf0f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf120	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf150	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf17c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf1a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf1b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf1dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf1f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf228	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf240	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf250	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf260	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf300	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf320	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf380	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf488	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf4a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf59c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf5a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf618	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf6a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf6c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf70c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfa80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfaac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfad8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfb08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfb34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfb60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfb94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfbc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfbf0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfca8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfd14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfe68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xff58	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xffec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10114	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1025c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10260	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x102dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10368	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10400	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1047c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1053c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x105cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10698	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10760	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1076c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10774	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1090c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x109a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10b44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10b90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10bfc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10c40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10c9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10ee8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10fcc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10fd4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11000	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1102c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11058	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11084	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x110b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x110dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11134	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11188	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x111b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x111c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11310	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x117a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x117b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11868	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x118dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1191c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11a08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12214	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x124e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12530	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12548	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1256c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x125a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x125d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12754	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12760	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12a58	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12ac8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12ad8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12b90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12bc0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12c54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12d94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12f78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13010	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x130c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13190	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x131e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13210	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13230	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1329c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13578	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x136dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1393c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13a24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13adc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13b38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13b4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13c28	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13c5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13f84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13fb8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13fec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1409c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14158	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1481c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x148b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x148ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14a88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14ad4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14f98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x150c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x150fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x151a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x151c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x152a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x152b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1539c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15418	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x154c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1558c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x155d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15628	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15648	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15704	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15760	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15898	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x158c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15980	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15a84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15af4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15b28	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15f48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16190	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1628c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16378	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16384	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x164b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16580	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x165b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16614	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16754	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x21000	0	NOTYPE	<unknown>	DEFAULT	6
$d	.symtab	0x21008	0	NOTYPE	<unknown>	DEFAULT	7
$d	.symtab	0x2101c	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x8118	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8174	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16868	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x21020	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x81c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x21024	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x8298	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x83cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8434	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x87d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x90e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9568	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x997c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa820	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16d3c	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0xa9a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xac28	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb324	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb478	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb5dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb754	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc8cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xca48	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xca64	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xcb1c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdb24	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe3f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xebf8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf0f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf1f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf224	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x21050	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x21058	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0xf230	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf480	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf5a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf6a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf704	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xfa64	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xfca4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xfe50	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x21060	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0xff40	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1024c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x21168	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x102c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10350	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x103e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10464	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x21180	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x10538	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x105c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1068c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1075c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17ec0	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x10908	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10984	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x21234	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x10b40	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10b8c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10bec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10c3c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10c8c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10eb4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2124c	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x10fc4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11130	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x25614	0	NOTYPE	<unknown>	DEFAULT	10
$d	.symtab	0x111bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11a04	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x121e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x124a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x21254	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x12564	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x125a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12738	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12a28	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12ac4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12ad4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12b80	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2126c	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x17f44	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x12c44	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12d6c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12f54	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x130c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13298	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13574	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x136d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13934	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13c50	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13f80	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13fb4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x213a8	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x14808	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14a84	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14ac8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14f74	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x150c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15298	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15394	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15414	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15f10	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18ed0	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x16284	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16370	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x164a4	0	NOTYPE	<unknown>	DEFAULT	2
/home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
C.111.5062	.symtab	0x16d3c	8	OBJECT	<unknown>	DEFAULT	4
C.148.5389	.symtab	0x176b8	24	OBJECT	<unknown>	DEFAULT	4
Laligned	.symtab	0xf348	0	NOTYPE	<unknown>	DEFAULT	2
Llastword	.symtab	0xf364	0	NOTYPE	<unknown>	DEFAULT	2
Q	.symtab	0x213e8	16384	OBJECT	<unknown>	DEFAULT	10
Sakura_Bot.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
SendSTD	.symtab	0xb328	340	FUNC	<unknown>	DEFAULT	2
SendSTDHEX	.symtab	0xa83c	364	FUNC	<unknown>	DEFAULT	2
SendSTD_HEX	.symtab	0xb5e0	376	FUNC	<unknown>	DEFAULT	2
SendUDP	.symtab	0x9d00	1228	FUNC	<unknown>	DEFAULT	2
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x21004	0	OBJECT	<unknown>	DEFAULT	6
__CTOR_LIST__	.symtab	0x21000	0	OBJECT	<unknown>	DEFAULT	6
__C_ctype_b	.symtab	0x21050	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x178c0	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x213a8	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x17fa6	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x21058	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x17bc0	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x2100c	0	OBJECT	<unknown>	DEFAULT	7
__DTOR_LIST__	.symtab	0x21008	0	OBJECT	<unknown>	DEFAULT	7
__EH_FRAME_BEGIN__	.symtab	0x18f18	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x18f18	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x21050	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_b_data	.symtab	0x178c0	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_tolower	.symtab	0x213a8	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_tolower_data	.symtab	0x17fa6	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_toupper	.symtab	0x21058	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_toupper_data	.symtab	0x17bc0	768	OBJECT	<unknown>	HIDDEN	4
__GI___ctype_b	.symtab	0x21054	4	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_tolower	.symtab	0x213ac	4	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_toupper	.symtab	0x2105c	4	OBJECT	<unknown>	HIDDEN	9
__GI___errno_location	.symtab	0xf228	12	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x14f98	304	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x152a0	20	FUNC	<unknown>	HIDDEN	2
__GI___h_errno_location	.symtab	0x111b4	12	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0xee44	116	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl64	.symtab	0xeeb8	80	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0xf088	92	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x10b90	108	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x10c40	92	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x152b4	232	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0xef08	40	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x10114	328	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x10760	12	FUNC	<unknown>	HIDDEN	2
__GI_atol	.symtab	0x10760	12	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x1256c	60	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0xef5c	44	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0xef88	44	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0xfa80	44	FUNC	<unknown>	HIDDEN	2
__GI_errno	.symtab	0x25614	4	OBJECT	<unknown>	HIDDEN	10
__GI_exit	.symtab	0x1090c	148	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x125d4	384	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0xee44	116	FUNC	<unknown>	HIDDEN	2
__GI_fcntl64	.symtab	0xeeb8	80	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x12d94	484	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x14f98	304	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x12bc0	148	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x12f78	152	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x12754	12	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0xefb4	44	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x150c8	52	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x16378	12	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x16384	304	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x150fc	172	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x14f98	304	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x11000	44	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x1102c	44	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x11058	44	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname	.symtab	0xf6c8	68	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0xf70c	884	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0xefe0	44	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0xfaac	44	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x11084	44	FUNC	<unknown>	HIDDEN	2
__GI_h_errno	.symtab	0x25618	4	OBJECT	<unknown>	HIDDEN	10
__GI_inet_addr	.symtab	0xf6a4	36	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x1191c	236	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa	.symtab	0xf698	12	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa_r	.symtab	0xf618	128	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x136dc	608	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x13368	528	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x10698	200	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0xf00c	80	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x13210	32	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0xf05c	44	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x165b0	100	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x16190	252	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0xf250	4	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x117a0	4	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x151a8	24	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x1628c	236	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0xf260	156	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x110b0	44	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0xf088	92	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x125a8	44	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x12530	24	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x10260	124	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x1053c	144	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x13010	184	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0xf0f4	44	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0xfb08	44	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x110dc	88	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0xf120	48	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0xfb34	44	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0xfb60	52	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0xf150	44	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0xfb94	48	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x1047c	192	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x10ee8	228	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0xfbf0	184	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x11134	84	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x109a0	420	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0xfbc4	44	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x13fb8	52	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x105cc	204	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x1539c	124	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0xf380	264	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0xf300	28	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0xf300	28	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0xf488	28	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x131e0	48	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0xf320	96	FUNC	<unknown>	HIDDEN	2
__GI_strncat	.symtab	0x130c8	200	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x117b0	184	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x151c0	224	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x118dc	64	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x13190	80	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0xf4a4	248	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0xf59c	12	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x11868	116	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x1076c	8	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x13230	108	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0xf17c	44	FUNC	<unknown>	HIDDEN	2
__GI_tolower	.symtab	0x13f84	52	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0xf1f4	52	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x13fec	176	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x11188	44	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0xf1a8	8	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x155d8	80	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x15648	188	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x15628	32	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0xf1b0	44	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x21010	0	OBJECT	<unknown>	DEFAULT	8
__JCR_LIST__	.symtab	0x21010	0	OBJECT	<unknown>	DEFAULT	8
__aeabi_idiv	.symtab	0x16614	0	FUNC	<unknown>	DEFAULT	2
__aeabi_idiv0	.symtab	0xedf0	4	FUNC	<unknown>	DEFAULT	2
__aeabi_idivmod	.symtab	0x1673c	24	FUNC	<unknown>	DEFAULT	2
__aeabi_ldiv0	.symtab	0xedf0	4	FUNC	<unknown>	DEFAULT	2
__aeabi_uidiv	.symtab	0xec14	0	FUNC	<unknown>	DEFAULT	2
__aeabi_uidivmod	.symtab	0xed0c	24	FUNC	<unknown>	DEFAULT	2
__app_fini	.symtab	0x25608	4	OBJECT	<unknown>	HIDDEN	10
__atexit_lock	.symtab	0x21234	24	OBJECT	<unknown>	DEFAULT	9
__bsd_signal	.symtab	0xfbf0	184	FUNC	<unknown>	HIDDEN	2
__bss_end__	.symtab	0x27710	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start	.symtab	0x213b4	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start__	.symtab	0x213b4	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x10c08	56	FUNC	<unknown>	DEFAULT	2
__ctype_b	.symtab	0x21054	4	OBJECT	<unknown>	DEFAULT	9
__ctype_tolower	.symtab	0x213ac	4	OBJECT	<unknown>	DEFAULT	9
__ctype_toupper	.symtab	0x2105c	4	OBJECT	<unknown>	DEFAULT	9
__curbrk	.symtab	0x25638	4	OBJECT	<unknown>	HIDDEN	10
__data_start	.symtab	0x21014	0	NOTYPE	<unknown>	DEFAULT	9
__decode_answer	.symtab	0x13b4c	220	FUNC	<unknown>	HIDDEN	2
__decode_dotted	.symtab	0x154c0	204	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x13a24	184	FUNC	<unknown>	HIDDEN	2
__default_rt_sa_restorer	.symtab	0x10fd0	0	FUNC	<unknown>	DEFAULT	2
__default_sa_restorer	.symtab	0x10fcc	0	FUNC	<unknown>	DEFAULT	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__div0	.symtab	0xedf0	4	FUNC	<unknown>	DEFAULT	2
__divsi3	.symtab	0x16614	296	FUNC	<unknown>	DEFAULT	2
__dns_lookup	.symtab	0x11a08	2060	FUNC	<unknown>	HIDDEN	2
__do_global_ctors_aux	.symtab	0x16838	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x80b0	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x21018	0	OBJECT	<unknown>	HIDDEN	9
__encode_dotted	.symtab	0x15418	168	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x1393c	232	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x13adc	92	FUNC	<unknown>	HIDDEN	2
__end__	.symtab	0x27710	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__environ	.symtab	0x25600	4	OBJECT	<unknown>	DEFAULT	10
__errno_location	.symtab	0xf228	12	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x255f8	4	OBJECT	<unknown>	HIDDEN	10
__fgetc_unlocked	.symtab	0x14f98	304	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x21000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fini_array_start	.symtab	0x21000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__get_hosts_byname_r	.symtab	0x124e8	72	FUNC	<unknown>	HIDDEN	2
__glibc_strerror_r	.symtab	0x152a0	20	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__h_errno_location	.symtab	0x111b4	12	FUNC	<unknown>	DEFAULT	2
__h_errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__heap_alloc	.symtab	0xff58	148	FUNC	<unknown>	DEFAULT	2
__heap_free	.symtab	0x10020	244	FUNC	<unknown>	DEFAULT	2
__heap_link_free_area	.symtab	0xffec	32	FUNC	<unknown>	DEFAULT	2
__heap_link_free_area_after	.symtab	0x1000c	20	FUNC	<unknown>	DEFAULT	2
__init_array_end	.symtab	0x21000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__init_array_start	.symtab	0x21000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__length_dotted	.symtab	0x1558c	76	FUNC	<unknown>	HIDDEN	2
__length_question	.symtab	0x13b38	20	FUNC	<unknown>	HIDDEN	2
__libc_close	.symtab	0xef88	44	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0xfa80	44	FUNC	<unknown>	DEFAULT	2
__libc_creat	.symtab	0xf0e4	16	FUNC	<unknown>	DEFAULT	2
__libc_fcntl	.symtab	0xee44	116	FUNC	<unknown>	DEFAULT	2
__libc_fcntl64	.symtab	0xeeb8	80	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0xefb4	44	FUNC	<unknown>	DEFAULT	2
__libc_getpid	.symtab	0xefe0	44	FUNC	<unknown>	DEFAULT	2
__libc_lseek64	.symtab	0x165b0	100	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0x110b0	44	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0xf088	92	FUNC	<unknown>	DEFAULT	2
__libc_poll	.symtab	0x125a8	44	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0xf0f4	44	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0xfb08	44	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0xf120	48	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0xfb34	44	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0xfb60	52	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x10ee8	228	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x255fc	4	OBJECT	<unknown>	DEFAULT	10
__libc_waitpid	.symtab	0xf1a8	8	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0xf1b0	44	FUNC	<unknown>	DEFAULT	2
__malloc_heap	.symtab	0x21060	4	OBJECT	<unknown>	DEFAULT	9
__malloc_heap_lock	.symtab	0x255dc	24	OBJECT	<unknown>	DEFAULT	10
__malloc_sbrk_lock	.symtab	0x276cc	24	OBJECT	<unknown>	DEFAULT	10
__modsi3	.symtab	0x16754	228	FUNC	<unknown>	DEFAULT	2
__muldi3	.symtab	0xedf4	80	FUNC	<unknown>	DEFAULT	2
__nameserver	.symtab	0x276f4	12	OBJECT	<unknown>	HIDDEN	10
__nameservers	.symtab	0x27700	4	OBJECT	<unknown>	HIDDEN	10
__open_etc_hosts	.symtab	0x13c28	52	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x12214	724	FUNC	<unknown>	HIDDEN	2
__pagesize	.symtab	0x25604	4	OBJECT	<unknown>	DEFAULT	10
__preinit_array_end	.symtab	0x21000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__preinit_array_start	.symtab	0x21000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__pthread_initialize_minimal	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0x10bfc	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x10bfc	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x10bfc	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x10bfc	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x10bfc	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_void	.symtab	0x10c04	4	FUNC	<unknown>	DEFAULT	2
__raise	.symtab	0x12530	24	FUNC	<unknown>	HIDDEN	2
__read_etc_hosts_r	.symtab	0x13c5c	808	FUNC	<unknown>	HIDDEN	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__resolv_lock	.symtab	0x21254	24	OBJECT	<unknown>	DEFAULT	9
__rtld_fini	.symtab	0x2560c	4	OBJECT	<unknown>	HIDDEN	10
__searchdomain	.symtab	0x276e4	16	OBJECT	<unknown>	HIDDEN	10
__searchdomains	.symtab	0x27704	4	OBJECT	<unknown>	HIDDEN	10
__sigaddset	.symtab	0xfccc	36	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0xfcf0	36	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0xfca8	36	FUNC	<unknown>	DEFAULT	2
__stdin	.symtab	0x21278	4	OBJECT	<unknown>	DEFAULT	9
__stdio_READ	.symtab	0x15704	92	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x1409c	188	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x164b4	204	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x15760	312	FUNC	<unknown>	HIDDEN	2
__stdio_init_mutex	.symtab	0x12ac8	16	FUNC	<unknown>	HIDDEN	2
__stdio_mutex_initializer.3929	.symtab	0x17f44	24	OBJECT	<unknown>	DEFAULT	4
__stdio_rfill	.symtab	0x15898	44	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x16580	48	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x158c4	188	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x15980	260	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x12b90	48	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x2127c	4	OBJECT	<unknown>	DEFAULT	9
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_rt_sigaction	.symtab	0x10fd4	44	FUNC	<unknown>	HIDDEN	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uClibc_fini	.symtab	0x10b90	108	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x10c40	92	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x10c9c	588	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x2124c	4	OBJECT	<unknown>	HIDDEN	9
__udivsi3	.symtab	0xec14	248	FUNC	<unknown>	DEFAULT	2
__umodsi3	.symtab	0xed24	204	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r	.symtab	0x152b4	232	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_bss_end__	.symtab	0x27710	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_charpad	.symtab	0x14158	76	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_dl_aux_init	.symtab	0x12548	36	FUNC	<unknown>	DEFAULT	2
_dl_phdr	.symtab	0x27708	4	OBJECT	<unknown>	DEFAULT	10
_dl_phnum	.symtab	0x2770c	4	OBJECT	<unknown>	DEFAULT	10
_edata	.symtab	0x213b4	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x27710	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_errno	.symtab	0x25614	4	OBJECT	<unknown>	DEFAULT	10
_exit	.symtab	0xef08	40	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x16874	4	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x25644	8192	OBJECT	<unknown>	DEFAULT	10
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x141a4	132	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x15b28	1640	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_h_errno	.symtab	0x25618	4	OBJECT	<unknown>	DEFAULT	10
_init	.symtab	0x8094	4	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x15a84	112	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_memcpy	.symtab	0x11310	0	FUNC	<unknown>	HIDDEN	2
_ppfs_init	.symtab	0x1481c	152	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x14ad4	1220	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x148b4	56	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x148ec	412	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x14a88	76	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x10c04	4	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x10c04	4	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_sigintr	.symtab	0x2764c	128	OBJECT	<unknown>	HIDDEN	10
_start	.symtab	0x8190	0	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x12760	760	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x12a58	112	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x21280	4	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_add_lock	.symtab	0x21284	24	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_dec_use	.symtab	0x12c54	320	FUNC	<unknown>	DEFAULT	2
_stdio_openlist_del_count	.symtab	0x25640	4	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_del_lock	.symtab	0x2129c	24	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_use_count	.symtab	0x2563c	4	OBJECT	<unknown>	DEFAULT	10
_stdio_streams	.symtab	0x212b8	240	OBJECT	<unknown>	DEFAULT	9
_stdio_term	.symtab	0x12ad8	184	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x212b4	4	OBJECT	<unknown>	DEFAULT	9
_stdlib_strto_l	.symtab	0x10774	408	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x15af4	52	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x18360	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x111c0	336	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x14228	1524	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x10114	328	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
access	.symtab	0xef30	44	FUNC	<unknown>	DEFAULT	2
access.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
astd	.symtab	0xc8e8	356	FUNC	<unknown>	DEFAULT	2
atcp	.symtab	0xc278	1648	FUNC	<unknown>	DEFAULT	2
atoi	.symtab	0x10760	12	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x10760	12	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
audp	.symtab	0xbc64	1556	FUNC	<unknown>	DEFAULT	2
bcopy	.symtab	0xf240	16	FUNC	<unknown>	DEFAULT	2
been_there_done_that	.symtab	0x255f4	4	OBJECT	<unknown>	DEFAULT	10
been_there_done_that.2789	.symtab	0x25610	4	OBJECT	<unknown>	DEFAULT	10
brk	.symtab	0x1256c	60	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0xfbf0	184	FUNC	<unknown>	DEFAULT	2
buf.2613	.symtab	0x253ec	16	OBJECT	<unknown>	DEFAULT	10
buf.4901	.symtab	0x253fc	460	OBJECT	<unknown>	DEFAULT	10
c	.symtab	0x21048	4	OBJECT	<unknown>	DEFAULT	9
call___do_global_ctors_aux	.symtab	0x1686c	0	FUNC	<unknown>	DEFAULT	2
call___do_global_dtors_aux	.symtab	0x8128	0	FUNC	<unknown>	DEFAULT	2
call_frame_dummy	.symtab	0x8188	0	FUNC	<unknown>	DEFAULT	2
chdir	.symtab	0xef5c	44	FUNC	<unknown>	DEFAULT	2
chdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0xef88	44	FUNC	<unknown>	DEFAULT	2
close.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
commServer	.symtab	0x21024	4	OBJECT	<unknown>	DEFAULT	9
completed.2555	.symtab	0x213b4	1	OBJECT	<unknown>	DEFAULT	10
connect	.symtab	0xfa80	44	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connectTimeout	.symtab	0x956c	640	FUNC	<unknown>	DEFAULT	2
creat	.symtab	0xf0e4	16	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
csum	.symtab	0x9984	344	FUNC	<unknown>	DEFAULT	2
currentServer	.symtab	0x21044	4	OBJECT	<unknown>	DEFAULT	9
data_start	.symtab	0x21020	0	NOTYPE	<unknown>	DEFAULT	9
decodea.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dnslookup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ	.symtab	0x25600	4	OBJECT	<unknown>	DEFAULT	10
errno	.symtab	0x25614	4	OBJECT	<unknown>	DEFAULT	10
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x1090c	148	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x18ed0	72	OBJECT	<unknown>	DEFAULT	4
fclose	.symtab	0x125d4	384	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0xee44	116	FUNC	<unknown>	DEFAULT	2
fcntl64	.symtab	0xeeb8	80	FUNC	<unknown>	DEFAULT	2
fdgets	.symtab	0x8438	208	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x12d94	484	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x14f98	304	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x12bc0	148	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x12f78	152	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fmt	.symtab	0x18ebc	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x12754	12	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
force_to_data	.symtab	0x21014	0	OBJECT	<unknown>	DEFAULT	9
force_to_data	.symtab	0x213b0	0	OBJECT	<unknown>	DEFAULT	9
fork	.symtab	0xefb4	44	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs_unlocked	.symtab	0x150c8	52	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x8130	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0xfe68	240	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x16378	12	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x16378	12	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x16384	304	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ftcp	.symtab	0xa1cc	1648	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked	.symtab	0x150fc	172	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getArch	.symtab	0xca4c	28	FUNC	<unknown>	DEFAULT	2
getHost	.symtab	0x91ac	100	FUNC	<unknown>	DEFAULT	2
getOurIP	.symtab	0x8508	740	FUNC	<unknown>	DEFAULT	2
getPortz	.symtab	0xca68	204	FUNC	<unknown>	DEFAULT	2
getRandomIP	.symtab	0x83d8	96	FUNC	<unknown>	DEFAULT	2
get_hosts_byname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getc_unlocked	.symtab	0x14f98	304	FUNC	<unknown>	DEFAULT	2
getegid	.symtab	0x11000	44	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x1102c	44	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x11058	44	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname	.symtab	0xf6c8	68	FUNC	<unknown>	DEFAULT	2
gethostbyname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r	.symtab	0xf70c	884	FUNC	<unknown>	DEFAULT	2
gethostbyname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0xefe0	44	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockname	.symtab	0xfaac	44	FUNC	<unknown>	DEFAULT	2
getsockname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0xfad8	48	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x11084	44	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gotIP	.symtab	0x213d4	4	OBJECT	<unknown>	DEFAULT	10
h.4900	.symtab	0x255c8	20	OBJECT	<unknown>	DEFAULT	10
h_errno	.symtab	0x25618	4	OBJECT	<unknown>	DEFAULT	10
heap_alloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
heap_free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
htonl	.symtab	0xf5e0	36	FUNC	<unknown>	DEFAULT	2
htons	.symtab	0xf604	20	FUNC	<unknown>	DEFAULT	2
i.4126	.symtab	0x2104c	4	OBJECT	<unknown>	DEFAULT	9
index	.symtab	0xf380	264	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0xf6a4	36	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x1191c	236	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa	.symtab	0xf698	12	FUNC	<unknown>	DEFAULT	2
inet_ntoa.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa_r	.symtab	0xf618	128	FUNC	<unknown>	DEFAULT	2
inet_ntop	.symtab	0x136dc	608	FUNC	<unknown>	DEFAULT	2
inet_ntop4	.symtab	0x13578	356	FUNC	<unknown>	DEFAULT	2
inet_pton	.symtab	0x13368	528	FUNC	<unknown>	DEFAULT	2
inet_pton4	.symtab	0x1329c	204	FUNC	<unknown>	DEFAULT	2
initConnection	.symtab	0xe274	396	FUNC	<unknown>	DEFAULT	2
init_rand	.symtab	0x81cc	212	FUNC	<unknown>	DEFAULT	2
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initial_fa	.symtab	0x21064	260	OBJECT	<unknown>	DEFAULT	9
initstate	.symtab	0x10368	152	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x10698	200	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0xf00c	80	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isatty	.symtab	0x13210	32	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isspace	.symtab	0xf1dc	24	FUNC	<unknown>	DEFAULT	2
isspace.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0xf05c	44	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lengthd.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lengthq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/_memcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/bcopy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/memcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/memmove.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/memset.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/strcmp.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/strlen.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/crt1.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/crti.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/crtn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/sigrestorer.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libgcc2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
listFork	.symtab	0x97ec	408	FUNC	<unknown>	DEFAULT	2
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x165b0	100	FUNC	<unknown>	DEFAULT	2
macAddress	.symtab	0x213e0	6	OBJECT	<unknown>	DEFAULT	10
main	.symtab	0xe400	2068	FUNC	<unknown>	DEFAULT	2
mainCommSock	.symtab	0x213d0	4	OBJECT	<unknown>	DEFAULT	10
makeIPPacket	.symtab	0x9bec	276	FUNC	<unknown>	DEFAULT	2
makeRandomStr	.symtab	0x9210	136	FUNC	<unknown>	DEFAULT	2
makevsepacket	.symtab	0xaaf4	312	FUNC	<unknown>	DEFAULT	2
malloc	.symtab	0xfd14	340	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memchr	.symtab	0x16190	252	FUNC	<unknown>	DEFAULT	2
memchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memcpy	.symtab	0xf250	4	FUNC	<unknown>	DEFAULT	2
memmove	.symtab	0x117a0	4	FUNC	<unknown>	DEFAULT	2
mempcpy	.symtab	0x151a8	24	FUNC	<unknown>	DEFAULT	2
mempcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memrchr	.symtab	0x1628c	236	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0xf260	156	FUNC	<unknown>	DEFAULT	2
mylock	.symtab	0x21168	24	OBJECT	<unknown>	DEFAULT	9
mylock	.symtab	0x21180	24	OBJECT	<unknown>	DEFAULT	9
mylock	.symtab	0x2561c	24	OBJECT	<unknown>	DEFAULT	10
nanosleep	.symtab	0x110b0	44	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
next_start.1066	.symtab	0x253e8	4	OBJECT	<unknown>	DEFAULT	10
ntohl	.symtab	0xf5a8	36	FUNC	<unknown>	DEFAULT	2
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0xf5cc	20	FUNC	<unknown>	DEFAULT	2
ntop.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
numpids	.symtab	0x213d8	8	OBJECT	<unknown>	DEFAULT	10
object.2636	.symtab	0x213b8	24	OBJECT	<unknown>	DEFAULT	10
open	.symtab	0xf088	92	FUNC	<unknown>	DEFAULT	2
open.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opennameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ourIP	.symtab	0x27644	4	OBJECT	<unknown>	DEFAULT	10
p.2553	.symtab	0x2101c	0	OBJECT	<unknown>	DEFAULT	9
pids	.symtab	0x27648	4	OBJECT	<unknown>	DEFAULT	10
poll	.symtab	0x125a8	44	FUNC	<unknown>	DEFAULT	2
poll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prefix.4141	.symtab	0x182b8	12	OBJECT	<unknown>	DEFAULT	4
print	.symtab	0x8cf4	1008	FUNC	<unknown>	DEFAULT	2
printchar	.symtab	0x891c	108	FUNC	<unknown>	DEFAULT	2
printi	.symtab	0x8b0c	488	FUNC	<unknown>	DEFAULT	2
prints	.symtab	0x8988	388	FUNC	<unknown>	DEFAULT	2
processCmd	.symtab	0xcb34	5952	FUNC	<unknown>	DEFAULT	2
qual_chars.4147	.symtab	0x182cc	20	OBJECT	<unknown>	DEFAULT	4
raise	.symtab	0x12530	24	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x1025c	4	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand_cmwc	.symtab	0x82a0	312	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x10260	124	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x17ec0	40	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x1053c	144	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randtbl	.symtab	0x211b4	128	OBJECT	<unknown>	DEFAULT	9
rawmemchr	.symtab	0x13010	184	FUNC	<unknown>	DEFAULT	2
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read	.symtab	0xf0f4	44	FUNC	<unknown>	DEFAULT	2
read.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read_etc_hosts_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recv	.symtab	0xfb08	44	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recvLine	.symtab	0x9298	724	FUNC	<unknown>	DEFAULT	2
rtcp	.symtab	0xb758	1292	FUNC	<unknown>	DEFAULT	2
sbrk	.symtab	0x110dc	88	FUNC	<unknown>	DEFAULT	2
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
select	.symtab	0xf120	48	FUNC	<unknown>	DEFAULT	2
select.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send	.symtab	0xfb34	44	FUNC	<unknown>	DEFAULT	2
send.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sendto	.symtab	0xfb60	52	FUNC	<unknown>	DEFAULT	2
sendto.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsid	.symtab	0xf150	44	FUNC	<unknown>	DEFAULT	2
setsid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsockopt	.symtab	0xfb94	48	FUNC	<unknown>	DEFAULT	2
setsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate	.symtab	0x102dc	140	FUNC	<unknown>	DEFAULT	2
setstate_r	.symtab	0x1047c	192	FUNC	<unknown>	DEFAULT	2
sigaction	.symtab	0x10ee8	228	FUNC	<unknown>	DEFAULT	2
sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
signal	.symtab	0xfbf0	184	FUNC	<unknown>	DEFAULT	2
signal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigprocmask	.symtab	0x11134	84	FUNC	<unknown>	DEFAULT	2
sigprocmask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigsetops.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sleep	.symtab	0x109a0	420	FUNC	<unknown>	DEFAULT	2
sleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket	.symtab	0xfbc4	44	FUNC	<unknown>	DEFAULT	2
socket.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket_connect	.symtab	0xa9a8	332	FUNC	<unknown>	DEFAULT	2
sockprintf	.symtab	0x90e4	200	FUNC	<unknown>	DEFAULT	2
spec_and_mask.4146	.symtab	0x182e0	16	OBJECT	<unknown>	DEFAULT	4
spec_base.4140	.symtab	0x182c4	7	OBJECT	<unknown>	DEFAULT	4
spec_chars.4143	.symtab	0x1830c	21	OBJECT	<unknown>	DEFAULT	4
spec_flags.4142	.symtab	0x18324	8	OBJECT	<unknown>	DEFAULT	4
spec_or_mask.4145	.symtab	0x182f0	16	OBJECT	<unknown>	DEFAULT	4
spec_ranges.4144	.symtab	0x18300	9	OBJECT	<unknown>	DEFAULT	4
sprintf	.symtab	0x13fb8	52	FUNC	<unknown>	DEFAULT	2
sprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
srand	.symtab	0x10400	124	FUNC	<unknown>	DEFAULT	2
srandom	.symtab	0x10400	124	FUNC	<unknown>	DEFAULT	2
srandom_r	.symtab	0x105cc	204	FUNC	<unknown>	DEFAULT	2
static_id	.symtab	0x21250	2	OBJECT	<unknown>	DEFAULT	9
static_ns	.symtab	0x25634	4	OBJECT	<unknown>	DEFAULT	10
stderr	.symtab	0x21274	4	OBJECT	<unknown>	DEFAULT	9
stdhexflood	.symtab	0xb47c	356	FUNC	<unknown>	DEFAULT	2
stdin	.symtab	0x2126c	4	OBJECT	<unknown>	DEFAULT	9
stdout	.symtab	0x21270	4	OBJECT	<unknown>	DEFAULT	9
strcasecmp	.symtab	0x1539c	124	FUNC	<unknown>	DEFAULT	2
strcasecmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchr	.symtab	0xf380	264	FUNC	<unknown>	DEFAULT	2
strchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcmp	.symtab	0xf300	28	FUNC	<unknown>	DEFAULT	2
strcoll	.symtab	0xf300	28	FUNC	<unknown>	DEFAULT	2
strcpy	.symtab	0xf488	28	FUNC	<unknown>	DEFAULT	2
strcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strdup	.symtab	0x131e0	48	FUNC	<unknown>	DEFAULT	2
strdup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strerror_r	.symtab	0x152b4	232	FUNC	<unknown>	DEFAULT	2
strlen	.symtab	0xf320	96	FUNC	<unknown>	DEFAULT	2
strncat	.symtab	0x130c8	200	FUNC	<unknown>	DEFAULT	2
strncat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncpy	.symtab	0x117b0	184	FUNC	<unknown>	DEFAULT	2
strncpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strnlen	.symtab	0x151c0	224	FUNC	<unknown>	DEFAULT	2
strnlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strpbrk	.symtab	0x118dc	64	FUNC	<unknown>	DEFAULT	2
strpbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strspn	.symtab	0x13190	80	FUNC	<unknown>	DEFAULT	2
strspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strstr	.symtab	0xf4a4	248	FUNC	<unknown>	DEFAULT	2
strstr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok	.symtab	0xf59c	12	FUNC	<unknown>	DEFAULT	2
strtok.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok_r	.symtab	0x11868	116	FUNC	<unknown>	DEFAULT	2
strtok_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtol	.symtab	0x1076c	8	FUNC	<unknown>	DEFAULT	2
strtol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcgetattr	.symtab	0x13230	108	FUNC	<unknown>	DEFAULT	2
tcgetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcpcsum	.symtab	0x9adc	272	FUNC	<unknown>	DEFAULT	2
time	.symtab	0xf17c	44	FUNC	<unknown>	DEFAULT	2
time.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tolower	.symtab	0x13f84	52	FUNC	<unknown>	DEFAULT	2
tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
toupper	.symtab	0xf1f4	52	FUNC	<unknown>	DEFAULT	2
toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
trim	.symtab	0x87ec	304	FUNC	<unknown>	DEFAULT	2
type_codes	.symtab	0x1832c	24	OBJECT	<unknown>	DEFAULT	4
type_sizes	.symtab	0x18344	12	OBJECT	<unknown>	DEFAULT	4
unknown.1088	.symtab	0x18350	14	OBJECT	<unknown>	DEFAULT	4
unsafe_state	.symtab	0x21198	28	OBJECT	<unknown>	DEFAULT	9
useragents	.symtab	0x21028	28	OBJECT	<unknown>	DEFAULT	9
usleep	.symtab	0x10b44	76	FUNC	<unknown>	DEFAULT	2
usleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
vseattack	.symtab	0xac2c	1788	FUNC	<unknown>	DEFAULT	2
vsnprintf	.symtab	0x13fec	176	FUNC	<unknown>	DEFAULT	2
vsnprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wait4	.symtab	0x11188	44	FUNC	<unknown>	DEFAULT	2
wait4.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
waitpid	.symtab	0xf1a8	8	FUNC	<unknown>	DEFAULT	2
waitpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcrtomb	.symtab	0x155d8	80	FUNC	<unknown>	DEFAULT	2
wcrtomb.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsnrtombs	.symtab	0x15648	188	FUNC	<unknown>	DEFAULT	2
wcsnrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsrtombs	.symtab	0x15628	32	FUNC	<unknown>	DEFAULT	2
wcsrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
write	.symtab	0xf1b0	44	FUNC	<unknown>	DEFAULT	2
write.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
xdigits.3041	.symtab	0x17f70	17	OBJECT	<unknown>	DEFAULT	4

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-16T11:51:49.306025+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55686	93.123.85.8	12345	TCP
2024-12-16T11:51:50.483837+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55688	93.123.85.8	12345	TCP
2024-12-16T11:51:51.656930+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55690	93.123.85.8	12345	TCP
2024-12-16T11:51:52.830054+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55692	93.123.85.8	12345	TCP
2024-12-16T11:51:54.005249+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55694	93.123.85.8	12345	TCP
2024-12-16T11:51:55.217093+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55696	93.123.85.8	12345	TCP
2024-12-16T11:51:56.398501+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55698	93.123.85.8	12345	TCP
2024-12-16T11:51:57.573518+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55700	93.123.85.8	12345	TCP
2024-12-16T11:51:58.752717+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55702	93.123.85.8	12345	TCP
2024-12-16T11:51:59.925855+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55704	93.123.85.8	12345	TCP
2024-12-16T11:52:01.099975+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55706	93.123.85.8	12345	TCP
2024-12-16T11:52:02.275910+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55708	93.123.85.8	12345	TCP
2024-12-16T11:52:03.449213+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55710	93.123.85.8	12345	TCP
2024-12-16T11:52:04.624283+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55712	93.123.85.8	12345	TCP
2024-12-16T11:52:05.797808+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55714	93.123.85.8	12345	TCP
2024-12-16T11:52:06.971695+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55716	93.123.85.8	12345	TCP
2024-12-16T11:52:08.166659+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55718	93.123.85.8	12345	TCP
2024-12-16T11:52:09.343609+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55720	93.123.85.8	12345	TCP
2024-12-16T11:52:10.518768+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55722	93.123.85.8	12345	TCP
2024-12-16T11:52:11.694052+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55724	93.123.85.8	12345	TCP
2024-12-16T11:52:12.873466+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55726	93.123.85.8	12345	TCP
2024-12-16T11:52:14.053815+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55728	93.123.85.8	12345	TCP
2024-12-16T11:52:15.228399+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55730	93.123.85.8	12345	TCP
2024-12-16T11:52:16.403990+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55732	93.123.85.8	12345	TCP
2024-12-16T11:52:17.577271+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55734	93.123.85.8	12345	TCP
2024-12-16T11:52:18.750864+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55736	93.123.85.8	12345	TCP
2024-12-16T11:52:19.928027+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55738	93.123.85.8	12345	TCP
2024-12-16T11:52:21.101262+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55740	93.123.85.8	12345	TCP
2024-12-16T11:52:22.278138+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55742	93.123.85.8	12345	TCP
2024-12-16T11:52:23.460429+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55744	93.123.85.8	12345	TCP
2024-12-16T11:52:24.633126+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55746	93.123.85.8	12345	TCP
2024-12-16T11:52:25.818808+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55748	93.123.85.8	12345	TCP
2024-12-16T11:52:26.992782+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55750	93.123.85.8	12345	TCP
2024-12-16T11:52:28.166689+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55752	93.123.85.8	12345	TCP
2024-12-16T11:52:29.341877+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55754	93.123.85.8	12345	TCP
2024-12-16T11:52:30.516923+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55756	93.123.85.8	12345	TCP
2024-12-16T11:52:31.690935+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55758	93.123.85.8	12345	TCP
2024-12-16T11:52:32.879567+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55760	93.123.85.8	12345	TCP
2024-12-16T11:52:34.055654+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55762	93.123.85.8	12345	TCP
2024-12-16T11:52:35.229404+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55764	93.123.85.8	12345	TCP
2024-12-16T11:52:36.403118+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55766	93.123.85.8	12345	TCP
2024-12-16T11:52:37.576289+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55768	93.123.85.8	12345	TCP
2024-12-16T11:52:38.754863+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55770	93.123.85.8	12345	TCP
2024-12-16T11:52:39.931023+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55772	93.123.85.8	12345	TCP
2024-12-16T11:52:41.104566+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55774	93.123.85.8	12345	TCP
2024-12-16T11:52:42.280723+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55776	93.123.85.8	12345	TCP
2024-12-16T11:52:43.454143+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55778	93.123.85.8	12345	TCP
2024-12-16T11:52:44.664590+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55780	93.123.85.8	12345	TCP
2024-12-16T11:52:45.838142+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55782	93.123.85.8	12345	TCP
2024-12-16T11:52:47.012088+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55784	93.123.85.8	12345	TCP
2024-12-16T11:52:48.185544+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55786	93.123.85.8	12345	TCP
2024-12-16T11:52:49.359407+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55788	93.123.85.8	12345	TCP
2024-12-16T11:52:50.533535+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55790	93.123.85.8	12345	TCP
2024-12-16T11:52:51.707347+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55792	93.123.85.8	12345	TCP
2024-12-16T11:52:52.881934+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55794	93.123.85.8	12345	TCP
2024-12-16T11:52:54.054221+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55796	93.123.85.8	12345	TCP
2024-12-16T11:52:55.228317+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55798	93.123.85.8	12345	TCP
2024-12-16T11:52:56.403415+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55800	93.123.85.8	12345	TCP
2024-12-16T11:52:57.577996+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55802	93.123.85.8	12345	TCP
2024-12-16T11:52:58.752745+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55804	93.123.85.8	12345	TCP
2024-12-16T11:52:59.930974+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55806	93.123.85.8	12345	TCP
2024-12-16T11:53:01.104722+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55808	93.123.85.8	12345	TCP
2024-12-16T11:53:02.279925+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55810	93.123.85.8	12345	TCP
2024-12-16T11:53:03.452653+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55812	93.123.85.8	12345	TCP
2024-12-16T11:53:04.628850+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55814	93.123.85.8	12345	TCP
2024-12-16T11:53:05.802658+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55816	93.123.85.8	12345	TCP
2024-12-16T11:53:06.978212+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55818	93.123.85.8	12345	TCP
2024-12-16T11:53:08.151846+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55820	93.123.85.8	12345	TCP
2024-12-16T11:53:30.207508+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55822	93.123.85.8	12345	TCP
2024-12-16T11:53:52.222787+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55824	93.123.85.8	12345	TCP
2024-12-16T11:54:14.237872+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55826	93.123.85.8	12345	TCP
2024-12-16T11:54:36.269192+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55828	93.123.85.8	12345	TCP
2024-12-16T11:54:58.302428+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55830	93.123.85.8	12345	TCP
2024-12-16T11:55:20.334942+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	55832	93.123.85.8	12345	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 16, 2024 11:51:49.117846966 CET	55686	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:51:49.304549932 CET	12345	55686	93.123.85.8	192.168.2.23
Dec 16, 2024 11:51:49.304647923 CET	55686	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:51:49.306025028 CET	55686	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:51:49.425889969 CET	12345	55686	93.123.85.8	192.168.2.23
Dec 16, 2024 11:51:50.113784075 CET	43928	443	192.168.2.23	91.189.91.42
Dec 16, 2024 11:51:50.362006903 CET	12345	55686	93.123.85.8	192.168.2.23
Dec 16, 2024 11:51:50.362077951 CET	12345	55686	93.123.85.8	192.168.2.23
Dec 16, 2024 11:51:50.362123966 CET	55686	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:51:50.362751007 CET	55686	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:51:50.363941908 CET	55688	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:51:50.482517958 CET	12345	55686	93.123.85.8	192.168.2.23
Dec 16, 2024 11:51:50.483665943 CET	12345	55688	93.123.85.8	192.168.2.23
Dec 16, 2024 11:51:50.483781099 CET	55688	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:51:50.483836889 CET	55688	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:51:50.603715897 CET	12345	55688	93.123.85.8	192.168.2.23
Dec 16, 2024 11:51:51.535831928 CET	12345	55688	93.123.85.8	192.168.2.23
Dec 16, 2024 11:51:51.535911083 CET	12345	55688	93.123.85.8	192.168.2.23
Dec 16, 2024 11:51:51.536075115 CET	55688	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:51:51.536075115 CET	55688	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:51:51.536883116 CET	55690	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:51:51.655844927 CET	12345	55688	93.123.85.8	192.168.2.23
Dec 16, 2024 11:51:51.656687021 CET	12345	55690	93.123.85.8	192.168.2.23
Dec 16, 2024 11:51:51.656929970 CET	55690	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:51:51.656929970 CET	55690	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:51:51.776731968 CET	12345	55690	93.123.85.8	192.168.2.23
Dec 16, 2024 11:51:52.708884001 CET	12345	55690	93.123.85.8	192.168.2.23
Dec 16, 2024 11:51:52.708966017 CET	12345	55690	93.123.85.8	192.168.2.23
Dec 16, 2024 11:51:52.709037066 CET	55690	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:51:52.709106922 CET	55690	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:51:52.709824085 CET	55692	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:51:52.829041004 CET	12345	55690	93.123.85.8	192.168.2.23
Dec 16, 2024 11:51:52.829834938 CET	12345	55692	93.123.85.8	192.168.2.23
Dec 16, 2024 11:51:52.829967022 CET	55692	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:51:52.830054045 CET	55692	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:51:52.950666904 CET	12345	55692	93.123.85.8	192.168.2.23
Dec 16, 2024 11:51:53.884469032 CET	12345	55692	93.123.85.8	192.168.2.23
Dec 16, 2024 11:51:53.884521008 CET	12345	55692	93.123.85.8	192.168.2.23
Dec 16, 2024 11:51:53.884757996 CET	55692	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:51:53.884758949 CET	55692	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:51:53.885332108 CET	55694	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:51:54.004591942 CET	12345	55692	93.123.85.8	192.168.2.23
Dec 16, 2024 11:51:54.005003929 CET	12345	55694	93.123.85.8	192.168.2.23
Dec 16, 2024 11:51:54.005249023 CET	55694	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:51:54.005249023 CET	55694	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:51:54.125160933 CET	12345	55694	93.123.85.8	192.168.2.23
Dec 16, 2024 11:51:54.465204954 CET	42516	80	192.168.2.23	109.202.202.202
Dec 16, 2024 11:51:55.096350908 CET	12345	55694	93.123.85.8	192.168.2.23
Dec 16, 2024 11:51:55.096379042 CET	12345	55694	93.123.85.8	192.168.2.23
Dec 16, 2024 11:51:55.096481085 CET	55694	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:51:55.096566916 CET	55694	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:51:55.097143888 CET	55696	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:51:55.216379881 CET	12345	55694	93.123.85.8	192.168.2.23
Dec 16, 2024 11:51:55.216887951 CET	12345	55696	93.123.85.8	192.168.2.23
Dec 16, 2024 11:51:55.216998100 CET	55696	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:51:55.217092991 CET	55696	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:51:55.336810112 CET	12345	55696	93.123.85.8	192.168.2.23
Dec 16, 2024 11:51:55.489027023 CET	42836	443	192.168.2.23	91.189.91.43
Dec 16, 2024 11:51:56.277221918 CET	12345	55696	93.123.85.8	192.168.2.23
Dec 16, 2024 11:51:56.277251005 CET	12345	55696	93.123.85.8	192.168.2.23
Dec 16, 2024 11:51:56.277510881 CET	55696	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:51:56.277512074 CET	55696	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:51:56.278549910 CET	55698	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:51:56.397480965 CET	12345	55696	93.123.85.8	192.168.2.23
Dec 16, 2024 11:51:56.398296118 CET	12345	55698	93.123.85.8	192.168.2.23
Dec 16, 2024 11:51:56.398412943 CET	55698	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:51:56.398500919 CET	55698	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:51:56.518269062 CET	12345	55698	93.123.85.8	192.168.2.23
Dec 16, 2024 11:51:57.450861931 CET	12345	55698	93.123.85.8	192.168.2.23
Dec 16, 2024 11:51:57.450954914 CET	12345	55698	93.123.85.8	192.168.2.23
Dec 16, 2024 11:51:57.450984001 CET	55698	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:51:57.451081038 CET	55698	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:51:57.451849937 CET	55700	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:51:57.573201895 CET	12345	55698	93.123.85.8	192.168.2.23
Dec 16, 2024 11:51:57.573214054 CET	12345	55700	93.123.85.8	192.168.2.23
Dec 16, 2024 11:51:57.573342085 CET	55700	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:51:57.573518038 CET	55700	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:51:57.694706917 CET	12345	55700	93.123.85.8	192.168.2.23
Dec 16, 2024 11:51:58.631175041 CET	12345	55700	93.123.85.8	192.168.2.23
Dec 16, 2024 11:51:58.631333113 CET	55700	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:51:58.631375074 CET	12345	55700	93.123.85.8	192.168.2.23
Dec 16, 2024 11:51:58.631490946 CET	55700	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:51:58.632405043 CET	55702	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:51:58.751280069 CET	12345	55700	93.123.85.8	192.168.2.23
Dec 16, 2024 11:51:58.752289057 CET	12345	55702	93.123.85.8	192.168.2.23
Dec 16, 2024 11:51:58.752372980 CET	55702	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:51:58.752717018 CET	55702	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:51:58.872478008 CET	12345	55702	93.123.85.8	192.168.2.23
Dec 16, 2024 11:51:59.804862022 CET	12345	55702	93.123.85.8	192.168.2.23
Dec 16, 2024 11:51:59.804992914 CET	55702	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:51:59.805082083 CET	12345	55702	93.123.85.8	192.168.2.23
Dec 16, 2024 11:51:59.805165052 CET	55702	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:51:59.805874109 CET	55704	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:51:59.924910069 CET	12345	55702	93.123.85.8	192.168.2.23
Dec 16, 2024 11:51:59.925673962 CET	12345	55704	93.123.85.8	192.168.2.23
Dec 16, 2024 11:51:59.925769091 CET	55704	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:51:59.925854921 CET	55704	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:00.045922995 CET	12345	55704	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:00.979098082 CET	12345	55704	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:00.979115963 CET	12345	55704	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:00.979253054 CET	55704	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:00.979366064 CET	55704	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:00.980088949 CET	55706	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:01.099224091 CET	12345	55704	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:01.099776030 CET	12345	55706	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:01.099975109 CET	55706	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:01.099975109 CET	55706	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:01.221177101 CET	12345	55706	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:02.154372931 CET	12345	55706	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:02.154388905 CET	12345	55706	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:02.154694080 CET	55706	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:02.154812098 CET	55706	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:02.155673027 CET	55708	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:02.274843931 CET	12345	55706	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:02.275490046 CET	12345	55708	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:02.275602102 CET	55708	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:02.275909901 CET	55708	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:02.395617008 CET	12345	55708	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:03.328109026 CET	12345	55708	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:03.328172922 CET	12345	55708	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:03.328352928 CET	55708	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:03.328419924 CET	55708	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:03.329210043 CET	55710	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:03.448152065 CET	12345	55708	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:03.448978901 CET	12345	55710	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:03.449098110 CET	55710	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:03.449213028 CET	55710	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:03.568916082 CET	12345	55710	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:04.502841949 CET	12345	55710	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:04.503034115 CET	12345	55710	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:04.503330946 CET	55710	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:04.503330946 CET	55710	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:04.504220009 CET	55712	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:04.623159885 CET	12345	55710	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:04.623928070 CET	12345	55712	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:04.624177933 CET	55712	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:04.624283075 CET	55712	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:04.743957043 CET	12345	55712	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:05.676423073 CET	12345	55712	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:05.676556110 CET	55712	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:05.676578045 CET	12345	55712	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:05.676640987 CET	55712	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:05.677550077 CET	55714	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:05.796386003 CET	12345	55712	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:05.797456980 CET	12345	55714	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:05.797564983 CET	55714	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:05.797807932 CET	55714	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:05.917514086 CET	12345	55714	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:06.850248098 CET	12345	55714	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:06.850409985 CET	12345	55714	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:06.850433111 CET	55714	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:06.850606918 CET	55714	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:06.851506948 CET	55716	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:06.970312119 CET	12345	55714	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:06.971354961 CET	12345	55716	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:06.971589088 CET	55716	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:06.971694946 CET	55716	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:07.091505051 CET	12345	55716	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:08.044687033 CET	12345	55716	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:08.044747114 CET	12345	55716	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:08.044929981 CET	55716	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:08.045033932 CET	55716	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:08.046324968 CET	55718	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:08.164791107 CET	12345	55716	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:08.166297913 CET	12345	55718	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:08.166408062 CET	55718	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:08.166659117 CET	55718	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:08.286473036 CET	12345	55718	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:09.222011089 CET	12345	55718	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:09.222107887 CET	12345	55718	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:09.222393036 CET	55718	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:09.222466946 CET	55718	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:09.223542929 CET	55720	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:09.342433929 CET	12345	55718	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:09.343348980 CET	12345	55720	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:09.343465090 CET	55720	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:09.343609095 CET	55720	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:09.463814020 CET	12345	55720	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:10.079216003 CET	43928	443	192.168.2.23	91.189.91.42
Dec 16, 2024 11:52:10.397325039 CET	12345	55720	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:10.397419930 CET	12345	55720	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:10.397481918 CET	55720	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:10.397550106 CET	55720	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:10.398279905 CET	55722	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:10.517812014 CET	12345	55720	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:10.518461943 CET	12345	55722	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:10.518573999 CET	55722	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:10.518768072 CET	55722	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:10.639362097 CET	12345	55722	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:11.571541071 CET	12345	55722	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:11.571707010 CET	12345	55722	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:11.571743011 CET	55722	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:11.571904898 CET	55722	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:11.573080063 CET	55724	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:11.691996098 CET	12345	55722	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:11.693873882 CET	12345	55724	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:11.693979025 CET	55724	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:11.694051981 CET	55724	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:11.813921928 CET	12345	55724	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:12.751492023 CET	12345	55724	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:12.751553059 CET	12345	55724	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:12.751766920 CET	55724	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:12.751861095 CET	55724	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:12.753138065 CET	55726	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:12.871809006 CET	12345	55724	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:12.873164892 CET	12345	55726	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:12.873317003 CET	55726	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:12.873466015 CET	55726	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:12.994673014 CET	12345	55726	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:13.932043076 CET	12345	55726	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:13.932110071 CET	12345	55726	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:13.932410002 CET	55726	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:13.932549000 CET	55726	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:13.933538914 CET	55728	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:14.052366972 CET	12345	55726	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:14.053458929 CET	12345	55728	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:14.053706884 CET	55728	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:14.053814888 CET	55728	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:14.173537016 CET	12345	55728	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:15.106935024 CET	12345	55728	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:15.106997013 CET	12345	55728	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:15.107254028 CET	55728	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:15.107348919 CET	55728	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:15.108268023 CET	55730	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:15.227220058 CET	12345	55728	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:15.228132963 CET	12345	55730	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:15.228281021 CET	55730	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:15.228399038 CET	55730	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:15.348189116 CET	12345	55730	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:16.282463074 CET	12345	55730	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:16.282615900 CET	12345	55730	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:16.282644033 CET	55730	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:16.282737970 CET	55730	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:16.283624887 CET	55732	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:16.403055906 CET	12345	55730	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:16.403594971 CET	12345	55732	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:16.403719902 CET	55732	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:16.403990030 CET	55732	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:16.523962021 CET	12345	55732	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:17.456417084 CET	12345	55732	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:17.456532955 CET	12345	55732	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:17.456615925 CET	55732	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:17.456671000 CET	55732	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:17.457303047 CET	55734	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:17.576459885 CET	12345	55732	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:17.577002048 CET	12345	55734	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:17.577089071 CET	55734	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:17.577270985 CET	55734	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:17.696907997 CET	12345	55734	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:18.629582882 CET	12345	55734	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:18.629767895 CET	12345	55734	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:18.629807949 CET	55734	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:18.629849911 CET	55734	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:18.630682945 CET	55736	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:18.749763966 CET	12345	55734	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:18.750647068 CET	12345	55736	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:18.750750065 CET	55736	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:18.750864029 CET	55736	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:18.870683908 CET	12345	55736	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:19.807185888 CET	12345	55736	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:19.807363987 CET	12345	55736	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:19.807429075 CET	55736	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:19.807524920 CET	55736	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:19.808072090 CET	55738	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:19.927349091 CET	12345	55736	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:19.927833080 CET	12345	55738	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:19.927963018 CET	55738	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:19.928026915 CET	55738	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:20.047790051 CET	12345	55738	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:20.979886055 CET	12345	55738	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:20.980086088 CET	12345	55738	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:20.980191946 CET	55738	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:20.980254889 CET	55738	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:20.981287956 CET	55740	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:21.100261927 CET	12345	55738	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:21.101038933 CET	12345	55740	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:21.101262093 CET	55740	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:21.101262093 CET	55740	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:21.221081972 CET	12345	55740	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:22.156714916 CET	12345	55740	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:22.156863928 CET	55740	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:22.156979084 CET	12345	55740	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:22.157231092 CET	55740	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:22.158076048 CET	55742	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:22.276990891 CET	12345	55740	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:22.277882099 CET	12345	55742	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:22.278021097 CET	55742	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:22.278137922 CET	55742	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:22.365447044 CET	42836	443	192.168.2.23	91.189.91.43
Dec 16, 2024 11:52:22.397834063 CET	12345	55742	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:23.338984966 CET	12345	55742	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:23.339025974 CET	12345	55742	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:23.339190960 CET	55742	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:23.339240074 CET	55742	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:23.340190887 CET	55744	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:23.459042072 CET	12345	55742	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:23.460184097 CET	12345	55744	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:23.460340023 CET	55744	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:23.460428953 CET	55744	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:23.580240011 CET	12345	55744	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:24.413141012 CET	42516	80	192.168.2.23	109.202.202.202
Dec 16, 2024 11:52:24.512099981 CET	12345	55744	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:24.512207985 CET	55744	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:24.512226105 CET	12345	55744	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:24.512315989 CET	55744	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:24.513179064 CET	55746	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:24.632137060 CET	12345	55744	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:24.632936954 CET	12345	55746	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:24.633038044 CET	55746	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:24.633126020 CET	55746	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:24.752953053 CET	12345	55746	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:25.697753906 CET	12345	55746	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:25.697964907 CET	55746	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:25.698088884 CET	12345	55746	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:25.698143959 CET	55746	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:25.698833942 CET	55748	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:25.817858934 CET	12345	55746	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:25.818640947 CET	12345	55748	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:25.818727016 CET	55748	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:25.818808079 CET	55748	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:25.940613031 CET	12345	55748	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:26.871190071 CET	12345	55748	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:26.871275902 CET	12345	55748	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:26.871357918 CET	55748	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:26.871428967 CET	55748	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:26.872241020 CET	55750	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:26.991770029 CET	12345	55748	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:26.992455959 CET	12345	55750	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:26.992600918 CET	55750	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:26.992782116 CET	55750	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:27.112453938 CET	12345	55750	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:28.045509100 CET	12345	55750	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:28.045610905 CET	12345	55750	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:28.045670033 CET	55750	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:28.045779943 CET	55750	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:28.046550035 CET	55752	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:28.165925980 CET	12345	55750	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:28.166399956 CET	12345	55752	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:28.166523933 CET	55752	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:28.166688919 CET	55752	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:28.286710024 CET	12345	55752	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:29.220957041 CET	12345	55752	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:29.221050978 CET	12345	55752	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:29.221085072 CET	55752	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:29.221163988 CET	55752	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:29.221818924 CET	55754	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:29.341260910 CET	12345	55752	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:29.341718912 CET	12345	55754	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:29.341801882 CET	55754	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:29.341876984 CET	55754	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:29.464160919 CET	12345	55754	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:30.394232988 CET	12345	55754	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:30.394342899 CET	12345	55754	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:30.394551039 CET	55754	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:30.394718885 CET	55754	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:30.395848989 CET	55756	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:30.514528990 CET	12345	55754	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:30.516653061 CET	12345	55756	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:30.516771078 CET	55756	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:30.516922951 CET	55756	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:30.637171984 CET	12345	55756	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:31.569152117 CET	12345	55756	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:31.569310904 CET	12345	55756	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:31.569349051 CET	55756	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:31.569545031 CET	55756	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:31.570652008 CET	55758	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:31.689317942 CET	12345	55756	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:31.690608978 CET	12345	55758	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:31.690787077 CET	55758	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:31.690934896 CET	55758	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:31.810718060 CET	12345	55758	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:32.757672071 CET	12345	55758	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:32.757805109 CET	12345	55758	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:32.757971048 CET	55758	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:32.758128881 CET	55758	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:32.759197950 CET	55760	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:32.877816916 CET	12345	55758	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:32.879092932 CET	12345	55760	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:32.879297972 CET	55760	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:32.879566908 CET	55760	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:32.999233007 CET	12345	55760	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:33.933720112 CET	12345	55760	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:33.933851957 CET	12345	55760	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:33.934066057 CET	55760	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:33.934283018 CET	55760	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:33.935513020 CET	55762	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:34.054014921 CET	12345	55760	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:34.055227041 CET	12345	55762	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:34.055358887 CET	55762	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:34.055654049 CET	55762	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:34.175525904 CET	12345	55762	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:35.107605934 CET	12345	55762	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:35.107652903 CET	12345	55762	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:35.107812881 CET	55762	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:35.107969999 CET	55762	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:35.109213114 CET	55764	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:35.227761984 CET	12345	55762	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:35.229119062 CET	12345	55764	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:35.229311943 CET	55764	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:35.229403973 CET	55764	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:35.349159002 CET	12345	55764	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:36.281373024 CET	12345	55764	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:36.281646967 CET	55764	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:36.281689882 CET	12345	55764	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:36.281868935 CET	55764	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:36.283054113 CET	55766	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:36.401613951 CET	12345	55764	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:36.402832031 CET	12345	55766	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:36.403002024 CET	55766	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:36.403117895 CET	55766	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:36.522852898 CET	12345	55766	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:37.455055952 CET	12345	55766	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:37.455188036 CET	12345	55766	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:37.455363989 CET	55766	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:37.455569983 CET	55766	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:37.456346989 CET	55768	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:37.575272083 CET	12345	55766	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:37.576075077 CET	12345	55768	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:37.576143026 CET	55768	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:37.576288939 CET	55768	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:37.695935965 CET	12345	55768	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:38.633605957 CET	12345	55768	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:38.633721113 CET	12345	55768	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:38.633750916 CET	55768	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:38.633889914 CET	55768	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:38.634924889 CET	55770	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:38.753602028 CET	12345	55768	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:38.754703045 CET	12345	55770	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:38.754786968 CET	55770	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:38.754863024 CET	55770	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:38.874540091 CET	12345	55770	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:39.809864998 CET	12345	55770	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:39.809890032 CET	12345	55770	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:39.810045958 CET	55770	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:39.810137033 CET	55770	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:39.811017036 CET	55772	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:39.930111885 CET	12345	55770	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:39.930804968 CET	12345	55772	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:39.931022882 CET	55772	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:39.931022882 CET	55772	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:40.051162958 CET	12345	55772	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:40.983592987 CET	12345	55772	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:40.983695984 CET	12345	55772	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:40.983704090 CET	55772	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:40.983778954 CET	55772	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:40.984586000 CET	55774	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:41.103482962 CET	12345	55772	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:41.104300022 CET	12345	55774	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:41.104566097 CET	55774	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:41.104566097 CET	55774	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:41.224538088 CET	12345	55774	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:42.159719944 CET	12345	55774	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:42.159872055 CET	12345	55774	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:42.159879923 CET	55774	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:42.160060883 CET	55774	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:42.160669088 CET	55776	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:42.279844999 CET	12345	55774	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:42.280371904 CET	12345	55776	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:42.280690908 CET	55776	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:42.280723095 CET	55776	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:42.400765896 CET	12345	55776	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:43.333108902 CET	12345	55776	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:43.333183050 CET	12345	55776	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:43.333277941 CET	55776	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:43.333364010 CET	55776	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:43.334264040 CET	55778	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:43.453105927 CET	12345	55776	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:43.453986883 CET	12345	55778	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:43.454066992 CET	55778	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:43.454143047 CET	55778	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:43.573952913 CET	12345	55778	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:44.543385983 CET	12345	55778	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:44.543407917 CET	12345	55778	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:44.543593884 CET	55778	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:44.543593884 CET	55778	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:44.544647932 CET	55780	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:44.663790941 CET	12345	55778	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:44.664386988 CET	12345	55780	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:44.664554119 CET	55780	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:44.664589882 CET	55780	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:44.784395933 CET	12345	55780	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:45.717063904 CET	12345	55780	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:45.717118025 CET	12345	55780	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:45.717240095 CET	55780	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:45.717322111 CET	55780	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:45.718141079 CET	55782	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:45.837066889 CET	12345	55780	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:45.837846994 CET	12345	55782	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:45.837960005 CET	55782	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:45.838141918 CET	55782	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:45.957770109 CET	12345	55782	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:46.890860081 CET	12345	55782	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:46.890882015 CET	12345	55782	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:46.891027927 CET	55782	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:46.891098976 CET	55782	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:46.892086029 CET	55784	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:47.010951996 CET	12345	55782	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:47.011876106 CET	12345	55784	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:47.012088060 CET	55784	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:47.012088060 CET	55784	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:47.132117033 CET	12345	55784	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:48.064798117 CET	12345	55784	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:48.064836979 CET	12345	55784	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:48.064944983 CET	55784	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:48.065020084 CET	55784	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:48.065686941 CET	55786	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:48.184747934 CET	12345	55784	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:48.185378075 CET	12345	55786	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:48.185455084 CET	55786	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:48.185544014 CET	55786	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:48.305269957 CET	12345	55786	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:49.237924099 CET	12345	55786	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:49.237971067 CET	12345	55786	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:49.238090992 CET	55786	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:49.238171101 CET	55786	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:49.239379883 CET	55788	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:49.357925892 CET	12345	55786	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:49.359185934 CET	12345	55788	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:49.359299898 CET	55788	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:49.359406948 CET	55788	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:49.479285002 CET	12345	55788	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:50.412400961 CET	12345	55788	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:50.412425041 CET	12345	55788	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:50.412535906 CET	55788	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:50.412605047 CET	55788	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:50.413552046 CET	55790	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:50.532386065 CET	12345	55788	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:50.533324003 CET	12345	55790	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:50.533440113 CET	55790	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:50.533535004 CET	55790	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:50.653580904 CET	12345	55790	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:51.033425093 CET	43928	443	192.168.2.23	91.189.91.42
Dec 16, 2024 11:52:51.586060047 CET	12345	55790	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:51.586118937 CET	12345	55790	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:51.586282969 CET	55790	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:51.586409092 CET	55790	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:51.587372065 CET	55792	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:51.706132889 CET	12345	55790	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:51.707091093 CET	12345	55792	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:51.707259893 CET	55792	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:51.707346916 CET	55792	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:51.827131033 CET	12345	55792	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:52.760107994 CET	12345	55792	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:52.760155916 CET	12345	55792	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:52.760325909 CET	55792	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:52.760433912 CET	55792	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:52.761589050 CET	55794	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:52.880328894 CET	12345	55792	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:52.881494999 CET	12345	55794	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:52.881628990 CET	55794	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:52.881933928 CET	55794	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:53.001710892 CET	12345	55794	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:53.933387995 CET	12345	55794	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:53.933650970 CET	12345	55794	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:53.933784962 CET	55794	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:53.933785915 CET	55794	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:53.934339046 CET	55796	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:54.053709030 CET	12345	55794	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:54.054044008 CET	12345	55796	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:54.054150105 CET	55796	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:54.054220915 CET	55796	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:54.174007893 CET	12345	55796	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:55.106978893 CET	12345	55796	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:55.107055902 CET	12345	55796	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:55.107211113 CET	55796	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:55.107279062 CET	55796	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:55.108225107 CET	55798	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:55.227062941 CET	12345	55796	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:55.227992058 CET	12345	55798	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:55.228147030 CET	55798	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:55.228317022 CET	55798	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:55.348051071 CET	12345	55798	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:56.282388926 CET	12345	55798	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:56.282429934 CET	12345	55798	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:56.282525063 CET	55798	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:56.282562971 CET	55798	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:56.283375025 CET	55800	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:56.402579069 CET	12345	55798	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:56.403193951 CET	12345	55800	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:56.403290033 CET	55800	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:56.403414965 CET	55800	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:56.523287058 CET	12345	55800	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:57.456326962 CET	12345	55800	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:57.456347942 CET	12345	55800	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:57.456657887 CET	55800	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:57.456691980 CET	55800	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:57.457720041 CET	55802	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:57.577124119 CET	12345	55800	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:57.577789068 CET	12345	55802	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:57.577948093 CET	55802	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:57.577996016 CET	55802	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:57.699306965 CET	12345	55802	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:58.631755114 CET	12345	55802	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:58.631943941 CET	12345	55802	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:58.631954908 CET	55802	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:58.632040024 CET	55802	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:58.632776976 CET	55804	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:58.751750946 CET	12345	55802	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:58.752542019 CET	12345	55804	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:58.752660990 CET	55804	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:58.752744913 CET	55804	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:58.872560978 CET	12345	55804	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:59.809125900 CET	12345	55804	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:59.809146881 CET	12345	55804	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:59.809420109 CET	55804	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:59.809510946 CET	55804	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:59.810956001 CET	55806	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:59.929394007 CET	12345	55804	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:59.930717945 CET	12345	55806	93.123.85.8	192.168.2.23
Dec 16, 2024 11:52:59.930926085 CET	55806	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:52:59.930974007 CET	55806	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:53:00.050782919 CET	12345	55806	93.123.85.8	192.168.2.23
Dec 16, 2024 11:53:00.983350992 CET	12345	55806	93.123.85.8	192.168.2.23
Dec 16, 2024 11:53:00.983380079 CET	12345	55806	93.123.85.8	192.168.2.23
Dec 16, 2024 11:53:00.983547926 CET	55806	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:53:00.983650923 CET	55806	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:53:00.984639883 CET	55808	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:53:01.103574991 CET	12345	55806	93.123.85.8	192.168.2.23
Dec 16, 2024 11:53:01.104444981 CET	12345	55808	93.123.85.8	192.168.2.23
Dec 16, 2024 11:53:01.104589939 CET	55808	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:53:01.104722023 CET	55808	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:53:01.224478006 CET	12345	55808	93.123.85.8	192.168.2.23
Dec 16, 2024 11:53:02.157876015 CET	12345	55808	93.123.85.8	192.168.2.23
Dec 16, 2024 11:53:02.157910109 CET	12345	55808	93.123.85.8	192.168.2.23
Dec 16, 2024 11:53:02.158018112 CET	55808	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:53:02.158452034 CET	55808	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:53:02.159769058 CET	55810	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:53:02.278249025 CET	12345	55808	93.123.85.8	192.168.2.23
Dec 16, 2024 11:53:02.279535055 CET	12345	55810	93.123.85.8	192.168.2.23
Dec 16, 2024 11:53:02.279737949 CET	55810	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:53:02.279925108 CET	55810	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:53:02.399732113 CET	12345	55810	93.123.85.8	192.168.2.23
Dec 16, 2024 11:53:03.331170082 CET	12345	55810	93.123.85.8	192.168.2.23
Dec 16, 2024 11:53:03.331228018 CET	12345	55810	93.123.85.8	192.168.2.23
Dec 16, 2024 11:53:03.331300020 CET	55810	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:53:03.331536055 CET	55810	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:53:03.332696915 CET	55812	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:53:03.451244116 CET	12345	55810	93.123.85.8	192.168.2.23
Dec 16, 2024 11:53:03.452480078 CET	12345	55812	93.123.85.8	192.168.2.23
Dec 16, 2024 11:53:03.452557087 CET	55812	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:53:03.452652931 CET	55812	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:53:03.572556973 CET	12345	55812	93.123.85.8	192.168.2.23
Dec 16, 2024 11:53:04.508079052 CET	12345	55812	93.123.85.8	192.168.2.23
Dec 16, 2024 11:53:04.508101940 CET	12345	55812	93.123.85.8	192.168.2.23
Dec 16, 2024 11:53:04.508253098 CET	55812	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:53:04.508349895 CET	55812	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:53:04.508905888 CET	55814	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:53:04.628199100 CET	12345	55812	93.123.85.8	192.168.2.23
Dec 16, 2024 11:53:04.628688097 CET	12345	55814	93.123.85.8	192.168.2.23
Dec 16, 2024 11:53:04.628770113 CET	55814	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:53:04.628849983 CET	55814	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:53:04.748615980 CET	12345	55814	93.123.85.8	192.168.2.23
Dec 16, 2024 11:53:05.681621075 CET	12345	55814	93.123.85.8	192.168.2.23
Dec 16, 2024 11:53:05.681646109 CET	12345	55814	93.123.85.8	192.168.2.23
Dec 16, 2024 11:53:05.681900978 CET	55814	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:53:05.681901932 CET	55814	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:53:05.682782888 CET	55816	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:53:05.801811934 CET	12345	55814	93.123.85.8	192.168.2.23
Dec 16, 2024 11:53:05.802505016 CET	12345	55816	93.123.85.8	192.168.2.23
Dec 16, 2024 11:53:05.802581072 CET	55816	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:53:05.802658081 CET	55816	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:53:05.922405958 CET	12345	55816	93.123.85.8	192.168.2.23
Dec 16, 2024 11:53:06.856844902 CET	12345	55816	93.123.85.8	192.168.2.23
Dec 16, 2024 11:53:06.856867075 CET	12345	55816	93.123.85.8	192.168.2.23
Dec 16, 2024 11:53:06.857038021 CET	55816	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:53:06.857172966 CET	55816	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:53:06.858110905 CET	55818	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:53:06.977009058 CET	12345	55816	93.123.85.8	192.168.2.23
Dec 16, 2024 11:53:06.977873087 CET	12345	55818	93.123.85.8	192.168.2.23
Dec 16, 2024 11:53:06.977991104 CET	55818	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:53:06.978212118 CET	55818	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:53:07.098053932 CET	12345	55818	93.123.85.8	192.168.2.23
Dec 16, 2024 11:53:08.030925989 CET	12345	55818	93.123.85.8	192.168.2.23
Dec 16, 2024 11:53:08.030986071 CET	12345	55818	93.123.85.8	192.168.2.23
Dec 16, 2024 11:53:08.031147003 CET	55818	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:53:08.031198025 CET	55818	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:53:08.031930923 CET	55820	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:53:08.150935888 CET	12345	55818	93.123.85.8	192.168.2.23
Dec 16, 2024 11:53:08.151612043 CET	12345	55820	93.123.85.8	192.168.2.23
Dec 16, 2024 11:53:08.151748896 CET	55820	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:53:08.151845932 CET	55820	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:53:08.271541119 CET	12345	55820	93.123.85.8	192.168.2.23
Dec 16, 2024 11:53:30.084568024 CET	12345	55820	93.123.85.8	192.168.2.23
Dec 16, 2024 11:53:30.085269928 CET	55820	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:53:30.087068081 CET	55822	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:53:30.205881119 CET	12345	55820	93.123.85.8	192.168.2.23
Dec 16, 2024 11:53:30.206913948 CET	12345	55822	93.123.85.8	192.168.2.23
Dec 16, 2024 11:53:30.207230091 CET	55822	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:53:30.207508087 CET	55822	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:53:30.327511072 CET	12345	55822	93.123.85.8	192.168.2.23
Dec 16, 2024 11:53:52.099917889 CET	12345	55822	93.123.85.8	192.168.2.23
Dec 16, 2024 11:53:52.100523949 CET	55822	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:53:52.102515936 CET	55824	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:53:52.220422983 CET	12345	55822	93.123.85.8	192.168.2.23
Dec 16, 2024 11:53:52.222275972 CET	12345	55824	93.123.85.8	192.168.2.23
Dec 16, 2024 11:53:52.222575903 CET	55824	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:53:52.222786903 CET	55824	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:53:52.342609882 CET	12345	55824	93.123.85.8	192.168.2.23
Dec 16, 2024 11:54:14.116507053 CET	12345	55824	93.123.85.8	192.168.2.23
Dec 16, 2024 11:54:14.116751909 CET	55824	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:54:14.117835999 CET	55826	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:54:14.236701012 CET	12345	55824	93.123.85.8	192.168.2.23
Dec 16, 2024 11:54:14.237632036 CET	12345	55826	93.123.85.8	192.168.2.23
Dec 16, 2024 11:54:14.237728119 CET	55826	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:54:14.237871885 CET	55826	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:54:14.358004093 CET	12345	55826	93.123.85.8	192.168.2.23
Dec 16, 2024 11:54:36.147650003 CET	12345	55826	93.123.85.8	192.168.2.23
Dec 16, 2024 11:54:36.147819996 CET	55826	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:54:36.148866892 CET	55828	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:54:36.268254042 CET	12345	55826	93.123.85.8	192.168.2.23
Dec 16, 2024 11:54:36.269021034 CET	12345	55828	93.123.85.8	192.168.2.23
Dec 16, 2024 11:54:36.269191980 CET	55828	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:54:36.269191980 CET	55828	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:54:36.389257908 CET	12345	55828	93.123.85.8	192.168.2.23
Dec 16, 2024 11:54:58.179712057 CET	12345	55828	93.123.85.8	192.168.2.23
Dec 16, 2024 11:54:58.180073023 CET	55828	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:54:58.182020903 CET	55830	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:54:58.300219059 CET	12345	55828	93.123.85.8	192.168.2.23
Dec 16, 2024 11:54:58.301871061 CET	12345	55830	93.123.85.8	192.168.2.23
Dec 16, 2024 11:54:58.302318096 CET	55830	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:54:58.302428007 CET	55830	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:54:58.422687054 CET	12345	55830	93.123.85.8	192.168.2.23
Dec 16, 2024 11:55:20.211663008 CET	12345	55830	93.123.85.8	192.168.2.23
Dec 16, 2024 11:55:20.212289095 CET	55830	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:55:20.214490891 CET	55832	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:55:20.332808018 CET	12345	55830	93.123.85.8	192.168.2.23
Dec 16, 2024 11:55:20.334530115 CET	12345	55832	93.123.85.8	192.168.2.23
Dec 16, 2024 11:55:20.334682941 CET	55832	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:55:20.334942102 CET	55832	12345	192.168.2.23	93.123.85.8
Dec 16, 2024 11:55:20.455030918 CET	12345	55832	93.123.85.8	192.168.2.23

System Behavior

Analysis Process: a-r.m-5.Sakura.elf PID: 6263, Parent PID: 6187

General

Start time (UTC):	10:51:48
Start date (UTC):	16/12/2024
Path:	/tmp/a-r.m-5.Sakura.elf
Arguments:	/tmp/a-r.m-5.Sakura.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: a-r.m-5.Sakura.elf PID: 6265, Parent PID: 6263

General

Start time (UTC):	10:51:48
Start date (UTC):	16/12/2024
Path:	/tmp/a-r.m-5.Sakura.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: a-r.m-5.Sakura.elf PID: 6267, Parent PID: 6265

General

Start time (UTC):	10:51:48
Start date (UTC):	16/12/2024
Path:	/tmp/a-r.m-5.Sakura.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping or `net view` using Net .
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report a-r.m-5.Sakura.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Threatname: Gafgyt

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: a-r.m-5.Sakura.elf PID: 6263, Parent PID: 6187

General

Chronological Activities

Analysis Process: a-r.m-5.Sakura.elf PID: 6265, Parent PID: 6263

General

Chronological Activities

Analysis Process: a-r.m-5.Sakura.elf PID: 6267, Parent PID: 6265

General

Chronological Activities

Linux Analysis Report
a-r.m-5.Sakura.elf