Edit tour

Linux Analysis Report
armv6l.elf

Overview

General Information

Sample name:	armv6l.elf
Analysis ID:	1575968
MD5:	6822322b70497ee511faf0b4e0566ca8
SHA1:	d0e5d87159d8e52bd3bc9adbc0d5a52a778b04a0
SHA256:	a1ea13c20b5ee7da35f527d958c426672d13a5cc207b889da2c08cbaeb04ec12
Tags:	elfuser-abuse_ch
Infos:

Detection

Gafgyt, Mirai

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Gafgyt

Yara detected Mirai

Opens /proc/net/* files useful for finding connected devices and routers

Detected TCP or UDP traffic on non-standard ports

Sample contains strings that are user agent strings indicative of HTTP manipulation

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1575968
Start date and time:	2024-12-16 12:50:17 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	armv6l.elf
Detection:	MAL
Classification:	mal100.spre.troj.linELF@0/0@2/0

Warnings

VT rate limit hit for: armv6l.elf

Runtime Messages

Command:	/tmp/armv6l.elf
PID:	5532
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

armv6l.elf (PID: 5532, Parent: 5451, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/armv6l.elf

armv6l.elf New Fork (PID: 5534, Parent: 5532)

armv6l.elf New Fork (PID: 5536, Parent: 5534)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
armv6l.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
armv6l.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
armv6l.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x12634:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12648:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1265c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12670:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12684:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12698:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x126ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x126c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x126d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x126e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x126fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12710:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12724:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12738:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1274c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12760:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12774:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12788:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1279c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x127b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x127c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
5534.1.00007fb8e4017000.00007fb8e402c000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5534.1.00007fb8e4017000.00007fb8e402c000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x12634:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12648:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1265c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12670:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12684:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12698:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x126ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x126c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x126d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x126e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x126fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12710:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12724:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12738:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1274c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12760:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12774:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12788:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1279c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x127b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x127c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5532.1.00007fb8e4017000.00007fb8e402c000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5532.1.00007fb8e4017000.00007fb8e402c000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x12634:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12648:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1265c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12670:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12684:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12698:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x126ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x126c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x126d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x126e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x126fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12710:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12724:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12738:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1274c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12760:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12774:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12788:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1279c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x127b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x127c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: armv6l.elf PID: 5532	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: armv6l.elf PID: 5532	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x11ef7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f0b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f1f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f33:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f47:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f5b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f6f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f83:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f97:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11fab:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11fbf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11fd3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11fe7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11ffb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1200f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12023:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12037:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1204b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1205f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12073:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12087:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: armv6l.elf PID: 5534	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: armv6l.elf PID: 5534	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x15e3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15f7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x160b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x161f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1633:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1647:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x165b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x166f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1683:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1697:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16ab:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16bf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16d3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16e7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16fb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x170f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1723:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1737:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x174b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x175f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1773:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 3 entries

Suricata Signatures

ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T12:51:10.164422+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55124	150.241.88.132	25565	TCP
2024-12-16T12:51:12.483695+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55126	150.241.88.132	25565	TCP
2024-12-16T12:51:14.815100+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55128	150.241.88.132	25565	TCP
2024-12-16T12:51:17.139766+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55130	150.241.88.132	25565	TCP
2024-12-16T12:51:19.470761+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55132	150.241.88.132	25565	TCP
2024-12-16T12:51:21.795640+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55134	150.241.88.132	25565	TCP
2024-12-16T12:51:24.172878+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55136	150.241.88.132	25565	TCP
2024-12-16T12:51:26.548187+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55138	150.241.88.132	25565	TCP
2024-12-16T12:51:28.875333+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55140	150.241.88.132	25565	TCP
2024-12-16T12:51:31.202517+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55142	150.241.88.132	25565	TCP
2024-12-16T12:51:33.530485+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55144	150.241.88.132	25565	TCP
2024-12-16T12:51:35.858821+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55146	150.241.88.132	25565	TCP
2024-12-16T12:51:38.235773+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55148	150.241.88.132	25565	TCP
2024-12-16T12:51:40.562571+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55150	150.241.88.132	25565	TCP
2024-12-16T12:51:42.890444+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55152	150.241.88.132	25565	TCP
2024-12-16T12:51:45.223623+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55154	150.241.88.132	25565	TCP
2024-12-16T12:51:47.546609+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55156	150.241.88.132	25565	TCP
2024-12-16T12:51:49.875151+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55158	150.241.88.132	25565	TCP
2024-12-16T12:51:52.202604+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55160	150.241.88.132	25565	TCP
2024-12-16T12:51:54.550092+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55162	150.241.88.132	25565	TCP
2024-12-16T12:51:56.875636+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55164	150.241.88.132	25565	TCP
2024-12-16T12:51:59.203515+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55166	150.241.88.132	25565	TCP
2024-12-16T12:52:01.655218+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55168	150.241.88.132	25565	TCP
2024-12-16T12:52:03.984526+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55170	150.241.88.132	25565	TCP
2024-12-16T12:52:06.360856+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55172	150.241.88.132	25565	TCP
2024-12-16T12:52:08.688273+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55174	150.241.88.132	25565	TCP
2024-12-16T12:52:11.065789+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55176	150.241.88.132	25565	TCP
2024-12-16T12:52:13.412646+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55178	150.241.88.132	25565	TCP
2024-12-16T12:52:15.754016+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55180	150.241.88.132	25565	TCP
2024-12-16T12:52:18.078917+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55182	150.241.88.132	25565	TCP
2024-12-16T12:52:20.407215+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55184	150.241.88.132	25565	TCP
2024-12-16T12:52:22.739207+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55186	150.241.88.132	25565	TCP
2024-12-16T12:52:25.064966+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55188	150.241.88.132	25565	TCP
2024-12-16T12:52:27.395682+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55190	150.241.88.132	25565	TCP
2024-12-16T12:52:29.784008+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55192	150.241.88.132	25565	TCP
2024-12-16T12:52:32.110172+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55194	150.241.88.132	25565	TCP
2024-12-16T12:52:34.441205+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55196	150.241.88.132	25565	TCP
2024-12-16T12:52:36.815476+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55198	150.241.88.132	25565	TCP
2024-12-16T12:52:39.157195+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55200	150.241.88.132	25565	TCP
2024-12-16T12:52:41.535209+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55202	150.241.88.132	25565	TCP
2024-12-16T12:52:43.862477+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55204	150.241.88.132	25565	TCP
2024-12-16T12:52:46.439933+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55206	150.241.88.132	25565	TCP
2024-12-16T12:52:48.766558+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55208	150.241.88.132	25565	TCP
2024-12-16T12:52:51.094241+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55210	150.241.88.132	25565	TCP
2024-12-16T12:52:53.471502+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55212	150.241.88.132	25565	TCP
2024-12-16T12:52:55.846003+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55214	150.241.88.132	25565	TCP
2024-12-16T12:52:58.173196+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55216	150.241.88.132	25565	TCP
2024-12-16T12:53:00.500925+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55218	150.241.88.132	25565	TCP
2024-12-16T12:53:02.829443+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55220	150.241.88.132	25565	TCP
2024-12-16T12:53:05.202446+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55222	150.241.88.132	25565	TCP
2024-12-16T12:53:07.533093+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55224	150.241.88.132	25565	TCP
2024-12-16T12:53:09.862420+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55226	150.241.88.132	25565	TCP
2024-12-16T12:53:12.190270+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55228	150.241.88.132	25565	TCP
2024-12-16T12:53:14.516347+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55230	150.241.88.132	25565	TCP
2024-12-16T12:53:16.848461+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55232	150.241.88.132	25565	TCP
2024-12-16T12:53:19.174572+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55234	150.241.88.132	25565	TCP
2024-12-16T12:53:21.550064+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55236	150.241.88.132	25565	TCP
2024-12-16T12:53:23.880237+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55238	150.241.88.132	25565	TCP
2024-12-16T12:53:26.204630+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55240	150.241.88.132	25565	TCP
2024-12-16T12:53:28.533540+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55242	150.241.88.132	25565	TCP
2024-12-16T12:53:30.885923+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55244	150.241.88.132	25565	TCP
2024-12-16T12:53:33.204759+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55246	150.241.88.132	25565	TCP
2024-12-16T12:53:35.533598+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55248	150.241.88.132	25565	TCP
2024-12-16T12:53:37.860955+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55250	150.241.88.132	25565	TCP
2024-12-16T12:53:40.238351+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55252	150.241.88.132	25565	TCP
2024-12-16T12:53:42.630031+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55254	150.241.88.132	25565	TCP
2024-12-16T12:53:44.955242+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55256	150.241.88.132	25565	TCP
2024-12-16T12:53:47.299104+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55258	150.241.88.132	25565	TCP
2024-12-16T12:53:49.630635+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55260	150.241.88.132	25565	TCP
2024-12-16T12:53:51.958167+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55262	150.241.88.132	25565	TCP
2024-12-16T12:53:54.336632+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55264	150.241.88.132	25565	TCP
2024-12-16T12:53:56.706370+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55266	150.241.88.132	25565	TCP
2024-12-16T12:53:59.082491+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55268	150.241.88.132	25565	TCP
2024-12-16T12:54:01.408920+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55270	150.241.88.132	25565	TCP
2024-12-16T12:54:03.800877+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55272	150.241.88.132	25565	TCP
2024-12-16T12:54:06.127432+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55274	150.241.88.132	25565	TCP
2024-12-16T12:54:08.456397+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55276	150.241.88.132	25565	TCP
2024-12-16T12:54:10.784226+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55278	150.241.88.132	25565	TCP
2024-12-16T12:54:13.118033+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55280	150.241.88.132	25565	TCP
2024-12-16T12:54:15.439601+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55282	150.241.88.132	25565	TCP
2024-12-16T12:54:17.772186+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55284	150.241.88.132	25565	TCP
2024-12-16T12:54:20.096623+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55286	150.241.88.132	25565	TCP
2024-12-16T12:54:22.473903+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55288	150.241.88.132	25565	TCP
2024-12-16T12:54:24.803389+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55290	150.241.88.132	25565	TCP
2024-12-16T12:54:27.131475+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55292	150.241.88.132	25565	TCP
2024-12-16T12:54:29.459013+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55294	150.241.88.132	25565	TCP
2024-12-16T12:54:31.787386+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55296	150.241.88.132	25565	TCP
2024-12-16T12:54:34.113155+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55298	150.241.88.132	25565	TCP
2024-12-16T12:54:36.506645+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55300	150.241.88.132	25565	TCP
2024-12-16T12:54:38.926531+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55302	150.241.88.132	25565	TCP
2024-12-16T12:54:41.253521+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55304	150.241.88.132	25565	TCP
2024-12-16T12:54:43.584170+0100	2846526	1	A Network Trojan was detected	192.168.2.15	55306	150.241.88.132	25565	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: armv6l.elf

Avira: detected

Found malware configuration

Source: armv6l.elf

Malware Configuration Extractor: Gafgyt {"C2 url": "150.241.88.132:25565"}

Multi AV Scanner detection for submitted file

Source: armv6l.elf

ReversingLabs: Detection: 65%

Spreading

Opens /proc/net/* files useful for finding connected devices and routers

Source: /tmp/armv6l.elf (PID: 5532)

Opens: /proc/net/route

Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55140 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55124 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55142 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55136 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55126 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55162 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55146 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55132 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55214 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55182 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55164 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55278 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55168 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55134 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55130 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55150 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55270 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55172 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55174 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55128 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55170 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55138 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55176 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55202 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55186 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55230 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55208 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55148 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55272 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55154 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55196 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55276 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55178 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55200 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55218 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55304 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55292 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55250 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55300 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55180 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55184 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55158 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55280 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55236 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55224 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55206 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55242 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55228 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55190 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55232 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55212 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55198 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55262 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55252 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55192 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55282 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55220 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55264 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55286 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55216 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55302 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55260 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55144 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55152 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55166 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55238 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55268 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55160 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55188 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55288 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55298 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55156 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55234 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55296 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55204 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55222 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55248 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55210 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55258 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55294 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55290 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55274 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55306 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55226 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55244 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55284 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55240 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55246 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55194 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55266 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55256 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:55254 -> 150.241.88.132:25565

Source: global traffic

TCP traffic: 192.168.2.15:55124 -> 150.241.88.132:25565

Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

System Summary

Malicious sample detected (through community Yara rule)

Source: armv6l.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5534.1.00007fb8e4017000.00007fb8e402c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5532.1.00007fb8e4017000.00007fb8e402c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: armv6l.elf PID: 5532, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: armv6l.elf PID: 5534, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: armv6l.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5534.1.00007fb8e4017000.00007fb8e402c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5532.1.00007fb8e4017000.00007fb8e402c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: armv6l.elf PID: 5532, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: armv6l.elf PID: 5534, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.spre.troj.linELF@0/0@2/0

Source: armv6l.elf	ELF static info symbol of initial sample: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: armv6l.elf	ELF static info symbol of initial sample: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: armv6l.elf	ELF static info symbol of initial sample: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: armv6l.elf	ELF static info symbol of initial sample: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: armv6l.elf	ELF static info symbol of initial sample: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: armv6l.elf	ELF static info symbol of initial sample: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: armv6l.elf	ELF static info symbol of initial sample: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: armv6l.elf	ELF static info symbol of initial sample: libc/string/arm/_memcpy.S
Source: armv6l.elf	ELF static info symbol of initial sample: libc/string/arm/bcopy.S
Source: armv6l.elf	ELF static info symbol of initial sample: libc/string/arm/bzero.S
Source: armv6l.elf	ELF static info symbol of initial sample: libc/string/arm/memcpy.S
Source: armv6l.elf	ELF static info symbol of initial sample: libc/string/arm/memmove.S
Source: armv6l.elf	ELF static info symbol of initial sample: libc/string/arm/memset.S
Source: armv6l.elf	ELF static info symbol of initial sample: libc/string/arm/strcmp.S
Source: armv6l.elf	ELF static info symbol of initial sample: libc/string/arm/strlen.S
Source: armv6l.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/crt1.S
Source: armv6l.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/crti.S
Source: armv6l.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/crtn.S
Source: armv6l.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/sigrestorer.S

Source: /tmp/armv6l.elf (PID: 5532)

Queries kernel information via 'uname':

Jump to behavior

Source: armv6l.elf, 5532.1.00007ffc74804000.00007ffc74825000.rw-.sdmp, armv6l.elf, 5534.1.00007ffc74804000.00007ffc74825000.rw-.sdmp	Binary or memory string: po#x86_64/usr/bin/qemu-arm/tmp/armv6l.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/armv6l.elf
Source: armv6l.elf, 5532.1.00005638aac85000.00005638aadb3000.rw-.sdmp, armv6l.elf, 5534.1.00005638aac85000.00005638aadb3000.rw-.sdmp	Binary or memory string: 8V!/etc/qemu-binfmt/arm
Source: armv6l.elf, 5532.1.00005638aac85000.00005638aadb3000.rw-.sdmp, armv6l.elf, 5534.1.00005638aac85000.00005638aadb3000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: armv6l.elf, 5532.1.00007ffc74804000.00007ffc74825000.rw-.sdmp, armv6l.elf, 5534.1.00007ffc74804000.00007ffc74825000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match

File source: armv6l.elf, type: SAMPLE

Yara detected Mirai

Source: Yara match	File source: armv6l.elf, type: SAMPLE
Source: Yara match	File source: 5534.1.00007fb8e4017000.00007fb8e402c000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5532.1.00007fb8e4017000.00007fb8e402c000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: armv6l.elf PID: 5532, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: armv6l.elf PID: 5534, type: MEMORYSTR

Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.71 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36

Remote Access Functionality

Yara detected Gafgyt

Source: Yara match

File source: armv6l.elf, type: SAMPLE

Yara detected Mirai

Source: Yara match	File source: armv6l.elf, type: SAMPLE
Source: Yara match	File source: 5534.1.00007fb8e4017000.00007fb8e402c000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5532.1.00007fb8e4017000.00007fb8e402c000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: armv6l.elf PID: 5532, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: armv6l.elf PID: 5534, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	1 Remote System Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

Threatname: Gafgyt

{"C2 url": "150.241.88.132:25565"}

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
armv6l.elf	66%	ReversingLabs	Linux.Trojan.Gafgyt
armv6l.elf	100%	Avira	LINUX/Gafgyt.opnd

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.24	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
150.241.88.132:25565	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
150.241.88.132	unknown	Spain		207714	TECNALIAES	true

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
150.241.88.132	armv4l.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	i586.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	armv5l.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	armv7l.elf	Get hash	malicious	Gafgyt, Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	boatnet.spc.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	armv4l.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	i586.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	armv5l.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	main_arm6.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	arm7.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	i686.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	mips.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	main_arm6.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	armv5l.elf	Get hash	malicious	Mirai	Browse	162.213.35.24

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TECNALIAES	armv4l.elf	Get hash	malicious	Gafgyt, Mirai	Browse	150.241.88.132
	i586.elf	Get hash	malicious	Gafgyt, Mirai	Browse	150.241.88.132
	armv5l.elf	Get hash	malicious	Gafgyt, Mirai	Browse	150.241.88.132
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	150.241.91.218
	file.exe	Get hash	malicious	SmokeLoader	Browse	150.241.91.218
	9RM52QaURq.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	150.241.95.163
	HZ1BUCfTne.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	150.241.95.163
	9RM52QaURq.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	150.241.95.163
	HZ1BUCfTne.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	150.241.95.163
	eMfPZvOkbJ.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	150.241.92.160

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	6.044668314645801
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	armv6l.elf
File size:	121'007 bytes
MD5:	6822322b70497ee511faf0b4e0566ca8
SHA1:	d0e5d87159d8e52bd3bc9adbc0d5a52a778b04a0
SHA256:	a1ea13c20b5ee7da35f527d958c426672d13a5cc207b889da2c08cbaeb04ec12
SHA512:	80527f400ca2e8fc143c450b8fd681e3baa4261d0c21185784af9976da02690ae2966101f82f6994825ce5b78aba6e721c592627456c8d8e46b60210565b3d97
SSDEEP:	3072:WkYPgPggnAb0JWaY/VfVEDx0dn+mTQOY5NX3cn:lYPgPggI4Wa8VEDW+mTQOY5R3cn
TLSH:	76C32805D5508727C2D3237AE79F825D37325BA4A3DB33215A34BFB82BC27891E39921
File Content Preview:	.ELF..............(.........4....b......4. ...(........p.F.......................................... F.. F.............. F.. F.. F.......i..........Q.td..................................-...L..................G.F.G.F.G.F.G.F G.F(G.F0G.F8G.F@G.FHG.FPG.FXG.

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x81b0
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	4
Section Header Offset:	90860
Section Header Size:	40
Number of Section Headers:	24
Header String Table Index:	21

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80b4	0xb4	0x10	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80d0	0xd0	0x11e34	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x19f04	0x11f04	0x10	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x19f18	0x11f18	0x26e0	0x0	0x2	A	0	0	8
.ARM.extab	PROGBITS	0x1c5f8	0x145f8	0x18	0x0	0x2	A	0	0	4
.ARM.exidx	ARM_EXIDX	0x1c610	0x14610	0x10	0x0	0x82	AL	2	0	4
.eh_frame	PROGBITS	0x24620	0x14620	0x4	0x0	0x3	WA	0	0	4
.init_array	INIT_ARRAY	0x24624	0x14624	0x4	0x0	0x3	WA	0	0	4
.fini_array	FINI_ARRAY	0x24628	0x14628	0x4	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x2462c	0x1462c	0x4	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x24630	0x14630	0x78	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x246a8	0x146a8	0x290	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x24938	0x14938	0x6668	0x0	0x3	WA	0	0	8
.comment	PROGBITS	0x0	0x14938	0xbf8	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x15530	0xe0	0x0	0x0		0	0	8
.debug_info	PROGBITS	0x0	0x15610	0x4b0	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x15ac0	0x8c	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x15b4c	0x655	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x161a4	0x58	0x0	0x0		0	0	4
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x161fc	0x10	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x1620c	0xdd	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x166ac	0x4a20	0x10	0x0		23	643	4
.strtab	STRTAB	0x0	0x1b0cc	0x27e3	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
EXIDX	0x14610	0x1c610	0x1c610	0x10	0x10	2.4056	0x4	R	0x4	.ARM.exidx
LOAD	0x0	0x8000	0x8000	0x14620	0x14620	6.1439	0x5	R E	0x8000	.init .text .fini .rodata .ARM.extab .ARM.exidx
LOAD	0x14620	0x24620	0x24620	0x318	0x6980	3.7887	0x6	RW	0x8000	.eh_frame .init_array .fini_array .jcr .got .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x80b4	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80d0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x19f04	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x19f18	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x1c5f8	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x1c610	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x24620	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x24624	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x24628	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x2462c	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x24630	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x246a8	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x24938	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	19
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	20
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	21
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	22
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	23
$a	.symtab	0x80b4	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x19f04	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80c0	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x19f10	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x810c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8150	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x81b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x81ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x82c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8408	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x846c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x87fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9108	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x92f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x95cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x99e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa82c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa984	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xabd4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb248	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb388	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb4d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb63c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc788	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc8d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc8fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc9d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd9fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe2a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xeaac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xebc0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xebd4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xec34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xec48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xec78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xecac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xecc8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xecfc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xed3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xed70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xeda4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xedd8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xee0c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xeee4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xef18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xef4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xefa0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xefcc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf000	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf028	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf058	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf080	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf120	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf180	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf190	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf1b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf1c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf1d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf2cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf2f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf3e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf410	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf470	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf518	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf540	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf55c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf5c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf5fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf634	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf678	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf6b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf6e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf728	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf76c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf7a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf7c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf878	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf8e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1027c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1071c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1075c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10884	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1089c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10940	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x109f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10ab8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10b5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10c40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10cd0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10da8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10e8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10eac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10ec8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11088	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11140	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x111ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11338	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11910	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11960	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11a20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11a74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11ae0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11db4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11e1c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11ea4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11eb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11ebc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11ef0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11f18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11f2c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11f60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11f74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11f88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11ff4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12008	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12034	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12068	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1209c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x120d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12108	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12200	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x122d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1237c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12414	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12500	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1251c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x128c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12a74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12a94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12d9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12e04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12e38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12f0c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12f3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13098	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13174	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13230	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x133b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x135c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x136f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13790	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13c20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13c98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13cdc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13d8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13dd8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13e28	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13f14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13f54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13f78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13ff4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x140ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1438c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x144c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14874	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x148ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x148f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14904	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14938	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14990	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14bc0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14c00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14d44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14d9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14e50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14e80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14f18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14f3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14ff8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x152e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x156ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x157a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15f8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15fe0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16038	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16494	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1652c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16578	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16870	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x168a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1691c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16974	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x169d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16a0c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16ac0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17280	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17320	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17364	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17514	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17568	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17ad8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17b10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17bc0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17bd0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17c9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17cb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17db4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17de8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17ed4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17f88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17fe8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18018	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1821c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18250	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x182a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x182c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18378	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x184b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18588	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x185f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18624	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18e18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18f08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18fe8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19054	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19100	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19124	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19274	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19338	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19374	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x194b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x198d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19d70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19eb0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8144	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x24628	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x819c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x24624	0	NOTYPE	<unknown>	DEFAULT	8
$d	.symtab	0x246ac	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x81e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x246b0	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x82bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x83fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8468	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x87e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9104	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x92f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x95c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x99e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa810	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a3d0	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0xa980	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xabd0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb244	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb384	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb4d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb638	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc76c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc8d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc8f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc9b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd9c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe298	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xea90	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf020	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf050	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x246dc	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x246e4	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0xf06c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf3d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf408	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf510	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf5b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf5f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf630	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf674	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf6ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf6e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf724	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf768	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf7a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf870	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10260	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x246ec	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x10700	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10754	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10870	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x24704	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x10924	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x109dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10a9c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10b40	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2471c	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x247b4	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x10c38	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10ccc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10d9c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10e84	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b554	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x11080	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11120	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x247c8	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x111e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11314	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x118ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1195c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11a0c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11a6c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11ad0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11d74	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x247e0	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x11e98	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11f10	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11fec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x121ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x122c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12378	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b5d0	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x124ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x28b6c	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x12514	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x128b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12a54	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12d68	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12dfc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12e30	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12ef8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x24820	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x247ec	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x1b5e8	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x13160	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1321c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1338c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x135a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x136e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13d84	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13f0c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13ff0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x140e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x144a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14858	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x148a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x148f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x152d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x156a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15f50	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15fd8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16030	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1644c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16514	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17260	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17510	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1755c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17aa8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2492c	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x17c94	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17da8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18010	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18210	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18df8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c2b0	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x18f00	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18fe0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1904c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x24930	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x19260	0	NOTYPE	<unknown>	DEFAULT	2
$t	.symtab	0x80d0	0	NOTYPE	<unknown>	DEFAULT	2
/home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
C.1.3506	.symtab	0x1b5d0	24	OBJECT	<unknown>	DEFAULT	4
C.108.5499	.symtab	0x1a3d0	8	OBJECT	<unknown>	DEFAULT	4
C.141.5806	.symtab	0x1ad4c	24	OBJECT	<unknown>	DEFAULT	4
Laligned	.symtab	0xf148	0	NOTYPE	<unknown>	DEFAULT	2
Llastword	.symtab	0xf164	0	NOTYPE	<unknown>	DEFAULT	2
Q	.symtab	0x24970	16384	OBJECT	<unknown>	DEFAULT	13
Sakura_Bot.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
SendSTD	.symtab	0xb248	320	FUNC	<unknown>	DEFAULT	2
SendSTDHEX	.symtab	0xa82c	344	FUNC	<unknown>	DEFAULT	2
SendSTD_HEX	.symtab	0xb4d8	356	FUNC	<unknown>	DEFAULT	2
SendUDP	.symtab	0x9d10	1116	FUNC	<unknown>	DEFAULT	2
_Exit	.symtab	0xefa0	44	FUNC	<unknown>	DEFAULT	2
_GLOBAL_OFFSET_TABLE_	.symtab	0x24630	0	OBJECT	<unknown>	HIDDEN	11
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b	.symtab	0x246dc	4	OBJECT	<unknown>	DEFAULT	12
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x1af54	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x24930	4	OBJECT	<unknown>	DEFAULT	12
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x1c2f8	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x246e4	4	OBJECT	<unknown>	DEFAULT	12
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x1b254	768	OBJECT	<unknown>	DEFAULT	4
__EH_FRAME_BEGIN__	.symtab	0x24620	0	OBJECT	<unknown>	DEFAULT	7
__FRAME_END__	.symtab	0x24620	0	OBJECT	<unknown>	DEFAULT	7
__GI___C_ctype_b	.symtab	0x246dc	4	OBJECT	<unknown>	HIDDEN	12
__GI___C_ctype_tolower	.symtab	0x24930	4	OBJECT	<unknown>	HIDDEN	12
__GI___C_ctype_toupper	.symtab	0x246e4	4	OBJECT	<unknown>	HIDDEN	12
__GI___ctype_b	.symtab	0x246e0	4	OBJECT	<unknown>	HIDDEN	12
__GI___ctype_tolower	.symtab	0x24934	4	OBJECT	<unknown>	HIDDEN	12
__GI___ctype_toupper	.symtab	0x246e8	4	OBJECT	<unknown>	HIDDEN	12
__GI___errno_location	.symtab	0xf058	28	FUNC	<unknown>	HIDDEN	2
__GI___fcntl_nocancel	.symtab	0xee78	108	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x135c4	300	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x17c9c	24	FUNC	<unknown>	HIDDEN	2
__GI___h_errno_location	.symtab	0x12500	28	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0xee0c	108	FUNC	<unknown>	HIDDEN	2
__GI___sigaddset	.symtab	0xf89c	36	FUNC	<unknown>	HIDDEN	2
__GI___sigdelset	.symtab	0xf8c0	36	FUNC	<unknown>	HIDDEN	2
__GI___sigismember	.symtab	0xf878	36	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x119a4	124	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x11a74	108	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x17cb4	256	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0xefa0	44	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x1075c	296	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x10e8c	32	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x148ac	76	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0xed3c	52	FUNC	<unknown>	HIDDEN	2
__GI_clock_getres	.symtab	0x11f2c	52	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0xefcc	52	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0x12108	248	FUNC	<unknown>	HIDDEN	2
__GI_config_close	.symtab	0x12844	52	FUNC	<unknown>	HIDDEN	2
__GI_config_open	.symtab	0x12878	72	FUNC	<unknown>	HIDDEN	2
__GI_config_read	.symtab	0x1251c	808	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0xf5c4	56	FUNC	<unknown>	HIDDEN	2
__GI_errno	.symtab	0x28b6c	4	OBJECT	<unknown>	HIDDEN	13
__GI_exit	.symtab	0x11088	184	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x128c0	436	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0xee0c	108	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x133b8	524	FUNC	<unknown>	HIDDEN	2
__GI_fgetc	.symtab	0x13098	220	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x135c4	300	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x13174	188	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x136f0	160	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x12a74	32	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0xec78	52	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x17ad8	56	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x19100	36	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x19124	336	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x14938	88	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x17b10	176	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x135c4	300	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x12008	44	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x11f60	20	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x11f74	20	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x11ff4	20	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname	.symtab	0xf540	28	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2	.symtab	0xf55c	104	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2_r	.symtab	0x140ec	672	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x16578	760	FUNC	<unknown>	HIDDEN	2
__GI_gethostname	.symtab	0x168a4	120	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x11ef0	40	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0xec34	20	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x14904	52	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0xf5fc	56	FUNC	<unknown>	HIDDEN	2
__GI_gettimeofday	.symtab	0xedd8	52	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x11f18	20	FUNC	<unknown>	HIDDEN	2
__GI_h_errno	.symtab	0x28b70	4	OBJECT	<unknown>	HIDDEN	13
__GI_htonl	.symtab	0xf420	32	FUNC	<unknown>	HIDDEN	2
__GI_htons	.symtab	0xf410	16	FUNC	<unknown>	HIDDEN	2
__GI_inet_addr	.symtab	0xf518	40	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x13ff4	248	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa	.symtab	0xf4fc	28	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa_r	.symtab	0xf470	140	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x15428	644	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x150c8	540	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x10da8	228	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0xef4c	84	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x13f54	36	FUNC	<unknown>	HIDDEN	2
__GI_isspace	.symtab	0xf000	40	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0xeda4	52	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x16974	100	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x18e18	240	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0xf1b0	4	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x17bc0	4	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x14f18	36	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x18f08	224	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0xf080	156	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x11db4	104	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x14bc0	64	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x12034	52	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x12068	52	FUNC	<unknown>	HIDDEN	2
__GI_ntohl	.symtab	0xf450	32	FUNC	<unknown>	HIDDEN	2
__GI_ntohs	.symtab	0xf440	16	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0xebd4	96	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0x122d0	172	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x16870	52	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0xf7a4	28	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x1089c	164	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x10c40	144	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x13cdc	176	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0xed70	52	FUNC	<unknown>	HIDDEN	2
__GI_readdir64	.symtab	0x12414	236	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0xf678	56	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x11f88	108	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0xecfc	64	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0xf6b0	56	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0xf6e8	64	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0xef18	52	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0xf728	68	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x10b5c	228	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x11e1c	136	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0xf7c0	184	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x120d0	56	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x11140	172	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0xf76c	56	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x169d8	52	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x10cd0	216	FUNC	<unknown>	HIDDEN	2
__GI_stat	.symtab	0x1691c	88	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x18fe8	108	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0xf2f0	240	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul	.symtab	0x13e28	236	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0xf190	28	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0xf190	28	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0xf2cc	36	FUNC	<unknown>	HIDDEN	2
__GI_strcspn	.symtab	0x13c98	68	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x17db4	52	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0xf120	96	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x14f3c	188	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x17bd0	204	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x13f14	64	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x13dd8	80	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x13d8c	76	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0xf1d0	252	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0xf3e0	48	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x13c20	120	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x10eac	28	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x11338	1496	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x13f78	124	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0xec48	48	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0xf028	48	FUNC	<unknown>	HIDDEN	2
__GI_uname	.symtab	0x1821c	52	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x16a0c	180	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x11ebc	52	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0xecac	28	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x18250	84	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x182c8	176	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x182a4	36	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0xeee4	52	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x2462c	0	OBJECT	<unknown>	DEFAULT	10
__JCR_LIST__	.symtab	0x2462c	0	OBJECT	<unknown>	DEFAULT	10
__adddf3	.symtab	0x194c4	784	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmpeq	.symtab	0x19e20	24	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmple	.symtab	0x19e20	24	FUNC	<unknown>	HIDDEN	2
__aeabi_cdrcmple	.symtab	0x19e04	52	FUNC	<unknown>	HIDDEN	2
__aeabi_d2uiz	.symtab	0x19eb0	84	FUNC	<unknown>	HIDDEN	2
__aeabi_dadd	.symtab	0x194c4	784	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpeq	.symtab	0x19e38	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpge	.symtab	0x19e80	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpgt	.symtab	0x19e98	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmple	.symtab	0x19e68	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmplt	.symtab	0x19e50	24	FUNC	<unknown>	HIDDEN	2
__aeabi_ddiv	.symtab	0x19b64	524	FUNC	<unknown>	HIDDEN	2
__aeabi_dmul	.symtab	0x198d4	656	FUNC	<unknown>	HIDDEN	2
__aeabi_drsub	.symtab	0x194b8	0	FUNC	<unknown>	HIDDEN	2
__aeabi_dsub	.symtab	0x194c0	788	FUNC	<unknown>	HIDDEN	2
__aeabi_f2d	.symtab	0x19820	64	FUNC	<unknown>	HIDDEN	2
__aeabi_i2d	.symtab	0x197f8	40	FUNC	<unknown>	HIDDEN	2
__aeabi_idiv	.symtab	0x19374	0	FUNC	<unknown>	HIDDEN	2
__aeabi_idivmod	.symtab	0x194a0	24	FUNC	<unknown>	HIDDEN	2
__aeabi_l2d	.symtab	0x19874	96	FUNC	<unknown>	HIDDEN	2
__aeabi_ui2d	.symtab	0x197d4	36	FUNC	<unknown>	HIDDEN	2
__aeabi_uidiv	.symtab	0xeaac	0	FUNC	<unknown>	HIDDEN	2
__aeabi_uidivmod	.symtab	0xeba8	24	FUNC	<unknown>	HIDDEN	2
__aeabi_ul2d	.symtab	0x19860	116	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr0	.symtab	0x148f8	4	FUNC	<unknown>	DEFAULT	2
__aeabi_unwind_cpp_pr1	.symtab	0x148fc	4	FUNC	<unknown>	DEFAULT	2
__aeabi_unwind_cpp_pr2	.symtab	0x14900	4	FUNC	<unknown>	DEFAULT	2
__app_fini	.symtab	0x28b64	4	OBJECT	<unknown>	HIDDEN	13
__atexit_lock	.symtab	0x247c8	24	OBJECT	<unknown>	DEFAULT	12
__bss_end__	.symtab	0x2afa0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start	.symtab	0x24938	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start__	.symtab	0x24938	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x11a20	84	FUNC	<unknown>	DEFAULT	2
__close_nameservers	.symtab	0x16494	152	FUNC	<unknown>	HIDDEN	2
__cmpdf2	.symtab	0x19d80	132	FUNC	<unknown>	HIDDEN	2
__ctype_b	.symtab	0x246e0	4	OBJECT	<unknown>	DEFAULT	12
__ctype_tolower	.symtab	0x24934	4	OBJECT	<unknown>	DEFAULT	12
__ctype_toupper	.symtab	0x246e8	4	OBJECT	<unknown>	DEFAULT	12
__curbrk	.symtab	0x2ab7c	4	OBJECT	<unknown>	HIDDEN	13
__data_start	.symtab	0x246a8	0	NOTYPE	<unknown>	DEFAULT	12
__decode_dotted	.symtab	0x156ac	248	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x17ed4	180	FUNC	<unknown>	HIDDEN	2
__default_rt_sa_restorer	.symtab	0x11eb4	0	FUNC	<unknown>	DEFAULT	2
__default_sa_restorer	.symtab	0x11ea8	0	FUNC	<unknown>	DEFAULT	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__div0	.symtab	0xebc0	20	FUNC	<unknown>	HIDDEN	2
__divdf3	.symtab	0x19b64	524	FUNC	<unknown>	HIDDEN	2
__divsi3	.symtab	0x19374	300	FUNC	<unknown>	HIDDEN	2
__dns_lookup	.symtab	0x157a4	2024	FUNC	<unknown>	HIDDEN	2
__do_global_dtors_aux	.symtab	0x810c	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux_fini_array_entry	.symtab	0x24628	0	OBJECT	<unknown>	DEFAULT	9
__dso_handle	.symtab	0x246a8	0	OBJECT	<unknown>	HIDDEN	12
__encode_dotted	.symtab	0x19054	172	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x17de8	236	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x17f88	96	FUNC	<unknown>	HIDDEN	2
__end__	.symtab	0x2afa0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__environ	.symtab	0x28b5c	4	OBJECT	<unknown>	DEFAULT	13
__eqdf2	.symtab	0x19d80	132	FUNC	<unknown>	HIDDEN	2
__errno_location	.symtab	0xf058	28	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exidx_end	.symtab	0x1c620	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exidx_start	.symtab	0x1c610	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x28b54	4	OBJECT	<unknown>	HIDDEN	13
__extendsfdf2	.symtab	0x19820	64	FUNC	<unknown>	HIDDEN	2
__fcntl_nocancel	.symtab	0xee78	108	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x135c4	300	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x2462c	0	NOTYPE	<unknown>	HIDDEN	9
__fini_array_start	.symtab	0x24628	0	NOTYPE	<unknown>	HIDDEN	9
__fixunsdfsi	.symtab	0x19eb0	84	FUNC	<unknown>	HIDDEN	2
__floatdidf	.symtab	0x19874	96	FUNC	<unknown>	HIDDEN	2
__floatsidf	.symtab	0x197f8	40	FUNC	<unknown>	HIDDEN	2
__floatundidf	.symtab	0x19860	116	FUNC	<unknown>	HIDDEN	2
__floatunsidf	.symtab	0x197d4	36	FUNC	<unknown>	HIDDEN	2
__frame_dummy_init_array_entry	.symtab	0x24624	0	OBJECT	<unknown>	DEFAULT	8
__gedf2	.symtab	0x19d70	148	FUNC	<unknown>	HIDDEN	2
__get_hosts_byname_r	.symtab	0x1652c	76	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x14c00	324	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x11ef0	40	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x17c9c	24	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__gtdf2	.symtab	0x19d70	148	FUNC	<unknown>	HIDDEN	2
__h_errno_location	.symtab	0x12500	28	FUNC	<unknown>	DEFAULT	2
__h_errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__init_array_end	.symtab	0x24628	0	NOTYPE	<unknown>	HIDDEN	8
__init_array_start	.symtab	0x24624	0	NOTYPE	<unknown>	HIDDEN	8
__ledf2	.symtab	0x19d78	140	FUNC	<unknown>	HIDDEN	2
__libc_close	.symtab	0xefcc	52	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0xf5c4	56	FUNC	<unknown>	DEFAULT	2
__libc_fcntl	.symtab	0xee0c	108	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0xec78	52	FUNC	<unknown>	DEFAULT	2
__libc_lseek64	.symtab	0x16974	100	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0x12068	52	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0xebd4	96	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0xed70	52	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0xf678	56	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0xecfc	64	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0xf6b0	56	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0xf6e8	64	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x11e1c	136	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x28b58	4	OBJECT	<unknown>	DEFAULT	13
__libc_waitpid	.symtab	0xecac	28	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0xeee4	52	FUNC	<unknown>	DEFAULT	2
__local_nameserver	.symtab	0x1b664	16	OBJECT	<unknown>	HIDDEN	4
__ltdf2	.symtab	0x19d78	140	FUNC	<unknown>	HIDDEN	2
__malloc_consolidate	.symtab	0x1032c	436	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0xf8e4	120	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x246ec	24	OBJECT	<unknown>	DEFAULT	12
__malloc_state	.symtab	0x2abbc	888	OBJECT	<unknown>	DEFAULT	13
__malloc_trim	.symtab	0x1027c	176	FUNC	<unknown>	DEFAULT	2
__muldf3	.symtab	0x198d4	656	FUNC	<unknown>	HIDDEN	2
__nameserver	.symtab	0x2af44	4	OBJECT	<unknown>	HIDDEN	13
__nameservers	.symtab	0x2af48	4	OBJECT	<unknown>	HIDDEN	13
__nedf2	.symtab	0x19d80	132	FUNC	<unknown>	HIDDEN	2
__open_etc_hosts	.symtab	0x17fe8	48	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x16038	1116	FUNC	<unknown>	HIDDEN	2
__pagesize	.symtab	0x28b60	4	OBJECT	<unknown>	DEFAULT	13
__preinit_array_end	.symtab	0x24624	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__preinit_array_start	.symtab	0x24624	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__progname	.symtab	0x247e4	4	OBJECT	<unknown>	DEFAULT	12
__progname_full	.symtab	0x247e8	4	OBJECT	<unknown>	DEFAULT	12
__pthread_initialize_minimal	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0x11968	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x11960	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x11960	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x11960	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x11960	8	FUNC	<unknown>	DEFAULT	2
__read_etc_hosts_r	.symtab	0x18018	516	FUNC	<unknown>	HIDDEN	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__res_sync	.symtab	0x2af3c	4	OBJECT	<unknown>	HIDDEN	13
__resolv_attempts	.symtab	0x2492b	1	OBJECT	<unknown>	HIDDEN	12
__resolv_lock	.symtab	0x2ab84	24	OBJECT	<unknown>	DEFAULT	13
__resolv_timeout	.symtab	0x2492a	1	OBJECT	<unknown>	HIDDEN	12
__rtld_fini	.symtab	0x28b68	4	OBJECT	<unknown>	HIDDEN	13
__searchdomain	.symtab	0x2af40	4	OBJECT	<unknown>	HIDDEN	13
__searchdomains	.symtab	0x2af4c	4	OBJECT	<unknown>	HIDDEN	13
__sigaddset	.symtab	0xf89c	36	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0xf8c0	36	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0xf878	36	FUNC	<unknown>	DEFAULT	2
__stdin	.symtab	0x2482c	4	OBJECT	<unknown>	DEFAULT	12
__stdio_READ	.symtab	0x14d44	88	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x14d9c	180	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x19274	196	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x18378	320	FUNC	<unknown>	HIDDEN	2
__stdio_init_mutex	.symtab	0x12e04	52	FUNC	<unknown>	HIDDEN	2
__stdio_mutex_initializer.4636	.symtab	0x1b5e8	24	OBJECT	<unknown>	DEFAULT	4
__stdio_rfill	.symtab	0x14e50	48	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x19338	60	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x14e80	152	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x184b8	208	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x12f0c	48	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x24830	4	OBJECT	<unknown>	DEFAULT	12
__subdf3	.symtab	0x194c0	788	FUNC	<unknown>	HIDDEN	2
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_rt_sigaction	.symtab	0x1209c	52	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uClibc_fini	.symtab	0x119a4	124	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x11a74	108	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x11ae0	724	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x247e0	4	OBJECT	<unknown>	HIDDEN	12
__udivsi3	.symtab	0xeaac	252	FUNC	<unknown>	HIDDEN	2
__xpg_strerror_r	.symtab	0x17cb4	256	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__xstat32_conv	.symtab	0x14a5c	172	FUNC	<unknown>	HIDDEN	2
__xstat64_conv	.symtab	0x14990	204	FUNC	<unknown>	HIDDEN	2
__xstat_conv	.symtab	0x14b08	184	FUNC	<unknown>	HIDDEN	2
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_bss_custom_printf_spec	.symtab	0x2aba0	10	OBJECT	<unknown>	DEFAULT	13
_bss_end__	.symtab	0x2afa0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_call_via_fp	.symtab	0x80fd	4	FUNC	<unknown>	HIDDEN	2
_call_via_ip	.symtab	0x8101	4	FUNC	<unknown>	HIDDEN	2
_call_via_lr	.symtab	0x8109	4	FUNC	<unknown>	HIDDEN	2
_call_via_r0	.symtab	0x80d1	4	FUNC	<unknown>	HIDDEN	2
_call_via_r1	.symtab	0x80d5	4	FUNC	<unknown>	HIDDEN	2
_call_via_r2	.symtab	0x80d9	4	FUNC	<unknown>	HIDDEN	2
_call_via_r3	.symtab	0x80dd	4	FUNC	<unknown>	HIDDEN	2
_call_via_r4	.symtab	0x80e1	4	FUNC	<unknown>	HIDDEN	2
_call_via_r5	.symtab	0x80e5	4	FUNC	<unknown>	HIDDEN	2
_call_via_r6	.symtab	0x80e9	4	FUNC	<unknown>	HIDDEN	2
_call_via_r7	.symtab	0x80ed	4	FUNC	<unknown>	HIDDEN	2
_call_via_r8	.symtab	0x80f1	4	FUNC	<unknown>	HIDDEN	2
_call_via_r9	.symtab	0x80f5	4	FUNC	<unknown>	HIDDEN	2
_call_via_sl	.symtab	0x80f9	4	FUNC	<unknown>	HIDDEN	2
_call_via_sp	.symtab	0x8105	4	FUNC	<unknown>	HIDDEN	2
_charpad	.symtab	0x16ac0	84	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_custom_printf_arginfo	.symtab	0x2af50	40	OBJECT	<unknown>	HIDDEN	13
_custom_printf_handler	.symtab	0x2af78	40	OBJECT	<unknown>	HIDDEN	13
_custom_printf_spec	.symtab	0x2492c	4	OBJECT	<unknown>	HIDDEN	12
_dl_aux_init	.symtab	0x14874	56	FUNC	<unknown>	DEFAULT	2
_dl_phdr	.symtab	0x2af34	4	OBJECT	<unknown>	DEFAULT	13
_dl_phnum	.symtab	0x2af38	4	OBJECT	<unknown>	DEFAULT	13
_edata	.symtab	0x24938	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x2afa0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_errno	.symtab	0x28b6c	4	OBJECT	<unknown>	DEFAULT	13
_exit	.symtab	0xefa0	44	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x19f04	0	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x28b7c	8192	OBJECT	<unknown>	DEFAULT	13
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x16b14	132	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x18624	2036	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_h_errno	.symtab	0x28b70	4	OBJECT	<unknown>	DEFAULT	13
_init	.symtab	0x80b4	0	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x18588	112	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_memcpy	.symtab	0x13790	0	FUNC	<unknown>	HIDDEN	2
_ppfs_init	.symtab	0x17280	160	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x17568	1392	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x17320	68	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x17364	432	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x17514	84	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x11978	44	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x11970	8	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_sigintr	.symtab	0x2abb4	8	OBJECT	<unknown>	HIDDEN	13
_start	.symtab	0x81b0	0	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x12a94	776	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x12d9c	104	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x24834	4	OBJECT	<unknown>	DEFAULT	12
_stdio_openlist_add_lock	.symtab	0x247ec	24	OBJECT	<unknown>	DEFAULT	12
_stdio_openlist_dec_use	.symtab	0x13230	392	FUNC	<unknown>	HIDDEN	2
_stdio_openlist_del_count	.symtab	0x28b78	4	OBJECT	<unknown>	DEFAULT	13
_stdio_openlist_del_lock	.symtab	0x24804	24	OBJECT	<unknown>	DEFAULT	12
_stdio_openlist_use_count	.symtab	0x28b74	4	OBJECT	<unknown>	DEFAULT	13
_stdio_streams	.symtab	0x24838	240	OBJECT	<unknown>	DEFAULT	12
_stdio_term	.symtab	0x12e38	212	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x2481c	4	OBJECT	<unknown>	DEFAULT	12
_stdlib_strto_l	.symtab	0x10ec8	448	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x185f8	44	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x1b72c	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x12f3c	348	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x16b98	1768	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x1075c	296	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
access	.symtab	0xecc8	52	FUNC	<unknown>	DEFAULT	2
access.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
aeabi_unwind_cpp_pr1.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
astd	.symtab	0xc788	336	FUNC	<unknown>	DEFAULT	2
atcp	.symtab	0xc0c8	1728	FUNC	<unknown>	DEFAULT	2
atoi	.symtab	0x10e8c	32	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x10e8c	32	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
audp	.symtab	0xbb34	1428	FUNC	<unknown>	DEFAULT	2
bcopy	.symtab	0xf180	16	FUNC	<unknown>	DEFAULT	2
been_there_done_that	.symtab	0x28b50	4	OBJECT	<unknown>	DEFAULT	13
brk	.symtab	0x148ac	76	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0xf7c0	184	FUNC	<unknown>	DEFAULT	2
buf.2975	.symtab	0x28974	16	OBJECT	<unknown>	DEFAULT	13
buf.5444	.symtab	0x28984	440	OBJECT	<unknown>	DEFAULT	13
bzero	.symtab	0xf1c0	12	FUNC	<unknown>	DEFAULT	2
c	.symtab	0x246d4	4	OBJECT	<unknown>	DEFAULT	12
calloc	.symtab	0x1438c	308	FUNC	<unknown>	DEFAULT	2
calloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
chdir	.symtab	0xed3c	52	FUNC	<unknown>	DEFAULT	2
chdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
clock_getres	.symtab	0x11f2c	52	FUNC	<unknown>	DEFAULT	2
clock_getres.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0xefcc	52	FUNC	<unknown>	DEFAULT	2
close.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
closedir	.symtab	0x12108	248	FUNC	<unknown>	DEFAULT	2
closedir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
closenameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
commServer	.symtab	0x246b0	4	OBJECT	<unknown>	DEFAULT	12
completed.4959	.symtab	0x24938	1	OBJECT	<unknown>	DEFAULT	13
connect	.symtab	0xf5c4	56	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connectTimeout	.symtab	0x95cc	628	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
csum	.symtab	0x99e8	340	FUNC	<unknown>	DEFAULT	2
currentServer	.symtab	0x246d0	4	OBJECT	<unknown>	DEFAULT	12
data_start	.symtab	0x246ac	0	NOTYPE	<unknown>	DEFAULT	12
decoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dnslookup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ	.symtab	0x28b5c	4	OBJECT	<unknown>	DEFAULT	13
errno	.symtab	0x28b6c	4	OBJECT	<unknown>	DEFAULT	13
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x11088	184	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x1c2b0	72	OBJECT	<unknown>	DEFAULT	4
fclose	.symtab	0x128c0	436	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0xee0c	108	FUNC	<unknown>	DEFAULT	2
fd_to_DIR	.symtab	0x12200	208	FUNC	<unknown>	DEFAULT	2
fdgets	.symtab	0x846c	212	FUNC	<unknown>	DEFAULT	2
fdopendir	.symtab	0x1237c	152	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x133b8	524	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc	.symtab	0x13098	220	FUNC	<unknown>	DEFAULT	2
fgetc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x135c4	300	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x13174	188	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x136f0	160	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fmt	.symtab	0x1c298	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x12a74	32	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0xec78	52	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs_unlocked	.symtab	0x17ad8	56	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x8150	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x104e0	572	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x19100	36	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x19100	36	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x19124	336	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fstat	.symtab	0x14938	88	FUNC	<unknown>	DEFAULT	2
fstat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ftcp	.symtab	0xa16c	1728	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked	.symtab	0x17b10	176	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getArch	.symtab	0xc8d8	36	FUNC	<unknown>	DEFAULT	2
getHost	.symtab	0x91d4	104	FUNC	<unknown>	DEFAULT	2
getOurIP	.symtab	0x8540	700	FUNC	<unknown>	DEFAULT	2
getPortz	.symtab	0xc8fc	212	FUNC	<unknown>	DEFAULT	2
getRandomIP	.symtab	0x8408	100	FUNC	<unknown>	DEFAULT	2
get_hosts_byname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getc	.symtab	0x13098	220	FUNC	<unknown>	DEFAULT	2
getc_unlocked	.symtab	0x135c4	300	FUNC	<unknown>	DEFAULT	2
getdents64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdtablesize	.symtab	0x12008	44	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x11f60	20	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x11f74	20	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x11ff4	20	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname	.symtab	0xf540	28	FUNC	<unknown>	DEFAULT	2
gethostbyname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname2	.symtab	0xf55c	104	FUNC	<unknown>	DEFAULT	2
gethostbyname2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname2_r	.symtab	0x140ec	672	FUNC	<unknown>	DEFAULT	2
gethostbyname2_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r	.symtab	0x16578	760	FUNC	<unknown>	DEFAULT	2
gethostbyname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostname	.symtab	0x168a4	120	FUNC	<unknown>	DEFAULT	2
gethostname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpagesize	.symtab	0x11ef0	40	FUNC	<unknown>	DEFAULT	2
getpagesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0xec34	20	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x14904	52	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockname	.symtab	0xf5fc	56	FUNC	<unknown>	DEFAULT	2
getsockname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0xf634	68	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gettimeofday	.symtab	0xedd8	52	FUNC	<unknown>	DEFAULT	2
gettimeofday.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x11f18	20	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gotIP	.symtab	0x2495c	4	OBJECT	<unknown>	DEFAULT	13
h_errno	.symtab	0x28b70	4	OBJECT	<unknown>	DEFAULT	13
hoste.5443	.symtab	0x28b3c	20	OBJECT	<unknown>	DEFAULT	13
htonl	.symtab	0xf420	32	FUNC	<unknown>	DEFAULT	2
htons	.symtab	0xf410	16	FUNC	<unknown>	DEFAULT	2
i.4588	.symtab	0x246d8	4	OBJECT	<unknown>	DEFAULT	12
index	.symtab	0xf2f0	240	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0xf518	40	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x13ff4	248	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa	.symtab	0xf4fc	28	FUNC	<unknown>	DEFAULT	2
inet_ntoa.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa_r	.symtab	0xf470	140	FUNC	<unknown>	DEFAULT	2
inet_ntop	.symtab	0x15428	644	FUNC	<unknown>	DEFAULT	2
inet_ntop4	.symtab	0x152e4	324	FUNC	<unknown>	DEFAULT	2
inet_pton	.symtab	0x150c8	540	FUNC	<unknown>	DEFAULT	2
inet_pton4	.symtab	0x14ff8	208	FUNC	<unknown>	DEFAULT	2
initConnection	.symtab	0xe114	400	FUNC	<unknown>	DEFAULT	2
init_rand	.symtab	0x81ec	216	FUNC	<unknown>	DEFAULT	2
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initstate	.symtab	0x109f8	192	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x10da8	228	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0xef4c	84	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isatty	.symtab	0x13f54	36	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isspace	.symtab	0xf000	40	FUNC	<unknown>	DEFAULT	2
isspace.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0xeda4	52	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
last_id.5501	.symtab	0x24928	2	OBJECT	<unknown>	DEFAULT	12
last_ns_num.5500	.symtab	0x2ab80	4	OBJECT	<unknown>	DEFAULT	13
libc/string/arm/_memcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/bcopy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/bzero.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/memcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/memmove.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/memset.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/strcmp.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/strlen.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/crt1.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/crti.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/crtn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/sigrestorer.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
listFork	.symtab	0x9840	424	FUNC	<unknown>	DEFAULT	2
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x16974	100	FUNC	<unknown>	DEFAULT	2
macAddress	.symtab	0x24968	6	OBJECT	<unknown>	DEFAULT	13
main	.symtab	0xe2a4	2056	FUNC	<unknown>	DEFAULT	2
mainCommSock	.symtab	0x24958	4	OBJECT	<unknown>	DEFAULT	13
makeIPPacket	.symtab	0x9c10	256	FUNC	<unknown>	DEFAULT	2
makeRandomStr	.symtab	0x923c	184	FUNC	<unknown>	DEFAULT	2
makevsepacket	.symtab	0xaab0	292	FUNC	<unknown>	DEFAULT	2
malloc	.symtab	0xf95c	2336	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
malloc_trim	.symtab	0x1071c	64	FUNC	<unknown>	DEFAULT	2
memchr	.symtab	0x18e18	240	FUNC	<unknown>	DEFAULT	2
memchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memcpy	.symtab	0xf1b0	4	FUNC	<unknown>	DEFAULT	2
memmove	.symtab	0x17bc0	4	FUNC	<unknown>	DEFAULT	2
mempcpy	.symtab	0x14f18	36	FUNC	<unknown>	DEFAULT	2
mempcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memrchr	.symtab	0x18f08	224	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0xf080	156	FUNC	<unknown>	DEFAULT	2
mmap	.symtab	0x11db4	104	FUNC	<unknown>	DEFAULT	2
mmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mremap	.symtab	0x14bc0	64	FUNC	<unknown>	DEFAULT	2
mremap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
munmap	.symtab	0x12034	52	FUNC	<unknown>	DEFAULT	2
munmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mylock	.symtab	0x24704	24	OBJECT	<unknown>	DEFAULT	12
mylock	.symtab	0x2471c	24	OBJECT	<unknown>	DEFAULT	12
nanosleep	.symtab	0x12068	52	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
next_start.1358	.symtab	0x28970	4	OBJECT	<unknown>	DEFAULT	13
nprocessors_onln	.symtab	0x111ec	332	FUNC	<unknown>	DEFAULT	2
ntohl	.symtab	0xf450	32	FUNC	<unknown>	DEFAULT	2
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0xf440	16	FUNC	<unknown>	DEFAULT	2
ntop.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
numpids	.symtab	0x24960	8	OBJECT	<unknown>	DEFAULT	13

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-16T12:51:10.164422+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55124	150.241.88.132	25565	TCP
2024-12-16T12:51:12.483695+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55126	150.241.88.132	25565	TCP
2024-12-16T12:51:14.815100+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55128	150.241.88.132	25565	TCP
2024-12-16T12:51:17.139766+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55130	150.241.88.132	25565	TCP
2024-12-16T12:51:19.470761+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55132	150.241.88.132	25565	TCP
2024-12-16T12:51:21.795640+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55134	150.241.88.132	25565	TCP
2024-12-16T12:51:24.172878+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55136	150.241.88.132	25565	TCP
2024-12-16T12:51:26.548187+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55138	150.241.88.132	25565	TCP
2024-12-16T12:51:28.875333+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55140	150.241.88.132	25565	TCP
2024-12-16T12:51:31.202517+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55142	150.241.88.132	25565	TCP
2024-12-16T12:51:33.530485+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55144	150.241.88.132	25565	TCP
2024-12-16T12:51:35.858821+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55146	150.241.88.132	25565	TCP
2024-12-16T12:51:38.235773+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55148	150.241.88.132	25565	TCP
2024-12-16T12:51:40.562571+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55150	150.241.88.132	25565	TCP
2024-12-16T12:51:42.890444+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55152	150.241.88.132	25565	TCP
2024-12-16T12:51:45.223623+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55154	150.241.88.132	25565	TCP
2024-12-16T12:51:47.546609+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55156	150.241.88.132	25565	TCP
2024-12-16T12:51:49.875151+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55158	150.241.88.132	25565	TCP
2024-12-16T12:51:52.202604+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55160	150.241.88.132	25565	TCP
2024-12-16T12:51:54.550092+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55162	150.241.88.132	25565	TCP
2024-12-16T12:51:56.875636+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55164	150.241.88.132	25565	TCP
2024-12-16T12:51:59.203515+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55166	150.241.88.132	25565	TCP
2024-12-16T12:52:01.655218+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55168	150.241.88.132	25565	TCP
2024-12-16T12:52:03.984526+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55170	150.241.88.132	25565	TCP
2024-12-16T12:52:06.360856+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55172	150.241.88.132	25565	TCP
2024-12-16T12:52:08.688273+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55174	150.241.88.132	25565	TCP
2024-12-16T12:52:11.065789+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55176	150.241.88.132	25565	TCP
2024-12-16T12:52:13.412646+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55178	150.241.88.132	25565	TCP
2024-12-16T12:52:15.754016+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55180	150.241.88.132	25565	TCP
2024-12-16T12:52:18.078917+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55182	150.241.88.132	25565	TCP
2024-12-16T12:52:20.407215+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55184	150.241.88.132	25565	TCP
2024-12-16T12:52:22.739207+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55186	150.241.88.132	25565	TCP
2024-12-16T12:52:25.064966+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55188	150.241.88.132	25565	TCP
2024-12-16T12:52:27.395682+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55190	150.241.88.132	25565	TCP
2024-12-16T12:52:29.784008+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55192	150.241.88.132	25565	TCP
2024-12-16T12:52:32.110172+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55194	150.241.88.132	25565	TCP
2024-12-16T12:52:34.441205+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55196	150.241.88.132	25565	TCP
2024-12-16T12:52:36.815476+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55198	150.241.88.132	25565	TCP
2024-12-16T12:52:39.157195+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55200	150.241.88.132	25565	TCP
2024-12-16T12:52:41.535209+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55202	150.241.88.132	25565	TCP
2024-12-16T12:52:43.862477+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55204	150.241.88.132	25565	TCP
2024-12-16T12:52:46.439933+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55206	150.241.88.132	25565	TCP
2024-12-16T12:52:48.766558+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55208	150.241.88.132	25565	TCP
2024-12-16T12:52:51.094241+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55210	150.241.88.132	25565	TCP
2024-12-16T12:52:53.471502+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55212	150.241.88.132	25565	TCP
2024-12-16T12:52:55.846003+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55214	150.241.88.132	25565	TCP
2024-12-16T12:52:58.173196+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55216	150.241.88.132	25565	TCP
2024-12-16T12:53:00.500925+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55218	150.241.88.132	25565	TCP
2024-12-16T12:53:02.829443+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55220	150.241.88.132	25565	TCP
2024-12-16T12:53:05.202446+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55222	150.241.88.132	25565	TCP
2024-12-16T12:53:07.533093+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55224	150.241.88.132	25565	TCP
2024-12-16T12:53:09.862420+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55226	150.241.88.132	25565	TCP
2024-12-16T12:53:12.190270+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55228	150.241.88.132	25565	TCP
2024-12-16T12:53:14.516347+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55230	150.241.88.132	25565	TCP
2024-12-16T12:53:16.848461+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55232	150.241.88.132	25565	TCP
2024-12-16T12:53:19.174572+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55234	150.241.88.132	25565	TCP
2024-12-16T12:53:21.550064+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55236	150.241.88.132	25565	TCP
2024-12-16T12:53:23.880237+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55238	150.241.88.132	25565	TCP
2024-12-16T12:53:26.204630+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55240	150.241.88.132	25565	TCP
2024-12-16T12:53:28.533540+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55242	150.241.88.132	25565	TCP
2024-12-16T12:53:30.885923+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55244	150.241.88.132	25565	TCP
2024-12-16T12:53:33.204759+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55246	150.241.88.132	25565	TCP
2024-12-16T12:53:35.533598+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55248	150.241.88.132	25565	TCP
2024-12-16T12:53:37.860955+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55250	150.241.88.132	25565	TCP
2024-12-16T12:53:40.238351+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55252	150.241.88.132	25565	TCP
2024-12-16T12:53:42.630031+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55254	150.241.88.132	25565	TCP
2024-12-16T12:53:44.955242+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55256	150.241.88.132	25565	TCP
2024-12-16T12:53:47.299104+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55258	150.241.88.132	25565	TCP
2024-12-16T12:53:49.630635+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55260	150.241.88.132	25565	TCP
2024-12-16T12:53:51.958167+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55262	150.241.88.132	25565	TCP
2024-12-16T12:53:54.336632+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55264	150.241.88.132	25565	TCP
2024-12-16T12:53:56.706370+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55266	150.241.88.132	25565	TCP
2024-12-16T12:53:59.082491+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55268	150.241.88.132	25565	TCP
2024-12-16T12:54:01.408920+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55270	150.241.88.132	25565	TCP
2024-12-16T12:54:03.800877+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55272	150.241.88.132	25565	TCP
2024-12-16T12:54:06.127432+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55274	150.241.88.132	25565	TCP
2024-12-16T12:54:08.456397+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55276	150.241.88.132	25565	TCP
2024-12-16T12:54:10.784226+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55278	150.241.88.132	25565	TCP
2024-12-16T12:54:13.118033+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55280	150.241.88.132	25565	TCP
2024-12-16T12:54:15.439601+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55282	150.241.88.132	25565	TCP
2024-12-16T12:54:17.772186+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55284	150.241.88.132	25565	TCP
2024-12-16T12:54:20.096623+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55286	150.241.88.132	25565	TCP
2024-12-16T12:54:22.473903+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55288	150.241.88.132	25565	TCP
2024-12-16T12:54:24.803389+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55290	150.241.88.132	25565	TCP
2024-12-16T12:54:27.131475+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55292	150.241.88.132	25565	TCP
2024-12-16T12:54:29.459013+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55294	150.241.88.132	25565	TCP
2024-12-16T12:54:31.787386+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55296	150.241.88.132	25565	TCP
2024-12-16T12:54:34.113155+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55298	150.241.88.132	25565	TCP
2024-12-16T12:54:36.506645+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55300	150.241.88.132	25565	TCP
2024-12-16T12:54:38.926531+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55302	150.241.88.132	25565	TCP
2024-12-16T12:54:41.253521+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55304	150.241.88.132	25565	TCP
2024-12-16T12:54:43.584170+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	55306	150.241.88.132	25565	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 16, 2024 12:51:10.043200970 CET	55124	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:10.163201094 CET	25565	55124	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:10.163301945 CET	55124	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:10.164422035 CET	55124	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:10.284225941 CET	25565	55124	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:12.362282038 CET	25565	55124	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:12.362910986 CET	55124	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:12.362946987 CET	55124	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:12.363629103 CET	55126	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:12.482778072 CET	25565	55124	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:12.483346939 CET	25565	55126	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:12.483439922 CET	55126	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:12.483695030 CET	55126	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:12.603486061 CET	25565	55126	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:14.694005013 CET	25565	55126	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:14.694247961 CET	55126	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:14.695162058 CET	55128	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:14.813982964 CET	25565	55126	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:14.814835072 CET	25565	55128	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:14.815023899 CET	55128	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:14.815099955 CET	55128	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:14.939454079 CET	25565	55128	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:17.018707991 CET	25565	55128	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:17.019048929 CET	55128	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:17.019859076 CET	55130	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:17.138962030 CET	25565	55128	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:17.139605045 CET	25565	55130	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:17.139765978 CET	55130	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:17.139765978 CET	55130	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:17.260102034 CET	25565	55130	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:19.350034952 CET	25565	55130	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:19.350200891 CET	55130	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:19.350907087 CET	55132	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:19.469902992 CET	25565	55130	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:19.470552921 CET	25565	55132	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:19.470671892 CET	55132	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:19.470761061 CET	55132	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:19.590554953 CET	25565	55132	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:21.674885035 CET	25565	55132	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:21.675093889 CET	55132	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:21.675730944 CET	55134	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:21.794889927 CET	25565	55132	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:21.795475006 CET	25565	55134	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:21.795552015 CET	55134	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:21.795639992 CET	55134	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:21.915400028 CET	25565	55134	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:24.051877022 CET	25565	55134	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:24.052175999 CET	55134	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:24.052789927 CET	55136	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:24.172039032 CET	25565	55134	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:24.172607899 CET	25565	55136	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:24.172710896 CET	55136	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:24.172878027 CET	55136	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:24.292617083 CET	25565	55136	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:26.426793098 CET	25565	55136	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:26.427047014 CET	55136	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:26.428040028 CET	55138	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:26.546868086 CET	25565	55136	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:26.547892094 CET	25565	55138	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:26.548007011 CET	55138	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:26.548187017 CET	55138	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:26.667938948 CET	25565	55138	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:28.753106117 CET	25565	55138	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:28.754034042 CET	55138	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:28.754590034 CET	55140	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:28.874866962 CET	25565	55138	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:28.874890089 CET	25565	55140	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:28.875333071 CET	55140	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:28.875333071 CET	55140	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:28.995173931 CET	25565	55140	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:31.081397057 CET	25565	55140	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:31.081587076 CET	55140	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:31.082221985 CET	55142	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:31.201565027 CET	25565	55140	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:31.202230930 CET	25565	55142	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:31.202404976 CET	55142	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:31.202517033 CET	55142	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:31.336699009 CET	25565	55142	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:33.409518003 CET	25565	55142	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:33.409787893 CET	55142	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:33.410542965 CET	55144	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:33.529663086 CET	25565	55142	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:33.530312061 CET	25565	55144	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:33.530416965 CET	55144	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:33.530484915 CET	55144	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:33.654441118 CET	25565	55144	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:35.737837076 CET	25565	55144	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:35.738019943 CET	55144	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:35.738729954 CET	55146	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:35.858211994 CET	25565	55144	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:35.858504057 CET	25565	55146	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:35.858592987 CET	55146	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:35.858820915 CET	55146	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:35.979232073 CET	25565	55146	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:38.114702940 CET	25565	55146	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:38.114949942 CET	55146	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:38.115706921 CET	55148	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:38.234864950 CET	25565	55146	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:38.235496998 CET	25565	55148	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:38.235686064 CET	55148	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:38.235773087 CET	55148	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:38.355551004 CET	25565	55148	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:40.441129923 CET	25565	55148	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:40.441381931 CET	55148	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:40.442521095 CET	55150	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:40.561188936 CET	25565	55148	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:40.562297106 CET	25565	55150	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:40.562433958 CET	55150	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:40.562571049 CET	55150	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:40.682626009 CET	25565	55150	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:42.769505024 CET	25565	55150	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:42.769701004 CET	55150	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:42.770453930 CET	55152	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:42.889612913 CET	25565	55150	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:42.890218973 CET	25565	55152	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:42.890389919 CET	55152	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:42.890444040 CET	55152	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:43.012356997 CET	25565	55152	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:45.101115942 CET	25565	55152	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:45.101356030 CET	55152	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:45.103614092 CET	55154	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:45.221163988 CET	25565	55152	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:45.223459005 CET	25565	55154	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:45.223583937 CET	55154	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:45.223623037 CET	55154	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:45.343482971 CET	25565	55154	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:47.425267935 CET	25565	55154	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:47.425499916 CET	55154	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:47.426265001 CET	55156	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:47.545725107 CET	25565	55154	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:47.546295881 CET	25565	55156	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:47.546469927 CET	55156	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:47.546608925 CET	55156	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:47.666938066 CET	25565	55156	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:49.753776073 CET	25565	55156	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:49.753947973 CET	55156	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:49.754993916 CET	55158	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:49.874028921 CET	25565	55156	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:49.874912977 CET	25565	55158	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:49.875025988 CET	55158	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:49.875150919 CET	55158	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:49.994798899 CET	25565	55158	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:52.081572056 CET	25565	55158	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:52.081768990 CET	55158	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:52.082607985 CET	55160	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:52.201805115 CET	25565	55158	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:52.202421904 CET	25565	55160	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:52.202522039 CET	55160	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:52.202604055 CET	55160	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:52.322609901 CET	25565	55160	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:54.428627968 CET	25565	55160	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:54.428838015 CET	55160	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:54.429975986 CET	55162	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:54.548633099 CET	25565	55160	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:54.549815893 CET	25565	55162	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:54.549973965 CET	55162	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:54.550091982 CET	55162	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:54.670114994 CET	25565	55162	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:56.754326105 CET	25565	55162	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:56.754616022 CET	55162	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:56.755624056 CET	55164	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:56.874500990 CET	25565	55162	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:56.875379086 CET	25565	55164	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:56.875508070 CET	55164	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:56.875636101 CET	55164	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:56.995626926 CET	25565	55164	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:59.081896067 CET	25565	55164	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:59.082192898 CET	55164	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:59.083405972 CET	55166	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:59.202020884 CET	25565	55164	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:59.203296900 CET	25565	55166	150.241.88.132	192.168.2.15
Dec 16, 2024 12:51:59.203515053 CET	55166	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:59.203515053 CET	55166	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:51:59.323637009 CET	25565	55166	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:01.428816080 CET	25565	55166	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:01.429061890 CET	55166	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:01.429888010 CET	55168	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:01.654900074 CET	25565	55166	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:01.654922962 CET	25565	55168	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:01.655056000 CET	55168	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:01.655217886 CET	55168	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:01.901146889 CET	25565	55168	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:03.863524914 CET	25565	55168	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:03.863823891 CET	55168	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:03.864610910 CET	55170	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:03.983635902 CET	25565	55168	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:03.984328032 CET	25565	55170	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:03.984422922 CET	55170	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:03.984525919 CET	55170	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:04.104295015 CET	25565	55170	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:06.239727020 CET	25565	55170	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:06.239914894 CET	55170	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:06.240742922 CET	55172	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:06.359836102 CET	25565	55170	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:06.360512972 CET	25565	55172	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:06.360757113 CET	55172	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:06.360856056 CET	55172	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:06.480658054 CET	25565	55172	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:08.566957951 CET	25565	55172	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:08.567276955 CET	55172	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:08.568196058 CET	55174	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:08.687160015 CET	25565	55172	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:08.687936068 CET	25565	55174	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:08.688116074 CET	55174	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:08.688272953 CET	55174	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:08.808058977 CET	25565	55174	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:10.944052935 CET	25565	55174	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:10.944313049 CET	55174	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:10.945698977 CET	55176	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:11.064069033 CET	25565	55174	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:11.065445900 CET	25565	55176	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:11.065618992 CET	55176	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:11.065788984 CET	55176	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:11.185513973 CET	25565	55176	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:13.288683891 CET	25565	55176	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:13.289150953 CET	55176	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:13.292323112 CET	55178	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:13.409012079 CET	25565	55176	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:13.412343979 CET	25565	55178	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:13.412477016 CET	55178	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:13.412646055 CET	55178	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:13.532701969 CET	25565	55178	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:15.632890940 CET	25565	55178	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:15.633132935 CET	55178	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:15.633909941 CET	55180	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:15.753077030 CET	25565	55178	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:15.753827095 CET	25565	55180	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:15.753941059 CET	55180	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:15.754015923 CET	55180	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:15.876821995 CET	25565	55180	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:17.957160950 CET	25565	55180	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:17.957422972 CET	55180	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:17.958306074 CET	55182	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:18.077915907 CET	25565	55180	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:18.078677893 CET	25565	55182	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:18.078829050 CET	55182	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:18.078917027 CET	55182	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:18.198725939 CET	25565	55182	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:20.285954952 CET	25565	55182	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:20.286257982 CET	55182	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:20.287197113 CET	55184	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:20.406090975 CET	25565	55182	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:20.406969070 CET	25565	55184	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:20.407139063 CET	55184	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:20.407215118 CET	55184	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:20.527017117 CET	25565	55184	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:22.617161036 CET	25565	55184	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:22.617450953 CET	55184	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:22.618273020 CET	55186	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:22.738703012 CET	25565	55184	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:22.738936901 CET	25565	55186	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:22.739063025 CET	55186	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:22.739207029 CET	55186	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:22.859525919 CET	25565	55186	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:24.943460941 CET	25565	55186	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:24.943969011 CET	55186	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:24.944725990 CET	55188	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:25.063791990 CET	25565	55186	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:25.064481974 CET	25565	55188	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:25.064697981 CET	55188	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:25.064965963 CET	55188	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:25.184880972 CET	25565	55188	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:27.273269892 CET	25565	55188	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:27.273514032 CET	55188	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:27.275070906 CET	55190	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:27.393934965 CET	25565	55188	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:27.395442963 CET	25565	55190	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:27.395524979 CET	55190	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:27.395682096 CET	55190	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:27.515386105 CET	25565	55190	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:29.662821054 CET	25565	55190	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:29.663122892 CET	55190	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:29.663842916 CET	55192	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:29.783015966 CET	25565	55190	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:29.783622026 CET	25565	55192	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:29.783797979 CET	55192	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:29.784008026 CET	55192	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:29.903805017 CET	25565	55192	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:31.988955021 CET	25565	55192	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:31.989157915 CET	55192	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:31.989907980 CET	55194	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:32.109291077 CET	25565	55192	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:32.109966040 CET	25565	55194	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:32.110057116 CET	55194	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:32.110172033 CET	55194	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:32.229959965 CET	25565	55194	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:34.320175886 CET	25565	55194	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:34.320555925 CET	55194	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:34.320555925 CET	55194	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:34.321150064 CET	55196	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:34.440717936 CET	25565	55194	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:34.440988064 CET	25565	55196	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:34.441098928 CET	55196	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:34.441205025 CET	55196	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:34.561036110 CET	25565	55196	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:36.693675995 CET	25565	55196	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:36.693824053 CET	55196	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:36.694365025 CET	55198	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:36.814858913 CET	25565	55196	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:36.815298080 CET	25565	55198	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:36.815402031 CET	55198	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:36.815475941 CET	55198	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:36.938262939 CET	25565	55198	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:39.036153078 CET	25565	55198	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:39.036436081 CET	55198	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:39.037208080 CET	55200	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:39.156625032 CET	25565	55198	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:39.157032013 CET	25565	55200	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:39.157124043 CET	55200	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:39.157195091 CET	55200	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:39.278331995 CET	25565	55200	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:41.412445068 CET	25565	55200	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:41.412710905 CET	55200	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:41.413892984 CET	55202	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:41.534116983 CET	25565	55200	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:41.535048008 CET	25565	55202	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:41.535147905 CET	55202	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:41.535208941 CET	55202	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:41.659007072 CET	25565	55202	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:43.739773989 CET	25565	55202	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:43.740061045 CET	55202	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:43.741101980 CET	55204	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:43.861165047 CET	25565	55202	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:43.862240076 CET	25565	55204	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:43.862407923 CET	55204	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:43.862477064 CET	55204	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:43.984321117 CET	25565	55204	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:46.318911076 CET	25565	55204	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:46.319137096 CET	55204	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:46.319962978 CET	55206	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:46.439336061 CET	25565	55204	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:46.439764977 CET	25565	55206	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:46.439841986 CET	55206	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:46.439933062 CET	55206	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:46.560075998 CET	25565	55206	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:48.645203114 CET	25565	55206	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:48.645479918 CET	55206	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:48.646413088 CET	55208	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:48.765294075 CET	25565	55206	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:48.766273975 CET	25565	55208	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:48.766423941 CET	55208	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:48.766557932 CET	55208	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:48.886207104 CET	25565	55208	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:50.973242044 CET	25565	55208	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:50.973480940 CET	55208	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:50.974224091 CET	55210	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:51.093466043 CET	25565	55208	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:51.093961000 CET	25565	55210	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:51.094082117 CET	55210	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:51.094240904 CET	55210	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:51.214205980 CET	25565	55210	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:53.349831104 CET	25565	55210	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:53.350044966 CET	55210	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:53.350733995 CET	55212	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:53.470952034 CET	25565	55210	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:53.471293926 CET	25565	55212	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:53.471502066 CET	55212	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:53.471502066 CET	55212	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:53.591386080 CET	25565	55212	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:55.724957943 CET	25565	55212	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:55.725204945 CET	55212	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:55.726006985 CET	55214	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:55.844927073 CET	25565	55212	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:55.845793009 CET	25565	55214	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:55.845911026 CET	55214	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:55.846003056 CET	55214	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:55.965698957 CET	25565	55214	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:58.051902056 CET	25565	55214	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:58.052192926 CET	55214	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:58.053077936 CET	55216	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:58.172147989 CET	25565	55214	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:58.172869921 CET	25565	55216	150.241.88.132	192.168.2.15
Dec 16, 2024 12:52:58.173015118 CET	55216	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:58.173196077 CET	55216	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:52:58.294125080 CET	25565	55216	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:00.379684925 CET	25565	55216	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:00.379944086 CET	55216	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:00.380963087 CET	55218	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:00.499918938 CET	25565	55216	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:00.500665903 CET	25565	55218	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:00.500771046 CET	55218	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:00.500925064 CET	55218	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:00.620609045 CET	25565	55218	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:02.708112955 CET	25565	55218	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:02.708450079 CET	55218	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:02.709167957 CET	55220	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:02.828366995 CET	25565	55218	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:02.829197884 CET	25565	55220	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:02.829293013 CET	55220	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:02.829442978 CET	55220	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:02.950902939 CET	25565	55220	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:05.081275940 CET	25565	55220	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:05.081613064 CET	55220	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:05.082195044 CET	55222	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:05.201586008 CET	25565	55220	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:05.202213049 CET	25565	55222	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:05.202415943 CET	55222	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:05.202445984 CET	55222	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:05.322314978 CET	25565	55222	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:07.411396027 CET	25565	55222	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:07.411988020 CET	55222	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:07.412795067 CET	55224	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:07.531864882 CET	25565	55222	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:07.532531977 CET	25565	55224	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:07.532882929 CET	55224	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:07.533092976 CET	55224	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:07.652879953 CET	25565	55224	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:09.739507914 CET	25565	55224	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:09.739769936 CET	55224	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:09.740715981 CET	55226	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:09.861500025 CET	25565	55224	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:09.862252951 CET	25565	55226	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:09.862325907 CET	55226	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:09.862420082 CET	55226	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:09.982172012 CET	25565	55226	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:12.067712069 CET	25565	55226	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:12.067996979 CET	55226	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:12.068715096 CET	55228	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:12.189899921 CET	25565	55226	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:12.189920902 CET	25565	55228	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:12.190167904 CET	55228	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:12.190269947 CET	55228	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:12.310743093 CET	25565	55228	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:14.395514011 CET	25565	55228	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:14.395864010 CET	55228	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:14.396410942 CET	55230	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:14.515590906 CET	25565	55228	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:14.516123056 CET	25565	55230	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:14.516345978 CET	55230	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:14.516346931 CET	55230	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:14.636099100 CET	25565	55230	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:16.727473021 CET	25565	55230	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:16.727853060 CET	55230	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:16.728457928 CET	55232	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:16.847708941 CET	25565	55230	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:16.848234892 CET	25565	55232	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:16.848460913 CET	55232	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:16.848460913 CET	55232	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:16.968154907 CET	25565	55232	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:19.052963018 CET	25565	55232	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:19.053283930 CET	55232	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:19.054148912 CET	55234	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:19.173223019 CET	25565	55232	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:19.174213886 CET	25565	55234	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:19.174416065 CET	55234	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:19.174571991 CET	55234	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:19.294271946 CET	25565	55234	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:21.428626060 CET	25565	55234	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:21.428909063 CET	55234	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:21.429893017 CET	55236	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:21.548692942 CET	25565	55234	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:21.549756050 CET	25565	55236	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:21.549876928 CET	55236	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:21.550064087 CET	55236	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:21.669836998 CET	25565	55236	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:23.758860111 CET	25565	55236	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:23.759226084 CET	55236	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:23.759320974 CET	55236	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:23.760071993 CET	55238	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:23.879133940 CET	25565	55236	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:23.879844904 CET	25565	55238	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:23.879950047 CET	55238	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:23.880237103 CET	55238	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:24.000056028 CET	25565	55238	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:26.083158970 CET	25565	55238	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:26.083451033 CET	55238	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:26.084470034 CET	55240	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:26.203195095 CET	25565	55238	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:26.204325914 CET	25565	55240	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:26.204500914 CET	55240	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:26.204629898 CET	55240	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:26.324433088 CET	25565	55240	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:28.411993027 CET	25565	55240	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:28.412534952 CET	55240	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:28.413527966 CET	55242	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:28.532330990 CET	25565	55240	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:28.533246994 CET	25565	55242	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:28.533416033 CET	55242	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:28.533540010 CET	55242	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:28.653228045 CET	25565	55242	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:30.764431953 CET	25565	55242	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:30.764710903 CET	55242	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:30.765691996 CET	55244	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:30.884449005 CET	25565	55242	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:30.885473967 CET	25565	55244	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:30.885776997 CET	55244	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:30.885922909 CET	55244	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:31.005805016 CET	25565	55244	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:33.083399057 CET	25565	55244	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:33.083797932 CET	55244	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:33.084551096 CET	55246	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:33.203759909 CET	25565	55244	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:33.204332113 CET	25565	55246	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:33.204471111 CET	55246	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:33.204758883 CET	55246	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:33.324479103 CET	25565	55246	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:35.411901951 CET	25565	55246	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:35.412364960 CET	55246	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:35.413137913 CET	55248	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:35.532957077 CET	25565	55246	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:35.533421040 CET	25565	55248	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:35.533521891 CET	55248	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:35.533597946 CET	55248	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:35.653434038 CET	25565	55248	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:37.739995956 CET	25565	55248	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:37.740161896 CET	55248	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:37.741059065 CET	55250	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:37.859910965 CET	25565	55248	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:37.860781908 CET	25565	55250	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:37.860891104 CET	55250	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:37.860955000 CET	55250	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:37.980766058 CET	25565	55250	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:40.116992950 CET	25565	55250	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:40.117276907 CET	55250	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:40.118273020 CET	55252	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:40.237109900 CET	25565	55250	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:40.238094091 CET	25565	55252	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:40.238215923 CET	55252	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:40.238351107 CET	55252	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:40.358261108 CET	25565	55252	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:42.507575989 CET	25565	55252	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:42.508121967 CET	55252	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:42.508914948 CET	55254	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:42.629538059 CET	25565	55252	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:42.629556894 CET	25565	55254	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:42.629756927 CET	55254	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:42.630031109 CET	55254	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:42.750232935 CET	25565	55254	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:44.834033012 CET	25565	55254	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:44.834269047 CET	55254	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:44.834955931 CET	55256	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:44.954236984 CET	25565	55254	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:44.954773903 CET	25565	55256	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:44.955117941 CET	55256	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:44.955241919 CET	55256	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:45.075231075 CET	25565	55256	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:47.177762985 CET	25565	55256	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:47.178210020 CET	55256	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:47.179060936 CET	55258	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:47.298197031 CET	25565	55256	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:47.298849106 CET	25565	55258	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:47.298988104 CET	55258	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:47.299103975 CET	55258	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:47.419100046 CET	25565	55258	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:49.509592056 CET	25565	55258	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:49.509900093 CET	55258	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:49.510606050 CET	55260	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:49.629839897 CET	25565	55258	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:49.630378962 CET	25565	55260	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:49.630635023 CET	55260	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:49.630635023 CET	55260	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:49.750555038 CET	25565	55260	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:51.837248087 CET	25565	55260	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:51.837491989 CET	55260	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:51.838049889 CET	55262	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:51.957376957 CET	25565	55260	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:51.957825899 CET	25565	55262	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:51.957946062 CET	55262	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:51.958167076 CET	55262	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:52.077991962 CET	25565	55262	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:54.210908890 CET	25565	55262	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:54.211100101 CET	55262	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:54.216460943 CET	55264	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:54.331012011 CET	25565	55262	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:54.336450100 CET	25565	55264	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:54.336532116 CET	55264	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:54.336632013 CET	55264	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:54.456546068 CET	25565	55264	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:56.585541010 CET	25565	55264	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:56.585719109 CET	55264	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:56.586266994 CET	55266	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:56.706041098 CET	25565	55264	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:56.706154108 CET	25565	55266	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:56.706234932 CET	55266	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:56.706370115 CET	55266	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:56.826260090 CET	25565	55266	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:58.961215973 CET	25565	55266	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:58.961810112 CET	55266	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:58.962443113 CET	55268	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:59.081878901 CET	25565	55266	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:59.082283974 CET	25565	55268	150.241.88.132	192.168.2.15
Dec 16, 2024 12:53:59.082412004 CET	55268	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:59.082490921 CET	55268	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:53:59.202208042 CET	25565	55268	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:01.287794113 CET	25565	55268	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:01.288110018 CET	55268	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:01.288702011 CET	55270	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:01.408091068 CET	25565	55268	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:01.408756018 CET	25565	55270	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:01.408849955 CET	55270	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:01.408920050 CET	55270	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:01.529062986 CET	25565	55270	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:03.679785013 CET	25565	55270	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:03.680156946 CET	55270	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:03.680764914 CET	55272	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:03.800029039 CET	25565	55270	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:03.800569057 CET	25565	55272	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:03.800704002 CET	55272	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:03.800877094 CET	55272	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:03.920617104 CET	25565	55272	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:06.006226063 CET	25565	55272	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:06.006577969 CET	55272	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:06.007524967 CET	55274	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:06.126394033 CET	25565	55272	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:06.127203941 CET	25565	55274	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:06.127304077 CET	55274	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:06.127432108 CET	55274	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:06.247416973 CET	25565	55274	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:08.334793091 CET	25565	55274	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:08.335306883 CET	55274	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:08.336263895 CET	55276	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:08.455096006 CET	25565	55274	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:08.456036091 CET	25565	55276	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:08.456202030 CET	55276	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:08.456397057 CET	55276	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:08.576423883 CET	25565	55276	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:10.662998915 CET	25565	55276	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:10.663362026 CET	55276	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:10.664239883 CET	55278	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:10.783154964 CET	25565	55276	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:10.783956051 CET	25565	55278	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:10.784084082 CET	55278	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:10.784225941 CET	55278	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:10.904062986 CET	25565	55278	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:12.995908022 CET	25565	55278	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:12.996085882 CET	55278	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:12.997003078 CET	55280	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:13.116782904 CET	25565	55278	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:13.117742062 CET	25565	55280	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:13.117918968 CET	55280	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:13.118032932 CET	55280	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:13.238898039 CET	25565	55280	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:15.318914890 CET	25565	55280	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:15.319155931 CET	55280	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:15.319679976 CET	55282	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:15.439169884 CET	25565	55280	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:15.439404964 CET	25565	55282	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:15.439490080 CET	55282	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:15.439600945 CET	55282	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:15.559446096 CET	25565	55282	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:17.650715113 CET	25565	55282	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:17.651078939 CET	55282	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:17.652050972 CET	55284	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:17.770962000 CET	25565	55282	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:17.771754026 CET	25565	55284	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:17.772010088 CET	55284	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:17.772186041 CET	55284	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:17.893256903 CET	25565	55284	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:19.975444078 CET	25565	55284	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:19.975703001 CET	55284	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:19.976540089 CET	55286	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:20.095760107 CET	25565	55284	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:20.096292019 CET	25565	55286	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:20.096431017 CET	55286	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:20.096622944 CET	55286	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:20.216650009 CET	25565	55286	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:22.351886988 CET	25565	55286	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:22.352315903 CET	55286	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:22.353713989 CET	55288	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:22.472084999 CET	25565	55286	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:22.473407984 CET	25565	55288	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:22.473752022 CET	55288	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:22.473902941 CET	55288	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:22.593642950 CET	25565	55288	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:24.681904078 CET	25565	55288	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:24.682279110 CET	55288	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:24.683224916 CET	55290	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:24.802267075 CET	25565	55288	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:24.802989960 CET	25565	55290	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:24.803195000 CET	55290	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:24.803389072 CET	55290	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:24.923113108 CET	25565	55290	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:27.009970903 CET	25565	55290	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:27.010354042 CET	55290	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:27.011341095 CET	55292	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:27.130369902 CET	25565	55290	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:27.131175995 CET	25565	55292	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:27.131408930 CET	55292	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:27.131474972 CET	55292	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:27.251357079 CET	25565	55292	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:29.338094950 CET	25565	55292	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:29.338406086 CET	55292	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:29.339023113 CET	55294	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:29.458173037 CET	25565	55292	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:29.458853006 CET	25565	55294	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:29.458919048 CET	55294	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:29.459012985 CET	55294	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:29.578716040 CET	25565	55294	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:31.666179895 CET	25565	55294	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:31.666500092 CET	55294	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:31.667342901 CET	55296	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:31.786214113 CET	25565	55294	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:31.787086964 CET	25565	55296	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:31.787216902 CET	55296	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:31.787385941 CET	55296	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:31.907140017 CET	25565	55296	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:33.991916895 CET	25565	55296	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:33.992182016 CET	55296	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:33.992897034 CET	55298	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:34.112107992 CET	25565	55296	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:34.112937927 CET	25565	55298	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:34.113086939 CET	55298	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:34.113154888 CET	55298	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:34.233371973 CET	25565	55298	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:36.385288954 CET	25565	55298	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:36.385595083 CET	55298	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:36.386446953 CET	55300	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:36.505399942 CET	25565	55298	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:36.506341934 CET	25565	55300	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:36.506644964 CET	55300	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:36.506644964 CET	55300	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:36.626897097 CET	25565	55300	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:38.805073977 CET	25565	55300	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:38.805577040 CET	55300	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:38.806211948 CET	55302	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:38.925529957 CET	25565	55300	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:38.926295996 CET	25565	55302	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:38.926476002 CET	55302	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:38.926531076 CET	55302	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:39.046681881 CET	25565	55302	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:41.132356882 CET	25565	55302	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:41.132777929 CET	55302	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:41.133424997 CET	55304	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:41.252630949 CET	25565	55302	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:41.253182888 CET	25565	55304	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:41.253432035 CET	55304	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:41.253520966 CET	55304	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:41.373354912 CET	25565	55304	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:43.463042021 CET	25565	55304	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:43.463414907 CET	55304	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:43.464219093 CET	55306	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:43.583162069 CET	25565	55304	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:43.583970070 CET	25565	55306	150.241.88.132	192.168.2.15
Dec 16, 2024 12:54:43.584064007 CET	55306	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:43.584170103 CET	55306	25565	192.168.2.15	150.241.88.132
Dec 16, 2024 12:54:43.703941107 CET	25565	55306	150.241.88.132	192.168.2.15

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 16, 2024 12:53:53.254950047 CET	34489	53	192.168.2.15	1.1.1.1
Dec 16, 2024 12:53:53.255012989 CET	48062	53	192.168.2.15	1.1.1.1
Dec 16, 2024 12:53:53.393052101 CET	53	34489	1.1.1.1	192.168.2.15
Dec 16, 2024 12:53:53.393779993 CET	53	48062	1.1.1.1	192.168.2.15

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 16, 2024 12:53:53.254950047 CET	192.168.2.15	1.1.1.1	0x316e	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 12:53:53.255012989 CET	192.168.2.15	1.1.1.1	0xbf4d	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 16, 2024 12:53:53.393052101 CET	1.1.1.1	192.168.2.15	0x316e	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false
Dec 16, 2024 12:53:53.393052101 CET	1.1.1.1	192.168.2.15	0x316e	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: armv6l.elf PID: 5532, Parent PID: 5451

General

Start time (UTC):	11:51:08
Start date (UTC):	16/12/2024
Path:	/tmp/armv6l.elf
Arguments:	/tmp/armv6l.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: armv6l.elf PID: 5534, Parent PID: 5532

General

Start time (UTC):	11:51:09
Start date (UTC):	16/12/2024
Path:	/tmp/armv6l.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: armv6l.elf PID: 5536, Parent PID: 5534

General

Start time (UTC):	11:51:09
Start date (UTC):	16/12/2024
Path:	/tmp/armv6l.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping or `net view` using Net .
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report armv6l.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Threatname: Gafgyt

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: armv6l.elf PID: 5532, Parent PID: 5451

General

Chronological Activities

Analysis Process: armv6l.elf PID: 5534, Parent PID: 5532

General

Chronological Activities

Analysis Process: armv6l.elf PID: 5536, Parent PID: 5534

General

Chronological Activities

Linux Analysis Report
armv6l.elf