Edit tour

Linux Analysis Report
m68k.elf

Overview

General Information

Sample name:	m68k.elf
Analysis ID:	1575970
MD5:	f6c5adaef44cb0d1bd1747c0ec770e8b
SHA1:	485a53e577f421ab60f6e18edbdca411bf705f38
SHA256:	3ac12f1a381879a34c3fc82b48598b8011605180e916c045e771aa1e796b8e51
Tags:	elfuser-abuse_ch
Infos:

Detection

Gafgyt, Mirai

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Gafgyt

Yara detected Mirai

Contains symbols with names commonly found in malware

Opens /proc/net/* files useful for finding connected devices and routers

Detected TCP or UDP traffic on non-standard ports

Sample contains strings that are user agent strings indicative of HTTP manipulation

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1575970
Start date and time:	2024-12-16 12:52:39 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	m68k.elf
Detection:	MAL
Classification:	mal100.spre.troj.linELF@0/1@2/0

Warnings

VT rate limit hit for: m68k.elf

Runtime Messages

Command:	/tmp/m68k.elf
PID:	5443
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

m68k.elf (PID: 5443, Parent: 5366, MD5: cd177594338c77b895ae27c33f8f86cc) Arguments: /tmp/m68k.elf

m68k.elf New Fork (PID: 5445, Parent: 5443)

m68k.elf New Fork (PID: 5447, Parent: 5445)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
m68k.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
m68k.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
m68k.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1063f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10653:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10667:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1067b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1068f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x106a3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x106b7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x106cb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x106df:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x106f3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10707:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1071b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1072f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10743:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10757:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1076b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1077f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10793:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x107a7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x107bb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x107cf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
5445.1.00007f94b4001000.00007f94b4014000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5445.1.00007f94b4001000.00007f94b4014000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1063f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10653:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10667:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1067b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1068f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x106a3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x106b7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x106cb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x106df:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x106f3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10707:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1071b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1072f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10743:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10757:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1076b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1077f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10793:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x107a7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x107bb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x107cf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5443.1.00007f94b4001000.00007f94b4014000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5443.1.00007f94b4001000.00007f94b4014000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1063f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10653:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10667:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1067b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1068f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x106a3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x106b7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x106cb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x106df:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x106f3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10707:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1071b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1072f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10743:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10757:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1076b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1077f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10793:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x107a7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x107bb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x107cf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: m68k.elf PID: 5443	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: m68k.elf PID: 5443	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x10da:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10ee:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1102:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1116:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x112a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x113e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1152:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1166:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x117a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11a2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11ca:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11de:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1206:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x121a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x122e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1242:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1256:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x126a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: m68k.elf PID: 5445	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: m68k.elf PID: 5445	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x4284:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4298:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x42ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x42c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x42d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x42e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x42fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4310:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4324:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4338:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x434c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4360:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4374:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4388:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x439c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x43b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x43c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x43d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x43ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4400:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4414:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 3 entries

Suricata Signatures

ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T12:53:27.656762+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53028	150.241.88.132	25565	TCP
2024-12-16T12:53:29.986696+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53030	150.241.88.132	25565	TCP
2024-12-16T12:53:32.360641+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53032	150.241.88.132	25565	TCP
2024-12-16T12:53:34.692861+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53034	150.241.88.132	25565	TCP
2024-12-16T12:53:37.017414+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53036	150.241.88.132	25565	TCP
2024-12-16T12:53:39.348979+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53038	150.241.88.132	25565	TCP
2024-12-16T12:53:41.674040+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53040	150.241.88.132	25565	TCP
2024-12-16T12:53:44.051906+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53042	150.241.88.132	25565	TCP
2024-12-16T12:53:46.395985+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53044	150.241.88.132	25565	TCP
2024-12-16T12:53:48.725347+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53046	150.241.88.132	25565	TCP
2024-12-16T12:53:51.049852+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53048	150.241.88.132	25565	TCP
2024-12-16T12:53:53.426525+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53050	150.241.88.132	25565	TCP
2024-12-16T12:53:55.802730+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53052	150.241.88.132	25565	TCP
2024-12-16T12:53:58.176454+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53054	150.241.88.132	25565	TCP
2024-12-16T12:54:00.502852+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53056	150.241.88.132	25565	TCP
2024-12-16T12:54:02.879389+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53058	150.241.88.132	25565	TCP
2024-12-16T12:54:05.209212+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53060	150.241.88.132	25565	TCP
2024-12-16T12:54:07.534093+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53062	150.241.88.132	25565	TCP
2024-12-16T12:54:09.862258+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53064	150.241.88.132	25565	TCP
2024-12-16T12:54:12.238505+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53066	150.241.88.132	25565	TCP
2024-12-16T12:54:14.565465+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53068	150.241.88.132	25565	TCP
2024-12-16T12:54:16.892770+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53070	150.241.88.132	25565	TCP
2024-12-16T12:54:19.220947+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53072	150.241.88.132	25565	TCP
2024-12-16T12:54:21.550022+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53074	150.241.88.132	25565	TCP
2024-12-16T12:54:23.926522+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53076	150.241.88.132	25565	TCP
2024-12-16T12:54:26.252746+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53078	150.241.88.132	25565	TCP
2024-12-16T12:54:28.583760+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53080	150.241.88.132	25565	TCP
2024-12-16T12:54:30.910268+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53082	150.241.88.132	25565	TCP
2024-12-16T12:54:33.237417+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53084	150.241.88.132	25565	TCP
2024-12-16T12:54:35.567011+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53086	150.241.88.132	25565	TCP
2024-12-16T12:54:37.943787+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53088	150.241.88.132	25565	TCP
2024-12-16T12:54:40.272278+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53090	150.241.88.132	25565	TCP
2024-12-16T12:54:42.597735+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53092	150.241.88.132	25565	TCP
2024-12-16T12:54:44.928790+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53094	150.241.88.132	25565	TCP
2024-12-16T12:54:47.254130+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53096	150.241.88.132	25565	TCP
2024-12-16T12:54:49.585051+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53098	150.241.88.132	25565	TCP
2024-12-16T12:54:51.957814+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53100	150.241.88.132	25565	TCP
2024-12-16T12:54:54.288957+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53102	150.241.88.132	25565	TCP
2024-12-16T12:54:56.615536+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53104	150.241.88.132	25565	TCP
2024-12-16T12:54:58.941307+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53106	150.241.88.132	25565	TCP
2024-12-16T12:55:01.317977+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53108	150.241.88.132	25565	TCP
2024-12-16T12:55:03.695229+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53110	150.241.88.132	25565	TCP
2024-12-16T12:55:06.019656+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53112	150.241.88.132	25565	TCP
2024-12-16T12:55:08.353685+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53114	150.241.88.132	25565	TCP
2024-12-16T12:55:10.676425+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53116	150.241.88.132	25565	TCP
2024-12-16T12:55:13.161969+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53118	150.241.88.132	25565	TCP
2024-12-16T12:55:15.489716+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53120	150.241.88.132	25565	TCP
2024-12-16T12:55:17.817947+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53122	150.241.88.132	25565	TCP
2024-12-16T12:55:20.149303+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53124	150.241.88.132	25565	TCP
2024-12-16T12:55:22.521439+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53126	150.241.88.132	25565	TCP
2024-12-16T12:55:24.859918+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53128	150.241.88.132	25565	TCP
2024-12-16T12:55:27.194284+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53130	150.241.88.132	25565	TCP
2024-12-16T12:55:29.519689+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53132	150.241.88.132	25565	TCP
2024-12-16T12:55:31.913987+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53134	150.241.88.132	25565	TCP
2024-12-16T12:55:34.242903+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53136	150.241.88.132	25565	TCP
2024-12-16T12:55:36.616309+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53138	150.241.88.132	25565	TCP
2024-12-16T12:55:38.941462+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53140	150.241.88.132	25565	TCP
2024-12-16T12:55:41.275642+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53142	150.241.88.132	25565	TCP
2024-12-16T12:55:43.598654+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53144	150.241.88.132	25565	TCP
2024-12-16T12:55:45.929790+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53146	150.241.88.132	25565	TCP
2024-12-16T12:55:48.256592+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53148	150.241.88.132	25565	TCP
2024-12-16T12:55:50.631596+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53150	150.241.88.132	25565	TCP
2024-12-16T12:55:52.958335+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53152	150.241.88.132	25565	TCP
2024-12-16T12:55:55.335135+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53154	150.241.88.132	25565	TCP
2024-12-16T12:55:57.661016+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53156	150.241.88.132	25565	TCP
2024-12-16T12:55:59.992786+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53158	150.241.88.132	25565	TCP
2024-12-16T12:56:02.379032+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53160	150.241.88.132	25565	TCP
2024-12-16T12:56:04.708838+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53162	150.241.88.132	25565	TCP
2024-12-16T12:56:07.085008+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53164	150.241.88.132	25565	TCP
2024-12-16T12:56:09.477982+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53166	150.241.88.132	25565	TCP
2024-12-16T12:56:11.806728+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53168	150.241.88.132	25565	TCP
2024-12-16T12:56:14.130534+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53170	150.241.88.132	25565	TCP
2024-12-16T12:56:16.506433+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53172	150.241.88.132	25565	TCP
2024-12-16T12:56:18.849598+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53174	150.241.88.132	25565	TCP
2024-12-16T12:56:21.177474+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53176	150.241.88.132	25565	TCP
2024-12-16T12:56:23.509245+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53178	150.241.88.132	25565	TCP
2024-12-16T12:56:25.859435+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53180	150.241.88.132	25565	TCP
2024-12-16T12:56:28.208603+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53182	150.241.88.132	25565	TCP
2024-12-16T12:56:30.537035+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53184	150.241.88.132	25565	TCP
2024-12-16T12:56:32.865030+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53186	150.241.88.132	25565	TCP
2024-12-16T12:56:35.192500+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53188	150.241.88.132	25565	TCP
2024-12-16T12:56:37.522982+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53190	150.241.88.132	25565	TCP
2024-12-16T12:56:39.861609+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53192	150.241.88.132	25565	TCP
2024-12-16T12:56:42.194320+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53194	150.241.88.132	25565	TCP
2024-12-16T12:56:44.521928+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53196	150.241.88.132	25565	TCP
2024-12-16T12:56:46.873376+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53198	150.241.88.132	25565	TCP
2024-12-16T12:56:49.213189+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53200	150.241.88.132	25565	TCP
2024-12-16T12:56:51.601710+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53202	150.241.88.132	25565	TCP
2024-12-16T12:56:53.927703+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53204	150.241.88.132	25565	TCP
2024-12-16T12:56:56.255657+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53206	150.241.88.132	25565	TCP
2024-12-16T12:56:58.584028+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53208	150.241.88.132	25565	TCP
2024-12-16T12:57:00.915436+0100	2846526	1	A Network Trojan was detected	192.168.2.13	53210	150.241.88.132	25565	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: m68k.elf

Avira: detected

Found malware configuration

Source: m68k.elf

Malware Configuration Extractor: Gafgyt {"C2 url": "150.241.88.132:25565"}

Multi AV Scanner detection for submitted file

Source: m68k.elf

ReversingLabs: Detection: 63%

Spreading

Opens /proc/net/* files useful for finding connected devices and routers

Source: /tmp/m68k.elf (PID: 5443)

Opens: /proc/net/route

Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53034 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53028 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53030 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53060 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53058 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53102 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53036 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53070 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53172 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53068 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53114 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53142 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53116 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53044 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53096 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53094 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53100 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53050 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53066 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53076 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53072 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53042 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53132 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53120 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53074 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53148 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53154 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53174 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53032 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53078 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53052 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53092 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53130 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53080 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53110 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53084 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53112 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53176 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53158 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53088 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53104 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53062 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53040 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53206 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53124 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53204 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53210 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53170 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53134 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53192 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53054 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53162 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53208 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53146 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53180 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53118 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53152 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53126 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53164 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53200 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53182 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53144 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53056 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53138 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53140 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53186 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53160 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53178 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53196 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53190 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53128 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53150 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53136 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53156 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53184 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53064 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53048 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53098 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53082 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53046 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53038 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53086 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53090 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53106 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53198 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53108 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53166 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53122 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53188 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53168 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53194 -> 150.241.88.132:25565
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:53202 -> 150.241.88.132:25565

Source: global traffic

TCP traffic: 192.168.2.13:53028 -> 150.241.88.132:25565

Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.88.132

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

System Summary

Malicious sample detected (through community Yara rule)

Source: m68k.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5445.1.00007f94b4001000.00007f94b4014000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5443.1.00007f94b4001000.00007f94b4014000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: m68k.elf PID: 5443, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: m68k.elf PID: 5445, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Contains symbols with names commonly found in malware

Source: ELF static info symbol of initial sample

Name: vseattack

Source: m68k.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5445.1.00007f94b4001000.00007f94b4014000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5443.1.00007f94b4001000.00007f94b4014000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: m68k.elf PID: 5443, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: m68k.elf PID: 5445, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.spre.troj.linELF@0/1@2/0

Source: m68k.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/m68k/crt1.S
Source: m68k.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/m68k/crti.S
Source: m68k.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/m68k/crtn.S

Source: /tmp/m68k.elf (PID: 5443)

Queries kernel information via 'uname':

Jump to behavior

Source: m68k.elf, 5443.1.00007fff920ae000.00007fff920cf000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.Qs3zpO
Source: m68k.elf, 5443.1.000055cb3abc8000.000055cb3ac2c000.rw-.sdmp, m68k.elf, 5445.1.000055cb3abc8000.000055cb3ac2c000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/m68k
Source: m68k.elf, 5443.1.00007fff920ae000.00007fff920cf000.rw-.sdmp, m68k.elf, 5445.1.00007fff920ae000.00007fff920cf000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-m68k
Source: m68k.elf, 5443.1.000055cb3abc8000.000055cb3ac2c000.rw-.sdmp, m68k.elf, 5445.1.000055cb3abc8000.000055cb3ac2c000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/m68k
Source: m68k.elf, 5443.1.00007fff920ae000.00007fff920cf000.rw-.sdmp	Binary or memory string: U/tmp/qemu-open.Qs3zpO\
Source: m68k.elf, 5443.1.00007fff920ae000.00007fff920cf000.rw-.sdmp, m68k.elf, 5445.1.00007fff920ae000.00007fff920cf000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-m68k/tmp/m68k.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/m68k.elf

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match

File source: m68k.elf, type: SAMPLE

Yara detected Mirai

Source: Yara match	File source: m68k.elf, type: SAMPLE
Source: Yara match	File source: 5445.1.00007f94b4001000.00007f94b4014000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5443.1.00007f94b4001000.00007f94b4014000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: m68k.elf PID: 5443, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: m68k.elf PID: 5445, type: MEMORYSTR

Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.71 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36

Remote Access Functionality

Yara detected Gafgyt

Source: Yara match

File source: m68k.elf, type: SAMPLE

Yara detected Mirai

Source: Yara match	File source: m68k.elf, type: SAMPLE
Source: Yara match	File source: 5445.1.00007f94b4001000.00007f94b4014000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5443.1.00007f94b4001000.00007f94b4014000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: m68k.elf PID: 5443, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: m68k.elf PID: 5445, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	1 Remote System Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

Threatname: Gafgyt

{"C2 url": "150.241.88.132:25565"}

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
m68k.elf	63%	ReversingLabs	Linux.Exploit.Mirai
m68k.elf	100%	Avira	EXP/ELF.Mirai.Z.A

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
150.241.88.132:25565	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.25	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
150.241.88.132:25565	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
150.241.88.132	unknown	Spain		207714	TECNALIAES	true

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
150.241.88.132	armv6l.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	mips.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	armv4l.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	i586.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	armv5l.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	armv7l.elf	Get hash	malicious	Gafgyt, Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	armv6l.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	mips.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	boatnet.spc.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	armv4l.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	i586.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	armv5l.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	main_arm6.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	arm7.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	i686.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	mips.elf	Get hash	malicious	Mirai	Browse	162.213.35.24

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TECNALIAES	armv6l.elf	Get hash	malicious	Gafgyt, Mirai	Browse	150.241.88.132
	mips.elf	Get hash	malicious	Gafgyt, Mirai	Browse	150.241.88.132
	armv4l.elf	Get hash	malicious	Gafgyt, Mirai	Browse	150.241.88.132
	i586.elf	Get hash	malicious	Gafgyt, Mirai	Browse	150.241.88.132
	armv5l.elf	Get hash	malicious	Gafgyt, Mirai	Browse	150.241.88.132
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	150.241.91.218
	file.exe	Get hash	malicious	SmokeLoader	Browse	150.241.91.218
	9RM52QaURq.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	150.241.95.163
	HZ1BUCfTne.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	150.241.95.163
	9RM52QaURq.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	150.241.95.163

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/tmp/qemu-open.Qs3zpO (deleted)

Download File

Process:	/tmp/m68k.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	230
Entropy (8bit):	3.709552666863289
Encrypted:	false
SSDEEP:	6:iekrEcvwAsE5KlwSd4pzKaV6Lpms/a/1VCxGF:ur+m5MwSdIKaV6L1adVRF
MD5:	2E667F43AE18CD1FE3C108641708A82C
SHA1:	12B90DE2DA0FBCFE66F3D6130905E56C8D6A68D3
SHA-256:	6F721492E7A337C5B498A8F55F5EB7AC745AFF716D0B5B08EFF2C1B6B250F983
SHA-512:	D2A0EE2509154EC1098994F38BE172F98F4150399C534A04D5C675D7C05630802225019F19344CC9070C576BC465A4FEB382AC7712DE6BF25E9244B54A9DB830
Malicious:	false
Reputation:	high, very likely benign file
Preview:	Iface.Destination.Gateway .Flags.RefCnt.Use.Metric.Mask..MTU.Window.IRTT .ens160.00000000.c0a80201.0003.0.0.0.00000000.0.0.0.ens160.c0a80200.00000000.0001.0.0.0.ffffff00.0.0.0.

Static File Info

General

File type:	ELF 32-bit MSB executable, Motorola m68k, 68020, version 1 (SYSV), statically linked, not stripped
Entropy (8bit):	6.093695563957966
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	m68k.elf
File size:	98'923 bytes
MD5:	f6c5adaef44cb0d1bd1747c0ec770e8b
SHA1:	485a53e577f421ab60f6e18edbdca411bf705f38
SHA256:	3ac12f1a381879a34c3fc82b48598b8011605180e916c045e771aa1e796b8e51
SHA512:	f6b1e242a9d209585a3fb532595eeaaa09a8ef765efb33397224875e9f35a0aa2032c8e893bfb5e06515467b77564f87d133bc8c3b753a403e01ab0d17ab9983
SSDEEP:	3072:BdKLGdUvuXwyKQlU8fzP6mumuxVqDr78fz1e:BdKLGdUfyKl8L6mumuxVqDr78fz1e
TLSH:	D9A30897F801DFB7F40AE67604D34B24B670BBE54F531622722739A6AE722D42823F45
File Content Preview:	.ELF.......................D...4..4x.....4. ...(......................%...%....... .......%...E...E.......g....... .dt.Q............................NV..a....da....dN^NuNV..J9..Itf>"y..E. QJ.g.X.#...E.N."y..E. QJ.f.A.....J.g.Hy..%.N.X.......ItN^NuNV..N^NuN

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	MC68000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x80000144
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	78968
Section Header Size:	40
Number of Section Headers:	15
Header String Table Index:	12

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80000094	0x94	0x14	0x0	0x6	AX	0	0	2
.text	PROGBITS	0x800000a8	0xa8	0xfe90	0x0	0x6	AX	0	0	4
.fini	PROGBITS	0x8000ff38	0xff38	0xe	0x0	0x6	AX	0	0	2
.rodata	PROGBITS	0x8000ff46	0xff46	0x267c	0x0	0x2	A	0	0	2
.eh_frame	PROGBITS	0x800125c4	0x125c4	0x4	0x0	0x2	A	0	0	4
.ctors	PROGBITS	0x800145c8	0x125c8	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x800145d0	0x125d0	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x800145d8	0x125d8	0x4	0x0	0x3	WA	0	0	4
.data	PROGBITS	0x800145dc	0x125dc	0x398	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x80014974	0x12974	0x635c	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x12974	0xa9e	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x13412	0x66	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x136d0	0x2ad0	0x10	0x0		14	266	4
.strtab	STRTAB	0x0	0x161a0	0x20cb	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x80000000	0x80000000	0x125c8	0x125c8	6.1063	0x5	R E	0x2000	.init .text .fini .rodata .eh_frame
LOAD	0x125c8	0x800145c8	0x800145c8	0x3ac	0x6708	2.8690	0x6	RW	0x2000	.ctors .dtors .jcr .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x80000094	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x800000a8	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x8000ff38	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x8000ff46	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x800125c4	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x800145c8	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x800145d0	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x800145d8	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x800145dc	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x80014974	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	14
Q	.symtab	0x800149a6	16384	OBJECT	<unknown>	DEFAULT	10
Sakura_Bot.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
SendSTD	.symtab	0x8000230e	266	FUNC	<unknown>	DEFAULT	2
SendSTDHEX	.symtab	0x80001b98	282	FUNC	<unknown>	DEFAULT	2
SendSTD_HEX	.symtab	0x8000252a	316	FUNC	<unknown>	DEFAULT	2
SendUDP	.symtab	0x800013b0	840	FUNC	<unknown>	DEFAULT	2
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x800145cc	0	OBJECT	<unknown>	DEFAULT	6
__CTOR_LIST__	.symtab	0x800145c8	0	OBJECT	<unknown>	DEFAULT	6
__C_ctype_b	.symtab	0x80014614	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x80010f1e	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x8001496c	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x800115f4	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x8001461c	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x8001121e	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x800145d4	0	OBJECT	<unknown>	DEFAULT	7
__DTOR_LIST__	.symtab	0x800145d0	0	OBJECT	<unknown>	DEFAULT	7
__EH_FRAME_BEGIN__	.symtab	0x800125c4	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x800125c4	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x80014614	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_b_data	.symtab	0x80010f1e	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_tolower	.symtab	0x8001496c	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_tolower_data	.symtab	0x800115f4	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_toupper	.symtab	0x8001461c	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_toupper_data	.symtab	0x8001121e	768	OBJECT	<unknown>	HIDDEN	4
__GI___ctype_b	.symtab	0x80014618	4	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_tolower	.symtab	0x80014970	4	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_toupper	.symtab	0x80014620	4	OBJECT	<unknown>	HIDDEN	9
__GI___errno_location	.symtab	0x800054d0	16	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x8000dd50	500	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x8000e1c4	36	FUNC	<unknown>	HIDDEN	2
__GI___h_errno_location	.symtab	0x800080b0	16	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x80004e3c	188	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl64	.symtab	0x80004f50	54	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x80005252	80	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x800079f0	106	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x80007b0c	74	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x8000e1e8	264	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x80004fc0	16	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x80009e28	390	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x80007440	28	FUNC	<unknown>	HIDDEN	2
__GI_atol	.symtab	0x80007440	28	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x80009fdc	64	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0x80005056	16	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x80005068	60	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x8000619c	48	FUNC	<unknown>	HIDDEN	2
__GI_errno	.symtab	0x80018bd0	4	OBJECT	<unknown>	HIDDEN	10
__GI_exit	.symtab	0x800076b4	124	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x8000a0d4	416	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x80004e3c	188	FUNC	<unknown>	HIDDEN	2
__GI_fcntl64	.symtab	0x80004f50	54	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x8000aa0e	510	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x8000dd50	500	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x8000a850	134	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x8000ac0c	226	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x8000a274	38	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x800050a4	56	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x8000df44	80	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x8000fae8	40	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x8000fb10	346	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x8000df94	162	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x8000dd50	500	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x80007dec	60	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x80007e28	60	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x80007e64	60	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname	.symtab	0x80005cd4	60	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x80005d10	1164	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x800050dc	56	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x800061cc	50	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x80007ea0	60	FUNC	<unknown>	HIDDEN	2
__GI_h_errno	.symtab	0x80018bd4	4	OBJECT	<unknown>	HIDDEN	10
__GI_inet_addr	.symtab	0x80005ca4	48	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x80008fa8	362	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa	.symtab	0x80005c84	30	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa_r	.symtab	0x80005be4	160	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x8000b966	112	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x8000b474	96	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x800072f6	330	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x80005114	130	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x8000aff4	52	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x800051e0	20	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x8000fe96	108	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x8000f824	348	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x800086a2	240	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x80008c54	288	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x8000e038	42	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x8000f980	358	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x800054e0	310	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x80007edc	78	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x80005252	80	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x8000a07c	88	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x8000c4f8	28	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x80006d10	94	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x80007046	266	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x8000acf0	274	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x800052c0	84	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x80006244	56	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x80007f2c	106	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x80005314	100	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x8000627c	56	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x800062b4	70	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x80005378	56	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x800062fc	64	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x80006eb0	406	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x80009d40	232	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x80006370	238	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x80007f98	160	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x80007730	558	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x8000633c	50	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x8000c554	52	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x80007150	422	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x8000e2f0	120	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x80005618	390	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x800057a0	110	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x800057a0	110	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x80005810	92	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x8000afa4	80	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x8000586c	268	FUNC	<unknown>	HIDDEN	2
__GI_strncat	.symtab	0x8000ae04	310	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x80008d74	320	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x8000e064	350	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x80008f50	86	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x8000af3c	104	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x80005978	484	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x80005b7c	36	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x80008eb4	154	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x8000745c	34	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x8000b028	182	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x800053b0	62	FUNC	<unknown>	HIDDEN	2
__GI_tolower	.symtab	0x8000c514	64	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x80005490	64	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x8000c588	198	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x80008092	30	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x800053f0	34	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x8000e63c	100	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x8000e6c8	206	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x8000e6a0	38	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x80005414	84	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x800145d8	0	OBJECT	<unknown>	DEFAULT	8
__JCR_LIST__	.symtab	0x800145d8	0	OBJECT	<unknown>	DEFAULT	8
__app_fini	.symtab	0x80018bc4	4	OBJECT	<unknown>	HIDDEN	10
__atexit_lock	.symtab	0x800147e0	24	OBJECT	<unknown>	DEFAULT	9
__bsd_signal	.symtab	0x80006370	238	FUNC	<unknown>	HIDDEN	2
__bss_start	.symtab	0x80014974	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x80007ac8	68	FUNC	<unknown>	DEFAULT	2
__check_suid	.symtab	0x80007a6c	92	FUNC	<unknown>	DEFAULT	2
__ctype_b	.symtab	0x80014618	4	OBJECT	<unknown>	DEFAULT	9
__ctype_tolower	.symtab	0x80014970	4	OBJECT	<unknown>	DEFAULT	9
__ctype_toupper	.symtab	0x80014620	4	OBJECT	<unknown>	DEFAULT	9
__curbrk	.symtab	0x80018bf8	4	OBJECT	<unknown>	DEFAULT	10
__data_start	.symtab	0x800145e4	0	NOTYPE	<unknown>	DEFAULT	9
__decode_answer	.symtab	0x8000bea8	460	FUNC	<unknown>	HIDDEN	2
__decode_dotted	.symtab	0x8000e474	340	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x8000bbc8	480	FUNC	<unknown>	HIDDEN	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__dns_lookup	.symtab	0x80009114	2224	FUNC	<unknown>	HIDDEN	2
__do_global_ctors_aux	.symtab	0x8000ff04	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x800000a8	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x800145dc	0	OBJECT	<unknown>	HIDDEN	9
__encode_dotted	.symtab	0x8000e368	268	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x8000b9d8	494	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x8000bda8	198	FUNC	<unknown>	HIDDEN	2
__environ	.symtab	0x80018bbc	4	OBJECT	<unknown>	DEFAULT	10
__errno_location	.symtab	0x800054d0	16	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x80018bb4	4	OBJECT	<unknown>	HIDDEN	10
__fgetc_unlocked	.symtab	0x8000dd50	500	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x800145c8	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fini_array_start	.symtab	0x800145c8	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__free_to_heap	.symtab	0x80006810	342	FUNC	<unknown>	DEFAULT	2
__get_hosts_byname_r	.symtab	0x80009d0c	50	FUNC	<unknown>	HIDDEN	2
__glibc_strerror_r	.symtab	0x8000e1c4	36	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__h_errno_location	.symtab	0x800080b0	16	FUNC	<unknown>	DEFAULT	2
__h_errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__heap_add_free_area	.symtab	0x80006b2a	66	FUNC	<unknown>	DEFAULT	2
__heap_alloc	.symtab	0x80006a22	150	FUNC	<unknown>	DEFAULT	2
__heap_delete	.symtab	0x800067b8	88	FUNC	<unknown>	DEFAULT	2
__heap_delete	.symtab	0x80006988	88	FUNC	<unknown>	DEFAULT	2
__heap_free	.symtab	0x80006b6c	404	FUNC	<unknown>	DEFAULT	2
__heap_free_area_alloc	.symtab	0x800069e0	66	FUNC	<unknown>	DEFAULT	2
__heap_link_free_area	.symtab	0x80006ab8	70	FUNC	<unknown>	DEFAULT	2
__heap_link_free_area_after	.symtab	0x80006afe	44	FUNC	<unknown>	DEFAULT	2
__init_array_end	.symtab	0x800145c8	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__init_array_start	.symtab	0x800145c8	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__length_dotted	.symtab	0x8000e5c8	114	FUNC	<unknown>	HIDDEN	2
__length_question	.symtab	0x8000be70	56	FUNC	<unknown>	HIDDEN	2
__libc_close	.symtab	0x80005068	60	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x8000619c	48	FUNC	<unknown>	DEFAULT	2
__libc_creat	.symtab	0x800052a2	30	FUNC	<unknown>	DEFAULT	2
__libc_fcntl	.symtab	0x80004e3c	188	FUNC	<unknown>	DEFAULT	2
__libc_fcntl64	.symtab	0x80004f50	54	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x800050a4	56	FUNC	<unknown>	DEFAULT	2
__libc_getpid	.symtab	0x800050dc	56	FUNC	<unknown>	DEFAULT	2
__libc_lseek64	.symtab	0x8000fe96	108	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0x80007edc	78	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x80005252	80	FUNC	<unknown>	DEFAULT	2
__libc_poll	.symtab	0x8000a07c	88	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x800052c0	84	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x80006244	56	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x80005314	100	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x8000627c	56	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x800062b4	70	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x80009d40	232	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x80018bb8	4	OBJECT	<unknown>	DEFAULT	10
__libc_waitpid	.symtab	0x800053f0	34	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x80005414	84	FUNC	<unknown>	DEFAULT	2
__malloc_from_heap	.symtab	0x8000653c	466	FUNC	<unknown>	DEFAULT	2
__malloc_heap	.symtab	0x80014624	4	OBJECT	<unknown>	DEFAULT	9
__malloc_heap_lock	.symtab	0x80018b9c	24	OBJECT	<unknown>	DEFAULT	10
__malloc_sbrk_lock	.symtab	0x8001ac8c	24	OBJECT	<unknown>	DEFAULT	10
__nameserver	.symtab	0x8001acb4	12	OBJECT	<unknown>	HIDDEN	10
__nameservers	.symtab	0x8001acc0	4	OBJECT	<unknown>	HIDDEN	10
__open_etc_hosts	.symtab	0x8000c074	72	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x800099c4	840	FUNC	<unknown>	HIDDEN	2
__pagesize	.symtab	0x80018bc0	4	OBJECT	<unknown>	DEFAULT	10
__preinit_array_end	.symtab	0x800145c8	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__preinit_array_start	.symtab	0x800145c8	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__pthread_initialize_minimal	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0x80007a5a	10	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x80007a5a	10	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x80007a5a	10	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x80007a5a	10	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x80007a5a	10	FUNC	<unknown>	DEFAULT	2
__pthread_return_void	.symtab	0x80007a64	8	FUNC	<unknown>	DEFAULT	2
__raise	.symtab	0x8000c4f8	28	FUNC	<unknown>	HIDDEN	2
__read_etc_hosts_r	.symtab	0x8000c0bc	1084	FUNC	<unknown>	HIDDEN	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__resolv_lock	.symtab	0x80014800	24	OBJECT	<unknown>	DEFAULT	9
__rtld_fini	.symtab	0x80018bc8	4	OBJECT	<unknown>	HIDDEN	10
__searchdomain	.symtab	0x8001aca4	16	OBJECT	<unknown>	HIDDEN	10
__searchdomains	.symtab	0x8001acc4	4	OBJECT	<unknown>	HIDDEN	10
__sigaddset	.symtab	0x800064b0	68	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x800064f4	72	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x80006460	80	FUNC	<unknown>	DEFAULT	2
__socketcall	.symtab	0x80007da0	74	FUNC	<unknown>	HIDDEN	2
__socketcall.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__stdin	.symtab	0x8001483c	4	OBJECT	<unknown>	DEFAULT	9
__stdio_READ	.symtab	0x8000e798	138	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x8000c650	314	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x8000fc6c	352	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x8000e824	518	FUNC	<unknown>	HIDDEN	2
__stdio_init_mutex	.symtab	0x8000a6c4	32	FUNC	<unknown>	HIDDEN	2
__stdio_mutex_initializer.3828	.symtab	0x80011598	24	OBJECT	<unknown>	DEFAULT	4
__stdio_rfill	.symtab	0x8000ea2c	90	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x8000fdcc	102	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x8000ea88	226	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x8000eb6c	414	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x8000a7dc	116	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x80014840	4	OBJECT	<unknown>	DEFAULT	9
__syscall_chdir	.symtab	0x80005018	62	FUNC	<unknown>	DEFAULT	2
__syscall_exit	.symtab	0x80004f88	56	FUNC	<unknown>	DEFAULT	2
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl64	.symtab	0x80004ef8	88	FUNC	<unknown>	DEFAULT	2
__syscall_fcntl64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_kill	.symtab	0x80005198	72	FUNC	<unknown>	DEFAULT	2
__syscall_llseek	.symtab	0x8000fe34	98	FUNC	<unknown>	DEFAULT	2
__syscall_open	.symtab	0x800051f4	94	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction	.symtab	0x8000a01c	94	FUNC	<unknown>	HIDDEN	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_wait4	.symtab	0x80008038	90	FUNC	<unknown>	DEFAULT	2
__uClibc_fini	.symtab	0x800079f0	106	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x80007b0c	74	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x80007b56	584	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x800147f8	4	OBJECT	<unknown>	HIDDEN	9
__xpg_strerror_r	.symtab	0x8000e1e8	264	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_charpad	.symtab	0x8000c78c	74	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_dl_aux_init	.symtab	0x80009fb0	44	FUNC	<unknown>	DEFAULT	2
_dl_phdr	.symtab	0x8001acc8	4	OBJECT	<unknown>	DEFAULT	10
_dl_phnum	.symtab	0x8001accc	4	OBJECT	<unknown>	DEFAULT	10
_do_one_spec	.symtab	0x8000c87e	2118	FUNC	<unknown>	DEFAULT	2
_edata	.symtab	0x80014974	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x8001acd0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_errno	.symtab	0x80018bd0	4	OBJECT	<unknown>	DEFAULT	10
_exit	.symtab	0x80004fc0	16	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x8000ff38	0	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x80018c04	8192	OBJECT	<unknown>	DEFAULT	10
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x8000c7d6	168	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x8000ee5c	2502	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_h_errno	.symtab	0x80018bd4	4	OBJECT	<unknown>	DEFAULT	10
_init	.symtab	0x80000094	0	FUNC	<unknown>	DEFAULT	1
_is_equal_or_bigger_arg	.symtab	0x8000d6b8	102	FUNC	<unknown>	DEFAULT	2
_load_inttype	.symtab	0x8000ed0c	238	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_init	.symtab	0x8000d258	208	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x8000d71e	1584	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x8000d328	108	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x8000d394	718	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x8000d664	84	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x80007a64	8	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x80007a64	8	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_sigintr	.symtab	0x8001ac0c	128	OBJECT	<unknown>	HIDDEN	10
_start	.symtab	0x80000144	0	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x8000a29c	960	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x8000a65c	104	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x80014844	4	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_add_lock	.symtab	0x80014848	24	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_dec_use	.symtab	0x8000a8d8	310	FUNC	<unknown>	DEFAULT	2
_stdio_openlist_del_count	.symtab	0x80018c00	4	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_del_lock	.symtab	0x80014860	24	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_use_count	.symtab	0x80018bfc	4	OBJECT	<unknown>	DEFAULT	10
_stdio_streams	.symtab	0x8001487c	240	OBJECT	<unknown>	DEFAULT	9
_stdio_term	.symtab	0x8000a6e4	248	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x80014878	4	OBJECT	<unknown>	DEFAULT	9
_stdlib_strto_l	.symtab	0x80007480	562	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x8000edfc	96	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x800119a0	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x800080c0	438	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x8000d0c4	404	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wordcopy_bwd_aligned	.symtab	0x80008794	638	FUNC	<unknown>	DEFAULT	2
_wordcopy_bwd_dest_aligned	.symtab	0x80008a12	578	FUNC	<unknown>	DEFAULT	2
_wordcopy_fwd_aligned	.symtab	0x80008278	566	FUNC	<unknown>	DEFAULT	2
_wordcopy_fwd_dest_aligned	.symtab	0x800084ae	500	FUNC	<unknown>	DEFAULT	2
abort	.symtab	0x80009e28	390	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
access	.symtab	0x80004fd0	72	FUNC	<unknown>	DEFAULT	2
access.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
astd	.symtab	0x800032c2	276	FUNC	<unknown>	DEFAULT	2
atcp	.symtab	0x80002e22	1184	FUNC	<unknown>	DEFAULT	2
atoi	.symtab	0x80007440	28	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x80007440	28	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
audp	.symtab	0x800029dc	1094	FUNC	<unknown>	DEFAULT	2
bcopy	.symtab	0x80005b5c	30	FUNC	<unknown>	DEFAULT	2
bcopy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
been_there_done_that	.symtab	0x80018bf4	4	OBJECT	<unknown>	DEFAULT	10
been_there_done_that.2790	.symtab	0x80018bcc	4	OBJECT	<unknown>	DEFAULT	10
brk	.symtab	0x80009fdc	64	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x80006370	238	FUNC	<unknown>	DEFAULT	2
buf.2603	.symtab	0x800189ac	16	OBJECT	<unknown>	DEFAULT	10
buf.4831	.symtab	0x800189bc	460	OBJECT	<unknown>	DEFAULT	10
c	.symtab	0x8001460c	4	OBJECT	<unknown>	DEFAULT	9
call___do_global_ctors_aux	.symtab	0x8000ff2e	0	FUNC	<unknown>	DEFAULT	2
call___do_global_dtors_aux	.symtab	0x800000f6	0	FUNC	<unknown>	DEFAULT	2
call_frame_dummy	.symtab	0x8000013c	0	FUNC	<unknown>	DEFAULT	2
chdir	.symtab	0x80005056	16	FUNC	<unknown>	DEFAULT	2
chdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x80005068	60	FUNC	<unknown>	DEFAULT	2
close.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
commServer	.symtab	0x800145e8	4	OBJECT	<unknown>	DEFAULT	9
completed.2170	.symtab	0x80014974	1	OBJECT	<unknown>	DEFAULT	10
connect	.symtab	0x8000619c	48	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connectTimeout	.symtab	0x80000ea8	462	FUNC	<unknown>	DEFAULT	2
creat	.symtab	0x800052a2	30	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
csum	.symtab	0x80001182	228	FUNC	<unknown>	DEFAULT	2
currentServer	.symtab	0x80014608	4	OBJECT	<unknown>	DEFAULT	9
data_start	.symtab	0x800145e4	0	NOTYPE	<unknown>	DEFAULT	9
decodea.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dnslookup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ	.symtab	0x80018bbc	4	OBJECT	<unknown>	DEFAULT	10
errno	.symtab	0x80018bd0	4	OBJECT	<unknown>	DEFAULT	10
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x800076b4	124	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x80012556	108	OBJECT	<unknown>	DEFAULT	4
fclose	.symtab	0x8000a0d4	416	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x80004e3c	188	FUNC	<unknown>	DEFAULT	2
fcntl64	.symtab	0x80004f50	54	FUNC	<unknown>	DEFAULT	2
fdgets	.symtab	0x8000034c	118	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x8000aa0e	510	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x8000dd50	500	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x8000a850	134	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x8000ac0c	226	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fmt	.symtab	0x80012542	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x8000a274	38	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0x800050a4	56	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs_unlocked	.symtab	0x8000df44	80	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x800000fe	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x80006966	32	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x8000fae8	40	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x8000fae8	40	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x8000fb10	346	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ftcp	.symtab	0x800016f8	1184	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked	.symtab	0x8000df94	162	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getArch	.symtab	0x800033d6	16	FUNC	<unknown>	DEFAULT	2
getHost	.symtab	0x80000c24	56	FUNC	<unknown>	DEFAULT	2
getOurIP	.symtab	0x800003c2	516	FUNC	<unknown>	DEFAULT	2
getPortz	.symtab	0x800033e6	150	FUNC	<unknown>	DEFAULT	2
getRandomIP	.symtab	0x80000314	56	FUNC	<unknown>	DEFAULT	2
get_hosts_byname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getc_unlocked	.symtab	0x8000dd50	500	FUNC	<unknown>	DEFAULT	2
getegid	.symtab	0x80007dec	60	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x80007e28	60	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x80007e64	60	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname	.symtab	0x80005cd4	60	FUNC	<unknown>	DEFAULT	2
gethostbyname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r	.symtab	0x80005d10	1164	FUNC	<unknown>	DEFAULT	2
gethostbyname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x800050dc	56	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockname	.symtab	0x800061cc	50	FUNC	<unknown>	DEFAULT	2
getsockname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x80006200	66	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x80007ea0	60	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gotIP	.symtab	0x80014994	4	OBJECT	<unknown>	DEFAULT	10
h.4830	.symtab	0x80018b88	20	OBJECT	<unknown>	DEFAULT	10
h_errno	.symtab	0x80018bd4	4	OBJECT	<unknown>	DEFAULT	10
have_current_got	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
have_current_got	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
have_current_got	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
heap_alloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
heap_free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
htonl	.symtab	0x80005bc2	12	FUNC	<unknown>	DEFAULT	2
htons	.symtab	0x80005bce	22	FUNC	<unknown>	DEFAULT	2
i.4118	.symtab	0x80014610	4	OBJECT	<unknown>	DEFAULT	9
index	.symtab	0x80005618	390	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x80005ca4	48	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x80008fa8	362	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa	.symtab	0x80005c84	30	FUNC	<unknown>	DEFAULT	2
inet_ntoa.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa_r	.symtab	0x80005be4	160	FUNC	<unknown>	DEFAULT	2
inet_ntop	.symtab	0x8000b966	112	FUNC	<unknown>	DEFAULT	2
inet_ntop4	.symtab	0x8000b4d4	464	FUNC	<unknown>	DEFAULT	2
inet_ntop6	.symtab	0x8000b6a4	706	FUNC	<unknown>	DEFAULT	2
inet_pton	.symtab	0x8000b474	96	FUNC	<unknown>	DEFAULT	2
inet_pton4	.symtab	0x8000b0e0	282	FUNC	<unknown>	DEFAULT	2
inet_pton6	.symtab	0x8000b1fa	634	FUNC	<unknown>	DEFAULT	2
initConnection	.symtab	0x800047cc	328	FUNC	<unknown>	DEFAULT	2
init_rand	.symtab	0x8000016c	144	FUNC	<unknown>	DEFAULT	2
initial_fa	.symtab	0x80014628	260	OBJECT	<unknown>	DEFAULT	9
initstate	.symtab	0x80006de2	118	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x800072f6	330	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x80005114	130	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isatty	.symtab	0x8000aff4	52	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isspace	.symtab	0x80005468	40	FUNC	<unknown>	DEFAULT	2
isspace.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0x800051e0	20	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lengthd.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lengthq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/m68k/crt1.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/m68k/crti.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/m68k/crtn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
listFork	.symtab	0x80001076	268	FUNC	<unknown>	DEFAULT	2
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x8000fe96	108	FUNC	<unknown>	DEFAULT	2
macAddress	.symtab	0x800149a0	6	OBJECT	<unknown>	DEFAULT	10
main	.symtab	0x80004914	1318	FUNC	<unknown>	DEFAULT	2
mainCommSock	.symtab	0x80014990	4	OBJECT	<unknown>	DEFAULT	10
makeIPPacket	.symtab	0x8000132c	132	FUNC	<unknown>	DEFAULT	2
makeRandomStr	.symtab	0x80000c5c	118	FUNC	<unknown>	DEFAULT	2
makevsepacket	.symtab	0x80001da2	148	FUNC	<unknown>	DEFAULT	2
malloc	.symtab	0x8000670e	168	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memchr	.symtab	0x8000f824	348	FUNC	<unknown>	DEFAULT	2
memchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memcpy	.symtab	0x800086a2	240	FUNC	<unknown>	DEFAULT	2
memcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memmove	.symtab	0x80008c54	288	FUNC	<unknown>	DEFAULT	2
memmove.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mempcpy	.symtab	0x8000e038	42	FUNC	<unknown>	DEFAULT	2
mempcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memrchr	.symtab	0x8000f980	358	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x800054e0	310	FUNC	<unknown>	DEFAULT	2
memset.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mylock	.symtab	0x8001472c	24	OBJECT	<unknown>	DEFAULT	9
mylock	.symtab	0x80018bd8	24	OBJECT	<unknown>	DEFAULT	10
mylock	.symtab	0x80014818	24	OBJECT	<unknown>	DEFAULT	9
nanosleep	.symtab	0x80007edc	78	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
next_start.1067	.symtab	0x800189a8	4	OBJECT	<unknown>	DEFAULT	10
ntohl	.symtab	0x80005ba0	12	FUNC	<unknown>	DEFAULT	2
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0x80005bac	22	FUNC	<unknown>	DEFAULT	2
ntop.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
numpids	.symtab	0x80014998	8	OBJECT	<unknown>	DEFAULT	10
object.2251	.symtab	0x80014976	24	OBJECT	<unknown>	DEFAULT	10
open	.symtab	0x80005252	80	FUNC	<unknown>	DEFAULT	2
open.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opennameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ourIP	.symtab	0x8001ac04	4	OBJECT	<unknown>	DEFAULT	10
p.2168	.symtab	0x800145e0	0	OBJECT	<unknown>	DEFAULT	9
pids	.symtab	0x8001ac08	4	OBJECT	<unknown>	DEFAULT	10
poll	.symtab	0x8000a07c	88	FUNC	<unknown>	DEFAULT	2
poll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prefix.4042	.symtab	0x80011901	12	OBJECT	<unknown>	DEFAULT	4
print	.symtab	0x800008c6	688	FUNC	<unknown>	DEFAULT	2
printchar	.symtab	0x80000674	68	FUNC	<unknown>	DEFAULT	2
printi	.symtab	0x8000078e	312	FUNC	<unknown>	DEFAULT	2
prints	.symtab	0x800006b8	214	FUNC	<unknown>	DEFAULT	2
processCmd	.symtab	0x8000347c	4944	FUNC	<unknown>	DEFAULT	2
qual_chars.4045	.symtab	0x80011914	20	OBJECT	<unknown>	DEFAULT	4
raise	.symtab	0x8000c4f8	28	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x80006d00	14	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand_cmwc	.symtab	0x800001fc	280	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x80006d10	94	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x8001151e	40	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x80007046	266	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randtbl	.symtab	0x80014760	128	OBJECT	<unknown>	DEFAULT	9
rawmemchr	.symtab	0x8000acf0	274	FUNC	<unknown>	DEFAULT	2
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read	.symtab	0x800052c0	84	FUNC	<unknown>	DEFAULT	2
read.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read_etc_hosts_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recv	.symtab	0x80006244	56	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recvLine	.symtab	0x80000cd2	470	FUNC	<unknown>	DEFAULT	2
rtcp	.symtab	0x80002666	886	FUNC	<unknown>	DEFAULT	2
sbrk	.symtab	0x80007f2c	106	FUNC	<unknown>	DEFAULT	2
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
select	.symtab	0x80005314	100	FUNC	<unknown>	DEFAULT	2
select.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send	.symtab	0x8000627c	56	FUNC	<unknown>	DEFAULT	2
send.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sendto	.symtab	0x800062b4	70	FUNC	<unknown>	DEFAULT	2
sendto.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsid	.symtab	0x80005378	56	FUNC	<unknown>	DEFAULT	2
setsid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsockopt	.symtab	0x800062fc	64	FUNC	<unknown>	DEFAULT	2
setsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate	.symtab	0x80006d6e	116	FUNC	<unknown>	DEFAULT	2
setstate_r	.symtab	0x80006eb0	406	FUNC	<unknown>	DEFAULT	2
sigaction	.symtab	0x80009d40	232	FUNC	<unknown>	DEFAULT	2
sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
signal	.symtab	0x80006370	238	FUNC	<unknown>	DEFAULT	2
signal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigprocmask	.symtab	0x80007f98	160	FUNC	<unknown>	DEFAULT	2
sigprocmask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigsetops.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sleep	.symtab	0x80007730	558	FUNC	<unknown>	DEFAULT	2
sleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket	.symtab	0x8000633c	50	FUNC	<unknown>	DEFAULT	2
socket.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket_connect	.symtab	0x80001cb2	240	FUNC	<unknown>	DEFAULT	2
sockprintf	.symtab	0x80000b76	174	FUNC	<unknown>	DEFAULT	2
spec_and_mask.4044	.symtab	0x80011928	16	OBJECT	<unknown>	DEFAULT	4
spec_base.4041	.symtab	0x8001190d	7	OBJECT	<unknown>	DEFAULT	4
spec_chars.4041	.symtab	0x80011951	21	OBJECT	<unknown>	DEFAULT	4
spec_flags.4040	.symtab	0x80011966	8	OBJECT	<unknown>	DEFAULT	4
spec_or_mask.4043	.symtab	0x80011938	16	OBJECT	<unknown>	DEFAULT	4
spec_ranges.4042	.symtab	0x80011948	9	OBJECT	<unknown>	DEFAULT	4
sprintf	.symtab	0x8000c554	52	FUNC	<unknown>	DEFAULT	2
sprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
srand	.symtab	0x80006e58	88	FUNC	<unknown>	DEFAULT	2
srandom	.symtab	0x80006e58	88	FUNC	<unknown>	DEFAULT	2
srandom_r	.symtab	0x80007150	422	FUNC	<unknown>	DEFAULT	2
static_id	.symtab	0x800147fc	2	OBJECT	<unknown>	DEFAULT	9
static_ns	.symtab	0x80018bf0	4	OBJECT	<unknown>	DEFAULT	10
stderr	.symtab	0x80014838	4	OBJECT	<unknown>	DEFAULT	9
stdhexflood	.symtab	0x80002418	274	FUNC	<unknown>	DEFAULT	2
stdin	.symtab	0x80014830	4	OBJECT	<unknown>	DEFAULT	9
stdout	.symtab	0x80014834	4	OBJECT	<unknown>	DEFAULT	9
strcasecmp	.symtab	0x8000e2f0	120	FUNC	<unknown>	DEFAULT	2
strcasecmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchr	.symtab	0x80005618	390	FUNC	<unknown>	DEFAULT	2
strchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcmp	.symtab	0x800057a0	110	FUNC	<unknown>	DEFAULT	2
strcmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcoll	.symtab	0x800057a0	110	FUNC	<unknown>	DEFAULT	2
strcpy	.symtab	0x80005810	92	FUNC	<unknown>	DEFAULT	2
strcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strdup	.symtab	0x8000afa4	80	FUNC	<unknown>	DEFAULT	2
strdup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strerror_r	.symtab	0x8000e1e8	264	FUNC	<unknown>	DEFAULT	2
strlen	.symtab	0x8000586c	268	FUNC	<unknown>	DEFAULT	2
strlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncat	.symtab	0x8000ae04	310	FUNC	<unknown>	DEFAULT	2
strncat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncpy	.symtab	0x80008d74	320	FUNC	<unknown>	DEFAULT	2
strncpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strnlen	.symtab	0x8000e064	350	FUNC	<unknown>	DEFAULT	2
strnlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strpbrk	.symtab	0x80008f50	86	FUNC	<unknown>	DEFAULT	2
strpbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strspn	.symtab	0x8000af3c	104	FUNC	<unknown>	DEFAULT	2
strspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strstr	.symtab	0x80005978	484	FUNC	<unknown>	DEFAULT	2
strstr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok	.symtab	0x80005b7c	36	FUNC	<unknown>	DEFAULT	2
strtok.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok_r	.symtab	0x80008eb4	154	FUNC	<unknown>	DEFAULT	2
strtok_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtol	.symtab	0x8000745c	34	FUNC	<unknown>	DEFAULT	2
strtol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcgetattr	.symtab	0x8000b028	182	FUNC	<unknown>	DEFAULT	2
tcgetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcpcsum	.symtab	0x80001266	198	FUNC	<unknown>	DEFAULT	2
time	.symtab	0x800053b0	62	FUNC	<unknown>	DEFAULT	2
time.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tolower	.symtab	0x8000c514	64	FUNC	<unknown>	DEFAULT	2
tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
toupper	.symtab	0x80005490	64	FUNC	<unknown>	DEFAULT	2
toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
trim	.symtab	0x800005c6	174	FUNC	<unknown>	DEFAULT	2
type_codes	.symtab	0x8001196e	24	OBJECT	<unknown>	DEFAULT	4
type_sizes	.symtab	0x80011986	12	OBJECT	<unknown>	DEFAULT	4
unknown.1089	.symtab	0x80011992	14	OBJECT	<unknown>	DEFAULT	4
unsafe_state	.symtab	0x80014744	28	OBJECT	<unknown>	DEFAULT	9
useragents	.symtab	0x800145ec	28	OBJECT	<unknown>	DEFAULT	9
usleep	.symtab	0x80007960	142	FUNC	<unknown>	DEFAULT	2
usleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
vseattack	.symtab	0x80001e36	1240	FUNC	<unknown>	DEFAULT	2
vsnprintf	.symtab	0x8000c588	198	FUNC	<unknown>	DEFAULT	2
vsnprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wait4	.symtab	0x80008092	30	FUNC	<unknown>	DEFAULT	2
wait4.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
waitpid	.symtab	0x800053f0	34	FUNC	<unknown>	DEFAULT	2
waitpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcrtomb	.symtab	0x8000e63c	100	FUNC	<unknown>	DEFAULT	2
wcrtomb.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsnrtombs	.symtab	0x8000e6c8	206	FUNC	<unknown>	DEFAULT	2
wcsnrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsrtombs	.symtab	0x8000e6a0	38	FUNC	<unknown>	DEFAULT	2
wcsrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
write	.symtab	0x80005414	84	FUNC	<unknown>	DEFAULT	2
write.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
xdigits.3095	.symtab	0x800115c4	17	OBJECT	<unknown>	DEFAULT	4

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-16T12:53:27.656762+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53028	150.241.88.132	25565	TCP
2024-12-16T12:53:29.986696+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53030	150.241.88.132	25565	TCP
2024-12-16T12:53:32.360641+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53032	150.241.88.132	25565	TCP
2024-12-16T12:53:34.692861+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53034	150.241.88.132	25565	TCP
2024-12-16T12:53:37.017414+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53036	150.241.88.132	25565	TCP
2024-12-16T12:53:39.348979+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53038	150.241.88.132	25565	TCP
2024-12-16T12:53:41.674040+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53040	150.241.88.132	25565	TCP
2024-12-16T12:53:44.051906+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53042	150.241.88.132	25565	TCP
2024-12-16T12:53:46.395985+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53044	150.241.88.132	25565	TCP
2024-12-16T12:53:48.725347+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53046	150.241.88.132	25565	TCP
2024-12-16T12:53:51.049852+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53048	150.241.88.132	25565	TCP
2024-12-16T12:53:53.426525+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53050	150.241.88.132	25565	TCP
2024-12-16T12:53:55.802730+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53052	150.241.88.132	25565	TCP
2024-12-16T12:53:58.176454+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53054	150.241.88.132	25565	TCP
2024-12-16T12:54:00.502852+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53056	150.241.88.132	25565	TCP
2024-12-16T12:54:02.879389+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53058	150.241.88.132	25565	TCP
2024-12-16T12:54:05.209212+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53060	150.241.88.132	25565	TCP
2024-12-16T12:54:07.534093+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53062	150.241.88.132	25565	TCP
2024-12-16T12:54:09.862258+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53064	150.241.88.132	25565	TCP
2024-12-16T12:54:12.238505+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53066	150.241.88.132	25565	TCP
2024-12-16T12:54:14.565465+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53068	150.241.88.132	25565	TCP
2024-12-16T12:54:16.892770+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53070	150.241.88.132	25565	TCP
2024-12-16T12:54:19.220947+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53072	150.241.88.132	25565	TCP
2024-12-16T12:54:21.550022+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53074	150.241.88.132	25565	TCP
2024-12-16T12:54:23.926522+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53076	150.241.88.132	25565	TCP
2024-12-16T12:54:26.252746+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53078	150.241.88.132	25565	TCP
2024-12-16T12:54:28.583760+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53080	150.241.88.132	25565	TCP
2024-12-16T12:54:30.910268+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53082	150.241.88.132	25565	TCP
2024-12-16T12:54:33.237417+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53084	150.241.88.132	25565	TCP
2024-12-16T12:54:35.567011+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53086	150.241.88.132	25565	TCP
2024-12-16T12:54:37.943787+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53088	150.241.88.132	25565	TCP
2024-12-16T12:54:40.272278+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53090	150.241.88.132	25565	TCP
2024-12-16T12:54:42.597735+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53092	150.241.88.132	25565	TCP
2024-12-16T12:54:44.928790+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53094	150.241.88.132	25565	TCP
2024-12-16T12:54:47.254130+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53096	150.241.88.132	25565	TCP
2024-12-16T12:54:49.585051+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53098	150.241.88.132	25565	TCP
2024-12-16T12:54:51.957814+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53100	150.241.88.132	25565	TCP
2024-12-16T12:54:54.288957+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53102	150.241.88.132	25565	TCP
2024-12-16T12:54:56.615536+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53104	150.241.88.132	25565	TCP
2024-12-16T12:54:58.941307+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53106	150.241.88.132	25565	TCP
2024-12-16T12:55:01.317977+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53108	150.241.88.132	25565	TCP
2024-12-16T12:55:03.695229+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53110	150.241.88.132	25565	TCP
2024-12-16T12:55:06.019656+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53112	150.241.88.132	25565	TCP
2024-12-16T12:55:08.353685+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53114	150.241.88.132	25565	TCP
2024-12-16T12:55:10.676425+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53116	150.241.88.132	25565	TCP
2024-12-16T12:55:13.161969+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53118	150.241.88.132	25565	TCP
2024-12-16T12:55:15.489716+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53120	150.241.88.132	25565	TCP
2024-12-16T12:55:17.817947+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53122	150.241.88.132	25565	TCP
2024-12-16T12:55:20.149303+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53124	150.241.88.132	25565	TCP
2024-12-16T12:55:22.521439+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53126	150.241.88.132	25565	TCP
2024-12-16T12:55:24.859918+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53128	150.241.88.132	25565	TCP
2024-12-16T12:55:27.194284+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53130	150.241.88.132	25565	TCP
2024-12-16T12:55:29.519689+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53132	150.241.88.132	25565	TCP
2024-12-16T12:55:31.913987+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53134	150.241.88.132	25565	TCP
2024-12-16T12:55:34.242903+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53136	150.241.88.132	25565	TCP
2024-12-16T12:55:36.616309+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53138	150.241.88.132	25565	TCP
2024-12-16T12:55:38.941462+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53140	150.241.88.132	25565	TCP
2024-12-16T12:55:41.275642+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53142	150.241.88.132	25565	TCP
2024-12-16T12:55:43.598654+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53144	150.241.88.132	25565	TCP
2024-12-16T12:55:45.929790+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53146	150.241.88.132	25565	TCP
2024-12-16T12:55:48.256592+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53148	150.241.88.132	25565	TCP
2024-12-16T12:55:50.631596+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53150	150.241.88.132	25565	TCP
2024-12-16T12:55:52.958335+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53152	150.241.88.132	25565	TCP
2024-12-16T12:55:55.335135+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53154	150.241.88.132	25565	TCP
2024-12-16T12:55:57.661016+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53156	150.241.88.132	25565	TCP
2024-12-16T12:55:59.992786+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53158	150.241.88.132	25565	TCP
2024-12-16T12:56:02.379032+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53160	150.241.88.132	25565	TCP
2024-12-16T12:56:04.708838+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53162	150.241.88.132	25565	TCP
2024-12-16T12:56:07.085008+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53164	150.241.88.132	25565	TCP
2024-12-16T12:56:09.477982+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53166	150.241.88.132	25565	TCP
2024-12-16T12:56:11.806728+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53168	150.241.88.132	25565	TCP
2024-12-16T12:56:14.130534+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53170	150.241.88.132	25565	TCP
2024-12-16T12:56:16.506433+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53172	150.241.88.132	25565	TCP
2024-12-16T12:56:18.849598+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53174	150.241.88.132	25565	TCP
2024-12-16T12:56:21.177474+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53176	150.241.88.132	25565	TCP
2024-12-16T12:56:23.509245+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53178	150.241.88.132	25565	TCP
2024-12-16T12:56:25.859435+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53180	150.241.88.132	25565	TCP
2024-12-16T12:56:28.208603+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53182	150.241.88.132	25565	TCP
2024-12-16T12:56:30.537035+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53184	150.241.88.132	25565	TCP
2024-12-16T12:56:32.865030+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53186	150.241.88.132	25565	TCP
2024-12-16T12:56:35.192500+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53188	150.241.88.132	25565	TCP
2024-12-16T12:56:37.522982+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53190	150.241.88.132	25565	TCP
2024-12-16T12:56:39.861609+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53192	150.241.88.132	25565	TCP
2024-12-16T12:56:42.194320+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53194	150.241.88.132	25565	TCP
2024-12-16T12:56:44.521928+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53196	150.241.88.132	25565	TCP
2024-12-16T12:56:46.873376+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53198	150.241.88.132	25565	TCP
2024-12-16T12:56:49.213189+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53200	150.241.88.132	25565	TCP
2024-12-16T12:56:51.601710+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53202	150.241.88.132	25565	TCP
2024-12-16T12:56:53.927703+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53204	150.241.88.132	25565	TCP
2024-12-16T12:56:56.255657+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53206	150.241.88.132	25565	TCP
2024-12-16T12:56:58.584028+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53208	150.241.88.132	25565	TCP
2024-12-16T12:57:00.915436+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	53210	150.241.88.132	25565	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 16, 2024 12:53:27.534368992 CET	53028	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:53:27.654375076 CET	25565	53028	150.241.88.132	192.168.2.13
Dec 16, 2024 12:53:27.654450893 CET	53028	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:53:27.656761885 CET	53028	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:53:27.776530981 CET	25565	53028	150.241.88.132	192.168.2.13
Dec 16, 2024 12:53:29.865159988 CET	25565	53028	150.241.88.132	192.168.2.13
Dec 16, 2024 12:53:29.865789890 CET	53028	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:53:29.866528034 CET	53030	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:53:29.985634089 CET	25565	53028	150.241.88.132	192.168.2.13
Dec 16, 2024 12:53:29.986355066 CET	25565	53030	150.241.88.132	192.168.2.13
Dec 16, 2024 12:53:29.986500978 CET	53030	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:53:29.986696005 CET	53030	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:53:30.106456041 CET	25565	53030	150.241.88.132	192.168.2.13
Dec 16, 2024 12:53:32.239777088 CET	25565	53030	150.241.88.132	192.168.2.13
Dec 16, 2024 12:53:32.240041971 CET	53030	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:53:32.240695000 CET	53032	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:53:32.359765053 CET	25565	53030	150.241.88.132	192.168.2.13
Dec 16, 2024 12:53:32.360451937 CET	25565	53032	150.241.88.132	192.168.2.13
Dec 16, 2024 12:53:32.360532045 CET	53032	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:53:32.360641003 CET	53032	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:53:32.481081963 CET	25565	53032	150.241.88.132	192.168.2.13
Dec 16, 2024 12:53:34.571568012 CET	25565	53032	150.241.88.132	192.168.2.13
Dec 16, 2024 12:53:34.571990013 CET	53032	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:53:34.572829962 CET	53034	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:53:34.691879988 CET	25565	53032	150.241.88.132	192.168.2.13
Dec 16, 2024 12:53:34.692576885 CET	25565	53034	150.241.88.132	192.168.2.13
Dec 16, 2024 12:53:34.692754984 CET	53034	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:53:34.692861080 CET	53034	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:53:34.812675953 CET	25565	53034	150.241.88.132	192.168.2.13
Dec 16, 2024 12:53:36.896488905 CET	25565	53034	150.241.88.132	192.168.2.13
Dec 16, 2024 12:53:36.896893024 CET	53034	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:53:36.897442102 CET	53036	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:53:37.016704082 CET	25565	53034	150.241.88.132	192.168.2.13
Dec 16, 2024 12:53:37.017132998 CET	25565	53036	150.241.88.132	192.168.2.13
Dec 16, 2024 12:53:37.017281055 CET	53036	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:53:37.017414093 CET	53036	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:53:37.137373924 CET	25565	53036	150.241.88.132	192.168.2.13
Dec 16, 2024 12:53:39.227817059 CET	25565	53036	150.241.88.132	192.168.2.13
Dec 16, 2024 12:53:39.228126049 CET	53036	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:53:39.228713989 CET	53038	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:53:39.348175049 CET	25565	53036	150.241.88.132	192.168.2.13
Dec 16, 2024 12:53:39.348798990 CET	25565	53038	150.241.88.132	192.168.2.13
Dec 16, 2024 12:53:39.348902941 CET	53038	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:53:39.348978996 CET	53038	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:53:39.468962908 CET	25565	53038	150.241.88.132	192.168.2.13
Dec 16, 2024 12:53:41.553119898 CET	25565	53038	150.241.88.132	192.168.2.13
Dec 16, 2024 12:53:41.553414106 CET	53038	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:53:41.554166079 CET	53040	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:53:41.673295975 CET	25565	53038	150.241.88.132	192.168.2.13
Dec 16, 2024 12:53:41.673873901 CET	25565	53040	150.241.88.132	192.168.2.13
Dec 16, 2024 12:53:41.674038887 CET	53040	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:53:41.674040079 CET	53040	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:53:41.794101000 CET	25565	53040	150.241.88.132	192.168.2.13
Dec 16, 2024 12:53:43.929691076 CET	25565	53040	150.241.88.132	192.168.2.13
Dec 16, 2024 12:53:43.930005074 CET	53040	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:53:43.930545092 CET	53042	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:53:44.051604986 CET	25565	53040	150.241.88.132	192.168.2.13
Dec 16, 2024 12:53:44.051625013 CET	25565	53042	150.241.88.132	192.168.2.13
Dec 16, 2024 12:53:44.051812887 CET	53042	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:53:44.051906109 CET	53042	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:53:44.171819925 CET	25565	53042	150.241.88.132	192.168.2.13
Dec 16, 2024 12:53:46.274935961 CET	25565	53042	150.241.88.132	192.168.2.13
Dec 16, 2024 12:53:46.275170088 CET	53042	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:53:46.275739908 CET	53044	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:53:46.395565987 CET	25565	53042	150.241.88.132	192.168.2.13
Dec 16, 2024 12:53:46.395755053 CET	25565	53044	150.241.88.132	192.168.2.13
Dec 16, 2024 12:53:46.395884991 CET	53044	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:53:46.395984888 CET	53044	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:53:46.515793085 CET	25565	53044	150.241.88.132	192.168.2.13
Dec 16, 2024 12:53:48.602966070 CET	25565	53044	150.241.88.132	192.168.2.13
Dec 16, 2024 12:53:48.603571892 CET	53044	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:53:48.604799032 CET	53046	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:53:48.723978043 CET	25565	53044	150.241.88.132	192.168.2.13
Dec 16, 2024 12:53:48.724977016 CET	25565	53046	150.241.88.132	192.168.2.13
Dec 16, 2024 12:53:48.725123882 CET	53046	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:53:48.725347042 CET	53046	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:53:48.845148087 CET	25565	53046	150.241.88.132	192.168.2.13
Dec 16, 2024 12:53:50.928189039 CET	25565	53046	150.241.88.132	192.168.2.13
Dec 16, 2024 12:53:50.928812027 CET	53046	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:53:50.929640055 CET	53048	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:53:51.048798084 CET	25565	53046	150.241.88.132	192.168.2.13
Dec 16, 2024 12:53:51.049485922 CET	25565	53048	150.241.88.132	192.168.2.13
Dec 16, 2024 12:53:51.049664021 CET	53048	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:53:51.049851894 CET	53048	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:53:51.169936895 CET	25565	53048	150.241.88.132	192.168.2.13
Dec 16, 2024 12:53:53.305097103 CET	25565	53048	150.241.88.132	192.168.2.13
Dec 16, 2024 12:53:53.305313110 CET	53048	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:53:53.306276083 CET	53050	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:53:53.425236940 CET	25565	53048	150.241.88.132	192.168.2.13
Dec 16, 2024 12:53:53.426095963 CET	25565	53050	150.241.88.132	192.168.2.13
Dec 16, 2024 12:53:53.426266909 CET	53050	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:53:53.426525116 CET	53050	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:53:53.546351910 CET	25565	53050	150.241.88.132	192.168.2.13
Dec 16, 2024 12:53:55.679759979 CET	25565	53050	150.241.88.132	192.168.2.13
Dec 16, 2024 12:53:55.679968119 CET	53050	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:53:55.680742025 CET	53052	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:53:55.802172899 CET	25565	53050	150.241.88.132	192.168.2.13
Dec 16, 2024 12:53:55.802536011 CET	25565	53052	150.241.88.132	192.168.2.13
Dec 16, 2024 12:53:55.802618980 CET	53052	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:53:55.802730083 CET	53052	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:53:55.923939943 CET	25565	53052	150.241.88.132	192.168.2.13
Dec 16, 2024 12:53:58.054524899 CET	25565	53052	150.241.88.132	192.168.2.13
Dec 16, 2024 12:53:58.055125952 CET	53052	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:53:58.056262016 CET	53054	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:53:58.175193071 CET	25565	53052	150.241.88.132	192.168.2.13
Dec 16, 2024 12:53:58.176105976 CET	25565	53054	150.241.88.132	192.168.2.13
Dec 16, 2024 12:53:58.176265955 CET	53054	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:53:58.176454067 CET	53054	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:53:58.296137094 CET	25565	53054	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:00.381540060 CET	25565	53054	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:00.381827116 CET	53054	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:00.382741928 CET	53056	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:00.501780987 CET	25565	53054	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:00.502583981 CET	25565	53056	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:00.502698898 CET	53056	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:00.502851963 CET	53056	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:00.622766972 CET	25565	53056	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:02.757767916 CET	25565	53056	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:02.758081913 CET	53056	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:02.759244919 CET	53058	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:02.877964973 CET	25565	53056	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:02.878933907 CET	25565	53058	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:02.879228115 CET	53058	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:02.879389048 CET	53058	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:02.999299049 CET	25565	53058	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:05.087702990 CET	25565	53058	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:05.088192940 CET	53058	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:05.089174986 CET	53060	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:05.208108902 CET	25565	53058	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:05.208895922 CET	25565	53060	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:05.209063053 CET	53060	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:05.209212065 CET	53060	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:05.329062939 CET	25565	53060	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:07.412602901 CET	25565	53060	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:07.413101912 CET	53060	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:07.414036989 CET	53062	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:07.533057928 CET	25565	53060	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:07.533796072 CET	25565	53062	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:07.533962965 CET	53062	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:07.534092903 CET	53062	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:07.653897047 CET	25565	53062	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:09.740652084 CET	25565	53062	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:09.741117954 CET	53062	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:09.741986036 CET	53064	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:09.861198902 CET	25565	53062	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:09.861794949 CET	25565	53064	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:09.861999989 CET	53064	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:09.862257957 CET	53064	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:09.982239962 CET	25565	53064	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:12.117290020 CET	25565	53064	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:12.117645979 CET	53064	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:12.118412018 CET	53066	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:12.237545967 CET	25565	53064	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:12.238090038 CET	25565	53066	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:12.238327026 CET	53066	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:12.238504887 CET	53066	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:12.358601093 CET	25565	53066	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:14.444303989 CET	25565	53066	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:14.444566965 CET	53066	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:14.445487976 CET	53068	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:14.564460039 CET	25565	53066	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:14.565246105 CET	25565	53068	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:14.565390110 CET	53068	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:14.565464973 CET	53068	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:14.685340881 CET	25565	53068	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:16.771766901 CET	25565	53068	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:16.772042990 CET	53068	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:16.772893906 CET	53070	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:16.892039061 CET	25565	53068	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:16.892613888 CET	25565	53070	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:16.892725945 CET	53070	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:16.892770052 CET	53070	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:17.013015985 CET	25565	53070	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:19.100236893 CET	25565	53070	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:19.100433111 CET	53070	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:19.101111889 CET	53072	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:19.220495939 CET	25565	53070	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:19.220830917 CET	25565	53072	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:19.220894098 CET	53072	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:19.220947027 CET	53072	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:19.340883017 CET	25565	53072	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:21.428853989 CET	25565	53072	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:21.429102898 CET	53072	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:21.429974079 CET	53074	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:21.548904896 CET	25565	53072	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:21.549690008 CET	25565	53074	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:21.549860001 CET	53074	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:21.550021887 CET	53074	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:21.669775963 CET	25565	53074	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:23.805499077 CET	25565	53074	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:23.805742979 CET	53074	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:23.806487083 CET	53076	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:23.925595045 CET	25565	53074	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:23.926181078 CET	25565	53076	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:23.926357985 CET	53076	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:23.926522017 CET	53076	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:24.046247959 CET	25565	53076	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:26.131480932 CET	25565	53076	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:26.131676912 CET	53076	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:26.132606030 CET	53078	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:26.251498938 CET	25565	53076	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:26.252388000 CET	25565	53078	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:26.252746105 CET	53078	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:26.252746105 CET	53078	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:26.372667074 CET	25565	53078	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:28.462802887 CET	25565	53078	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:28.463149071 CET	53078	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:28.463773012 CET	53080	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:28.582895994 CET	25565	53078	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:28.583472967 CET	25565	53080	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:28.583760023 CET	53080	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:28.583760023 CET	53080	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:28.703597069 CET	25565	53080	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:30.788463116 CET	25565	53080	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:30.788738966 CET	53080	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:30.789504051 CET	53082	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:30.908790112 CET	25565	53080	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:30.910056114 CET	25565	53082	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:30.910221100 CET	53082	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:30.910268068 CET	53082	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:31.030019045 CET	25565	53082	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:33.115731955 CET	25565	53082	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:33.115969896 CET	53082	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:33.116826057 CET	53084	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:33.235925913 CET	25565	53082	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:33.236771107 CET	25565	53084	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:33.236933947 CET	53084	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:33.237416983 CET	53084	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:33.357621908 CET	25565	53084	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:35.444757938 CET	25565	53084	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:35.445245981 CET	53084	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:35.446181059 CET	53086	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:35.565772057 CET	25565	53084	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:35.566482067 CET	25565	53086	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:35.566809893 CET	53086	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:35.567011118 CET	53086	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:35.686796904 CET	25565	53086	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:37.822618008 CET	25565	53086	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:37.822992086 CET	53086	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:37.823771000 CET	53088	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:37.942969084 CET	25565	53086	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:37.943564892 CET	25565	53088	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:37.943694115 CET	53088	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:37.943787098 CET	53088	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:38.065639019 CET	25565	53088	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:40.150515079 CET	25565	53088	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:40.150937080 CET	53088	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:40.152137995 CET	53090	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:40.270674944 CET	25565	53088	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:40.271892071 CET	25565	53090	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:40.272176981 CET	53090	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:40.272278070 CET	53090	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:40.391988993 CET	25565	53090	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:42.476032972 CET	25565	53090	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:42.476758957 CET	53090	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:42.477639914 CET	53092	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:42.596911907 CET	25565	53090	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:42.597450972 CET	25565	53092	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:42.597600937 CET	53092	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:42.597734928 CET	53092	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:42.717632055 CET	25565	53092	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:44.807302952 CET	25565	53092	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:44.807614088 CET	53092	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:44.808636904 CET	53094	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:44.927299023 CET	25565	53092	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:44.928533077 CET	25565	53094	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:44.928740025 CET	53094	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:44.928790092 CET	53094	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:45.048681021 CET	25565	53094	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:47.132441998 CET	25565	53094	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:47.132960081 CET	53094	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:47.133846045 CET	53096	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:47.252949953 CET	25565	53094	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:47.253654957 CET	25565	53096	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:47.253730059 CET	53096	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:47.254129887 CET	53096	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:47.374334097 CET	25565	53096	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:49.463445902 CET	25565	53096	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:49.463963032 CET	53096	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:49.464899063 CET	53098	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:49.584049940 CET	25565	53096	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:49.584654093 CET	25565	53098	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:49.584878922 CET	53098	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:49.585051060 CET	53098	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:49.704804897 CET	25565	53098	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:51.836849928 CET	25565	53098	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:51.837028027 CET	53098	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:51.837656021 CET	53100	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:51.956918001 CET	25565	53098	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:51.957643032 CET	25565	53100	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:51.957777023 CET	53100	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:51.957813978 CET	53100	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:52.077665091 CET	25565	53100	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:54.166054964 CET	25565	53100	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:54.166394949 CET	53100	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:54.166958094 CET	53102	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:54.288053989 CET	25565	53100	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:54.288440943 CET	25565	53102	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:54.288665056 CET	53102	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:54.288957119 CET	53102	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:54.408981085 CET	25565	53102	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:56.492171049 CET	25565	53102	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:56.492558002 CET	53102	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:56.493376017 CET	53104	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:56.614242077 CET	25565	53102	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:56.615288973 CET	25565	53104	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:56.615381002 CET	53104	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:56.615535975 CET	53104	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:56.735280991 CET	25565	53104	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:58.819885969 CET	25565	53104	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:58.820067883 CET	53104	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:58.820718050 CET	53106	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:58.940299034 CET	25565	53104	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:58.940927029 CET	25565	53106	150.241.88.132	192.168.2.13
Dec 16, 2024 12:54:58.941201925 CET	53106	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:58.941307068 CET	53106	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:54:59.062581062 CET	25565	53106	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:01.196455956 CET	25565	53106	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:01.196980000 CET	53106	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:01.197916031 CET	53108	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:01.316907883 CET	25565	53106	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:01.317585945 CET	25565	53108	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:01.317879915 CET	53108	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:01.317976952 CET	53108	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:01.439430952 CET	25565	53108	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:03.571871996 CET	25565	53108	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:03.572453022 CET	53108	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:03.573421001 CET	53110	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:03.694515944 CET	25565	53108	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:03.694905996 CET	25565	53110	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:03.695064068 CET	53110	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:03.695229053 CET	53110	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:03.815077066 CET	25565	53110	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:05.898510933 CET	25565	53110	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:05.898891926 CET	53110	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:05.899708033 CET	53112	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:06.018821001 CET	25565	53110	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:06.019490957 CET	25565	53112	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:06.019623041 CET	53112	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:06.019655943 CET	53112	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:06.140249968 CET	25565	53112	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:08.232162952 CET	25565	53112	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:08.232556105 CET	53112	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:08.233632088 CET	53114	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:08.352462053 CET	25565	53112	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:08.353352070 CET	25565	53114	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:08.353630066 CET	53114	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:08.353684902 CET	53114	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:08.475691080 CET	25565	53114	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:10.554812908 CET	25565	53114	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:10.555161953 CET	53114	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:10.556118011 CET	53116	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:10.675012112 CET	25565	53114	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:10.675884962 CET	25565	53116	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:10.676184893 CET	53116	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:10.676424980 CET	53116	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:10.796603918 CET	25565	53116	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:13.040646076 CET	25565	53116	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:13.040894985 CET	53116	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:13.041908026 CET	53118	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:13.160649061 CET	25565	53116	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:13.161626101 CET	25565	53118	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:13.161814928 CET	53118	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:13.161968946 CET	53118	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:13.281667948 CET	25565	53118	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:15.367588997 CET	25565	53118	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:15.367837906 CET	53118	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:15.368957043 CET	53120	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:15.489469051 CET	25565	53118	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:15.489516020 CET	25565	53120	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:15.489716053 CET	53120	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:15.489716053 CET	53120	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:15.609672070 CET	25565	53120	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:17.695802927 CET	25565	53120	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:17.696317911 CET	53120	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:17.696397066 CET	53120	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:17.697335005 CET	53122	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:17.817434072 CET	25565	53120	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:17.817476034 CET	25565	53122	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:17.817778111 CET	53122	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:17.817946911 CET	53122	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:17.937722921 CET	25565	53122	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:20.027079105 CET	25565	53122	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:20.027544022 CET	53122	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:20.029061079 CET	53124	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:20.147516966 CET	25565	53122	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:20.149054050 CET	25565	53124	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:20.149174929 CET	53124	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:20.149302959 CET	53124	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:20.270133018 CET	25565	53124	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:22.400187969 CET	25565	53124	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:22.400430918 CET	53124	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:22.401345015 CET	53126	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:22.520212889 CET	25565	53124	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:22.521039009 CET	25565	53126	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:22.521347046 CET	53126	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:22.521439075 CET	53126	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:22.641189098 CET	25565	53126	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:24.738372087 CET	25565	53126	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:24.738723040 CET	53126	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:24.739840984 CET	53128	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:24.858584881 CET	25565	53126	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:24.859597921 CET	25565	53128	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:24.859849930 CET	53128	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:24.859918118 CET	53128	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:24.980159044 CET	25565	53128	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:27.070101976 CET	25565	53128	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:27.070532084 CET	53128	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:27.071276903 CET	53130	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:27.192730904 CET	25565	53128	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:27.193950891 CET	25565	53130	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:27.194220066 CET	53130	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:27.194283962 CET	53130	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:27.313993931 CET	25565	53130	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:29.398096085 CET	25565	53130	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:29.398494005 CET	53130	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:29.399331093 CET	53132	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:29.518470049 CET	25565	53130	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:29.519203901 CET	25565	53132	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:29.519494057 CET	53132	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:29.519689083 CET	53132	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:29.639352083 CET	25565	53132	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:31.792196035 CET	25565	53132	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:31.792646885 CET	53132	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:31.793777943 CET	53134	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:31.912450075 CET	25565	53132	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:31.913510084 CET	25565	53134	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:31.913837910 CET	53134	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:31.913986921 CET	53134	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:32.036714077 CET	25565	53134	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:34.118745089 CET	25565	53134	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:34.119200945 CET	53134	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:34.120424032 CET	53136	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:34.240159988 CET	25565	53134	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:34.242602110 CET	25565	53136	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:34.242722988 CET	53136	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:34.242902994 CET	53136	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:34.362978935 CET	25565	53136	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:36.494086981 CET	25565	53136	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:36.494482040 CET	53136	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:36.495385885 CET	53138	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:36.614717960 CET	25565	53136	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:36.615791082 CET	25565	53138	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:36.616061926 CET	53138	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:36.616308928 CET	53138	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:36.736346960 CET	25565	53138	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:38.820424080 CET	25565	53138	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:38.820611954 CET	53138	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:38.821327925 CET	53140	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:38.940419912 CET	25565	53138	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:38.941030979 CET	25565	53140	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:38.941462040 CET	53140	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:38.941462040 CET	53140	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:39.061323881 CET	25565	53140	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:41.154380083 CET	25565	53140	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:41.154741049 CET	53140	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:41.155607939 CET	53142	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:41.274487019 CET	25565	53140	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:41.275255919 CET	25565	53142	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:41.275489092 CET	53142	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:41.275641918 CET	53142	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:41.395415068 CET	25565	53142	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:43.477297068 CET	25565	53142	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:43.477601051 CET	53142	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:43.478383064 CET	53144	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:43.597635031 CET	25565	53142	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:43.598352909 CET	25565	53144	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:43.598490953 CET	53144	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:43.598654032 CET	53144	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:43.718374014 CET	25565	53144	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:45.808574915 CET	25565	53144	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:45.808799028 CET	53144	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:45.809851885 CET	53146	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:45.928711891 CET	25565	53144	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:45.929557085 CET	25565	53146	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:45.929656982 CET	53146	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:45.929790020 CET	53146	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:46.049556017 CET	25565	53146	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:48.133446932 CET	25565	53146	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:48.134100914 CET	53146	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:48.135102034 CET	53148	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:48.253945112 CET	25565	53146	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:48.256305933 CET	25565	53148	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:48.256472111 CET	53148	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:48.256592035 CET	53148	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:48.376549006 CET	25565	53148	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:50.510104895 CET	25565	53148	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:50.510528088 CET	53148	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:50.511459112 CET	53150	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:50.630548000 CET	25565	53148	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:50.631253004 CET	25565	53150	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:50.631395102 CET	53150	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:50.631596088 CET	53150	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:50.751676083 CET	25565	53150	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:52.836815119 CET	25565	53150	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:52.837132931 CET	53150	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:52.838036060 CET	53152	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:52.957271099 CET	25565	53150	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:52.958090067 CET	25565	53152	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:52.958221912 CET	53152	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:52.958334923 CET	53152	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:53.078378916 CET	25565	53152	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:55.213733912 CET	25565	53152	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:55.214054108 CET	53152	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:55.214766026 CET	53154	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:55.334322929 CET	25565	53152	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:55.334800959 CET	25565	53154	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:55.334999084 CET	53154	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:55.335134983 CET	53154	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:55.456012964 CET	25565	53154	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:57.539282084 CET	25565	53154	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:57.539530993 CET	53154	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:57.540060043 CET	53156	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:57.660270929 CET	25565	53154	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:57.660708904 CET	25565	53156	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:57.660953999 CET	53156	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:57.661015987 CET	53156	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:57.780833006 CET	25565	53156	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:59.871211052 CET	25565	53156	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:59.871543884 CET	53156	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:59.872847080 CET	53158	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:59.991345882 CET	25565	53156	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:59.992568016 CET	25565	53158	150.241.88.132	192.168.2.13
Dec 16, 2024 12:55:59.992686033 CET	53158	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:55:59.992785931 CET	53158	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:00.112706900 CET	25565	53158	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:02.257472038 CET	25565	53158	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:02.258022070 CET	53158	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:02.258939981 CET	53160	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:02.377819061 CET	25565	53158	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:02.378690958 CET	25565	53160	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:02.378856897 CET	53160	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:02.379031897 CET	53160	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:02.498776913 CET	25565	53160	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:04.587419987 CET	25565	53160	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:04.587791920 CET	53160	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:04.588665962 CET	53162	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:04.707865953 CET	25565	53160	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:04.708509922 CET	25565	53162	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:04.708703041 CET	53162	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:04.708837986 CET	53162	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:04.828649044 CET	25565	53162	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:06.963341951 CET	25565	53162	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:06.963681936 CET	53162	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:06.964834929 CET	53164	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:07.084342003 CET	25565	53162	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:07.084676981 CET	25565	53164	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:07.084920883 CET	53164	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:07.085007906 CET	53164	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:07.205377102 CET	25565	53164	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:09.356724977 CET	25565	53164	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:09.357033968 CET	53164	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:09.357876062 CET	53166	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:09.477108955 CET	25565	53164	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:09.477696896 CET	25565	53166	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:09.477885962 CET	53166	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:09.477982044 CET	53166	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:09.597990036 CET	25565	53166	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:11.685287952 CET	25565	53166	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:11.685452938 CET	53166	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:11.686743021 CET	53168	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:11.805408955 CET	25565	53166	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:11.806559086 CET	25565	53168	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:11.806648016 CET	53168	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:11.806727886 CET	53168	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:11.926630020 CET	25565	53168	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:14.008915901 CET	25565	53168	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:14.009078979 CET	53168	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:14.009630919 CET	53170	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:14.130270004 CET	25565	53168	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:14.130294085 CET	25565	53170	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:14.130533934 CET	53170	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:14.130533934 CET	53170	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:14.250710964 CET	25565	53170	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:16.385725021 CET	25565	53170	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:16.385879993 CET	53170	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:16.386336088 CET	53172	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:16.505861998 CET	25565	53170	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:16.506195068 CET	25565	53172	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:16.506349087 CET	53172	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:16.506433010 CET	53172	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:16.626324892 CET	25565	53172	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:18.728171110 CET	25565	53172	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:18.728580952 CET	53172	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:18.729341030 CET	53174	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:18.848798037 CET	25565	53172	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:18.849328995 CET	25565	53174	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:18.849596977 CET	53174	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:18.849597931 CET	53174	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:18.969748974 CET	25565	53174	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:21.056176901 CET	25565	53174	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:21.056422949 CET	53174	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:21.057480097 CET	53176	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:21.176426888 CET	25565	53174	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:21.177216053 CET	25565	53176	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:21.177330017 CET	53176	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:21.177474022 CET	53176	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:21.297595978 CET	25565	53176	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:23.387845993 CET	25565	53176	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:23.388108969 CET	53176	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:23.389102936 CET	53178	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:23.508434057 CET	25565	53176	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:23.508956909 CET	25565	53178	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:23.509243965 CET	53178	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:23.509244919 CET	53178	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:23.629429102 CET	25565	53178	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:25.738071918 CET	25565	53178	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:25.738467932 CET	53178	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:25.739200115 CET	53180	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:25.858407021 CET	25565	53178	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:25.859132051 CET	25565	53180	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:25.859435081 CET	53180	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:25.859435081 CET	53180	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:25.979798079 CET	25565	53180	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:28.087466955 CET	25565	53180	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:28.087769032 CET	53180	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:28.088290930 CET	53182	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:28.208225012 CET	25565	53180	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:28.208369970 CET	25565	53182	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:28.208539009 CET	53182	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:28.208602905 CET	53182	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:28.328564882 CET	25565	53182	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:30.415949106 CET	25565	53182	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:30.416291952 CET	53182	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:30.416877031 CET	53184	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:30.536200047 CET	25565	53182	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:30.536664963 CET	25565	53184	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:30.536807060 CET	53184	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:30.537034988 CET	53184	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:30.657406092 CET	25565	53184	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:32.744031906 CET	25565	53184	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:32.744435072 CET	53184	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:32.745043993 CET	53186	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:32.864447117 CET	25565	53184	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:32.864725113 CET	25565	53186	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:32.864923954 CET	53186	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:32.865030050 CET	53186	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:32.984802961 CET	25565	53186	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:35.071835995 CET	25565	53186	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:35.072021961 CET	53186	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:35.072519064 CET	53188	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:35.191911936 CET	25565	53186	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:35.192251921 CET	25565	53188	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:35.192416906 CET	53188	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:35.192500114 CET	53188	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:35.312381029 CET	25565	53188	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:37.400839090 CET	25565	53188	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:37.401443005 CET	53188	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:37.402301073 CET	53190	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:37.522017956 CET	25565	53188	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:37.522471905 CET	25565	53190	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:37.522870064 CET	53190	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:37.522981882 CET	53190	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:37.642887115 CET	25565	53190	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:39.740149975 CET	25565	53190	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:39.740628958 CET	53190	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:39.741508007 CET	53192	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:39.860605955 CET	25565	53190	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:39.861303091 CET	25565	53192	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:39.861433983 CET	53192	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:39.861608982 CET	53192	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:39.981504917 CET	25565	53192	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:42.072437048 CET	25565	53192	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:42.072902918 CET	53192	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:42.074168921 CET	53194	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:42.192926884 CET	25565	53192	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:42.194006920 CET	25565	53194	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:42.194159031 CET	53194	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:42.194319963 CET	53194	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:42.314208984 CET	25565	53194	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:44.400764942 CET	25565	53194	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:44.401117086 CET	53194	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:44.401596069 CET	53196	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:44.521156073 CET	25565	53194	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:44.521451950 CET	25565	53196	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:44.521688938 CET	53196	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:44.521928072 CET	53196	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:44.641808987 CET	25565	53196	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:46.752693892 CET	25565	53196	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:46.752903938 CET	53196	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:46.753403902 CET	53198	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:46.872896910 CET	25565	53196	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:46.873123884 CET	25565	53198	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:46.873250008 CET	53198	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:46.873375893 CET	53198	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:46.993241072 CET	25565	53198	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:49.091568947 CET	25565	53198	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:49.092207909 CET	53198	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:49.093151093 CET	53200	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:49.212291956 CET	25565	53198	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:49.212886095 CET	25565	53200	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:49.212994099 CET	53200	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:49.213188887 CET	53200	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:49.332911968 CET	25565	53200	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:51.480514050 CET	25565	53200	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:51.480792046 CET	53200	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:51.481564045 CET	53202	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:51.600681067 CET	25565	53200	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:51.601353884 CET	25565	53202	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:51.601551056 CET	53202	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:51.601710081 CET	53202	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:51.722048044 CET	25565	53202	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:53.807003021 CET	25565	53202	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:53.807209969 CET	53202	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:53.807686090 CET	53204	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:53.927190065 CET	25565	53202	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:53.927476883 CET	25565	53204	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:53.927630901 CET	53204	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:53.927702904 CET	53204	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:54.047759056 CET	25565	53204	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:56.134919882 CET	25565	53204	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:56.135181904 CET	53204	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:56.135678053 CET	53206	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:56.255093098 CET	25565	53204	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:56.255389929 CET	25565	53206	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:56.255532980 CET	53206	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:56.255656958 CET	53206	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:56.375726938 CET	25565	53206	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:58.462924957 CET	25565	53206	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:58.463197947 CET	53206	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:58.464025974 CET	53208	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:58.583247900 CET	25565	53206	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:58.583765030 CET	25565	53208	150.241.88.132	192.168.2.13
Dec 16, 2024 12:56:58.583901882 CET	53208	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:58.584028006 CET	53208	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:56:58.703813076 CET	25565	53208	150.241.88.132	192.168.2.13
Dec 16, 2024 12:57:00.794771910 CET	25565	53208	150.241.88.132	192.168.2.13
Dec 16, 2024 12:57:00.795034885 CET	53208	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:57:00.795547009 CET	53210	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:57:00.914855957 CET	25565	53208	150.241.88.132	192.168.2.13
Dec 16, 2024 12:57:00.915203094 CET	25565	53210	150.241.88.132	192.168.2.13
Dec 16, 2024 12:57:00.915345907 CET	53210	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:57:00.915436029 CET	53210	25565	192.168.2.13	150.241.88.132
Dec 16, 2024 12:57:01.035588026 CET	25565	53210	150.241.88.132	192.168.2.13

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 16, 2024 12:56:11.757545948 CET	55462	53	192.168.2.13	1.1.1.1
Dec 16, 2024 12:56:11.757606030 CET	59552	53	192.168.2.13	1.1.1.1
Dec 16, 2024 12:56:11.896367073 CET	53	59552	1.1.1.1	192.168.2.13
Dec 16, 2024 12:56:11.981982946 CET	53	55462	1.1.1.1	192.168.2.13

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 16, 2024 12:56:11.757545948 CET	192.168.2.13	1.1.1.1	0xa31	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 12:56:11.757606030 CET	192.168.2.13	1.1.1.1	0xb992	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 16, 2024 12:56:11.981982946 CET	1.1.1.1	192.168.2.13	0xa31	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false
Dec 16, 2024 12:56:11.981982946 CET	1.1.1.1	192.168.2.13	0xa31	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: m68k.elf PID: 5443, Parent PID: 5366

General

Start time (UTC):	11:53:26
Start date (UTC):	16/12/2024
Path:	/tmp/m68k.elf
Arguments:	/tmp/m68k.elf
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: m68k.elf PID: 5445, Parent PID: 5443

General

Start time (UTC):	11:53:27
Start date (UTC):	16/12/2024
Path:	/tmp/m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: m68k.elf PID: 5447, Parent PID: 5445

General

Start time (UTC):	11:53:27
Start date (UTC):	16/12/2024
Path:	/tmp/m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping or `net view` using Net .
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report m68k.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Threatname: Gafgyt

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.Qs3zpO (deleted)

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: m68k.elf PID: 5443, Parent PID: 5366

General

Chronological Activities

Analysis Process: m68k.elf PID: 5445, Parent PID: 5443

General

Chronological Activities

Analysis Process: m68k.elf PID: 5447, Parent PID: 5445

General

Chronological Activities

Linux Analysis Report
m68k.elf