Edit tour

Linux Analysis Report
hidakibest.x86.elf

Overview

General Information

Sample name:	hidakibest.x86.elf
Analysis ID:	1579491
MD5:	589d6374c72c1721be71a3a5e3de4a09
SHA1:	e3dea83cde3691800e8751c9e5d7730761eeec6e
SHA256:	aad6878d2aa36a8eb4f95279b6ffea26d83b53df9e27f921b83a986a819d041e
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai, Gafgyt

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Detected Mirai

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Gafgyt

Yara detected Mirai

Machine Learning detection for sample

Opens /proc/net/* files useful for finding connected devices and routers

Detected TCP or UDP traffic on non-standard ports

Sample contains strings that are user agent strings indicative of HTTP manipulation

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1579491
Start date and time:	2024-12-22 16:00:37 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 16s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	hidakibest.x86.elf
Detection:	MAL
Classification:	mal100.spre.troj.linELF@0/0@2/0

Warnings

VT rate limit hit for: 185.216.71.152:4258
VT rate limit hit for: http://fast.no/support/crawler.asp)
VT rate limit hit for: http://feedback.redkolibri.com/
VT rate limit hit for: http://www.billybobbot.com/crawler/)

Runtime Messages

Command:	/tmp/hidakibest.x86.elf
PID:	5511
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

hidakibest.x86.elf (PID: 5511, Parent: 5437, MD5: 589d6374c72c1721be71a3a5e3de4a09) Arguments: /tmp/hidakibest.x86.elf

hidakibest.x86.elf New Fork (PID: 5512, Parent: 5511)

hidakibest.x86.elf New Fork (PID: 5513, Parent: 5512)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
hidakibest.x86.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
hidakibest.x86.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
hidakibest.x86.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xda40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xda54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xda68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xda7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xda90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdaa4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdab8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdacc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdae0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdaf4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdb08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdb1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdb30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdb44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdb58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdb6c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdb80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdb94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdba8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdbbc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdbd0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
hidakibest.x86.elf	Linux_Trojan_Gafgyt_a6a2adb9	unknown	unknown	0x8a8:$a: CC 01 C2 89 55 B4 8B 45 B4 C9 C3 55 48 89 E5 48 81 EC 90 00
hidakibest.x86.elf	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x5574:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
hidakibest.x86.elf	Linux_Trojan_Gafgyt_f3d83a74	unknown	unknown	0x7ce:$a: DC 00 74 1B 83 7D E0 0A 75 15 83 7D E4 00 79 0F C7 45 C8 01 00
hidakibest.x86.elf	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xd9ec:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
hidakibest.x86.elf	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0x356e:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x35d2:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x36e9:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
hidakibest.x86.elf	Linux_Trojan_Gafgyt_09c3070e	unknown	unknown	0xf0a:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 0xfbf:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 0x1200:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83
hidakibest.x86.elf	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0x8ce2:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
hidakibest.x86.elf	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0x5925:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
hidakibest.x86.elf	Linux_Trojan_Gafgyt_779e142f	unknown	unknown	0x6f0:$a: EC 8B 45 E8 83 E0 02 85 C0 74 07 C7 45 D8 30 00 00 00 8B 45 E8 83
hidakibest.x86.elf	Linux_Trojan_Gafgyt_cf84c9f2	unknown	unknown	0x323:$a: 55 48 89 E5 48 83 EC 30 48 89 7D E8 89 75 E4 89 55 E0 C7 45 F8 01 00
hidakibest.x86.elf	Linux_Trojan_Gafgyt_859042a0	unknown	unknown	0x332c:$a: 45 A8 48 83 C0 01 48 89 45 C0 EB 05 48 83 45 C0 01 48 8B 45 C0 0F
hidakibest.x86.elf	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0x5c1b:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
hidakibest.x86.elf	Linux_Trojan_Gafgyt_e4a1982b	unknown	unknown	0x317:$a: 8B 45 EC F7 D0 21 D0 33 45 FC C9 C3 55 48 89 E5 48 83 EC 30 48 89
Click to see the 11 entries

Memory Dumps

Source	Rule	Description	Author	Strings
5511.1.0000000000400000.0000000000411000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
5511.1.0000000000400000.0000000000411000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5511.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xda40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xda54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xda68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xda7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xda90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdaa4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdab8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdacc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdae0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdaf4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdb08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdb1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdb30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdb44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdb58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdb6c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdb80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdb94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdba8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdbbc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdbd0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5511.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_a6a2adb9	unknown	unknown	0x8a8:$a: CC 01 C2 89 55 B4 8B 45 B4 C9 C3 55 48 89 E5 48 81 EC 90 00
5511.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x5574:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
5511.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_f3d83a74	unknown	unknown	0x7ce:$a: DC 00 74 1B 83 7D E0 0A 75 15 83 7D E4 00 79 0F C7 45 C8 01 00
5511.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xd9ec:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
5511.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0x356e:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x35d2:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x36e9:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
5511.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_09c3070e	unknown	unknown	0xf0a:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 0xfbf:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 0x1200:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83
5511.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0x8ce2:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
5511.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0x5925:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
5511.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_779e142f	unknown	unknown	0x6f0:$a: EC 8B 45 E8 83 E0 02 85 C0 74 07 C7 45 D8 30 00 00 00 8B 45 E8 83
5511.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_cf84c9f2	unknown	unknown	0x323:$a: 55 48 89 E5 48 83 EC 30 48 89 7D E8 89 75 E4 89 55 E0 C7 45 F8 01 00
5511.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_859042a0	unknown	unknown	0x332c:$a: 45 A8 48 83 C0 01 48 89 45 C0 EB 05 48 83 45 C0 01 48 8B 45 C0 0F
5511.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0x5c1b:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
5511.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_e4a1982b	unknown	unknown	0x317:$a: 8B 45 EC F7 D0 21 D0 33 45 FC C9 C3 55 48 89 E5 48 83 EC 30 48 89
5512.1.0000000000400000.0000000000411000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
5512.1.0000000000400000.0000000000411000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5512.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xda40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xda54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xda68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xda7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xda90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdaa4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdab8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdacc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdae0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdaf4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdb08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdb1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdb30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdb44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdb58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdb6c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdb80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdb94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdba8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdbbc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdbd0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5512.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_a6a2adb9	unknown	unknown	0x8a8:$a: CC 01 C2 89 55 B4 8B 45 B4 C9 C3 55 48 89 E5 48 81 EC 90 00
5512.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x5574:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
5512.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_f3d83a74	unknown	unknown	0x7ce:$a: DC 00 74 1B 83 7D E0 0A 75 15 83 7D E4 00 79 0F C7 45 C8 01 00
5512.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xd9ec:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
5512.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0x356e:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x35d2:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x36e9:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
5512.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_09c3070e	unknown	unknown	0xf0a:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 0xfbf:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 0x1200:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83
5512.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0x8ce2:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
5512.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0x5925:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
5512.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_779e142f	unknown	unknown	0x6f0:$a: EC 8B 45 E8 83 E0 02 85 C0 74 07 C7 45 D8 30 00 00 00 8B 45 E8 83
5512.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_cf84c9f2	unknown	unknown	0x323:$a: 55 48 89 E5 48 83 EC 30 48 89 7D E8 89 75 E4 89 55 E0 C7 45 F8 01 00
5512.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_859042a0	unknown	unknown	0x332c:$a: 45 A8 48 83 C0 01 48 89 45 C0 EB 05 48 83 45 C0 01 48 8B 45 C0 0F
5512.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0x5c1b:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
5512.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_e4a1982b	unknown	unknown	0x317:$a: 8B 45 EC F7 D0 21 D0 33 45 FC C9 C3 55 48 89 E5 48 83 EC 30 48 89
Process Memory Space: hidakibest.x86.elf PID: 5511	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: hidakibest.x86.elf PID: 5511	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x3790:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x37a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x37b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x37cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x37e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x37f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3808:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x381c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3830:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3844:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3858:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x386c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3880:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3894:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x38a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x38bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x38d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x38e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x38f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x390c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3920:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: hidakibest.x86.elf PID: 5511	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x3743:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x3bb5:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: hidakibest.x86.elf PID: 5512	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: hidakibest.x86.elf PID: 5512	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x3790:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x37a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x37b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x37cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x37e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x37f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3808:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x381c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3830:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3844:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3858:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x386c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3880:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3894:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x38a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x38bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x38d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x38e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x38f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x390c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3920:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: hidakibest.x86.elf PID: 5512	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x3743:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x3bb5:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Click to see the 33 entries

Suricata Signatures

ETPRO MALWARE ELF/Mirai Variant CnC Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-22T16:01:49.632718+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40080	185.216.71.152	4258	TCP
2024-12-22T16:01:51.048407+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40082	185.216.71.152	4258	TCP
2024-12-22T16:01:52.346879+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40084	185.216.71.152	4258	TCP
2024-12-22T16:01:53.748559+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40086	185.216.71.152	4258	TCP
2024-12-22T16:01:55.054006+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40088	185.216.71.152	4258	TCP
2024-12-22T16:01:56.425320+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40090	185.216.71.152	4258	TCP
2024-12-22T16:01:57.738775+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40092	185.216.71.152	4258	TCP
2024-12-22T16:01:59.023455+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40094	185.216.71.152	4258	TCP
2024-12-22T16:02:00.334599+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40096	185.216.71.152	4258	TCP
2024-12-22T16:02:01.728305+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40098	185.216.71.152	4258	TCP
2024-12-22T16:02:06.013122+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40100	185.216.71.152	4258	TCP
2024-12-22T16:02:07.305566+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40102	185.216.71.152	4258	TCP
2024-12-22T16:02:08.594028+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40104	185.216.71.152	4258	TCP
2024-12-22T16:02:10.035379+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40106	185.216.71.152	4258	TCP
2024-12-22T16:02:14.402679+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40108	185.216.71.152	4258	TCP
2024-12-22T16:02:15.786294+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40110	185.216.71.152	4258	TCP
2024-12-22T16:02:17.065021+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40112	185.216.71.152	4258	TCP
2024-12-22T16:02:18.345001+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40114	185.216.71.152	4258	TCP
2024-12-22T16:02:19.618033+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40116	185.216.71.152	4258	TCP
2024-12-22T16:02:20.913416+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40118	185.216.71.152	4258	TCP
2024-12-22T16:02:22.200367+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40120	185.216.71.152	4258	TCP
2024-12-22T16:02:23.495954+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40122	185.216.71.152	4258	TCP
2024-12-22T16:02:24.766335+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40124	185.216.71.152	4258	TCP
2024-12-22T16:02:26.065161+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40126	185.216.71.152	4258	TCP
2024-12-22T16:02:27.342565+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40128	185.216.71.152	4258	TCP
2024-12-22T16:02:28.628761+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40130	185.216.71.152	4258	TCP
2024-12-22T16:02:29.913656+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40132	185.216.71.152	4258	TCP
2024-12-22T16:02:31.212950+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40134	185.216.71.152	4258	TCP
2024-12-22T16:02:32.483293+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40136	185.216.71.152	4258	TCP
2024-12-22T16:02:33.857557+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40138	185.216.71.152	4258	TCP
2024-12-22T16:02:35.158313+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40140	185.216.71.152	4258	TCP
2024-12-22T16:02:36.458912+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40142	185.216.71.152	4258	TCP
2024-12-22T16:02:37.730644+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40144	185.216.71.152	4258	TCP
2024-12-22T16:02:39.008822+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40146	185.216.71.152	4258	TCP
2024-12-22T16:02:40.288516+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40148	185.216.71.152	4258	TCP
2024-12-22T16:02:41.577548+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40150	185.216.71.152	4258	TCP
2024-12-22T16:02:42.892204+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40152	185.216.71.152	4258	TCP
2024-12-22T16:02:44.172311+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40154	185.216.71.152	4258	TCP
2024-12-22T16:02:45.469612+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40156	185.216.71.152	4258	TCP
2024-12-22T16:02:46.769824+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40158	185.216.71.152	4258	TCP
2024-12-22T16:02:48.067839+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40160	185.216.71.152	4258	TCP
2024-12-22T16:02:49.343720+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40162	185.216.71.152	4258	TCP
2024-12-22T16:02:50.635745+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40164	185.216.71.152	4258	TCP
2024-12-22T16:02:51.929405+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40166	185.216.71.152	4258	TCP
2024-12-22T16:02:53.204865+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40168	185.216.71.152	4258	TCP
2024-12-22T16:02:54.479561+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40170	185.216.71.152	4258	TCP
2024-12-22T16:02:55.811001+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40172	185.216.71.152	4258	TCP
2024-12-22T16:02:57.128836+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40174	185.216.71.152	4258	TCP
2024-12-22T16:02:58.408282+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40176	185.216.71.152	4258	TCP
2024-12-22T16:02:59.762257+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40178	185.216.71.152	4258	TCP
2024-12-22T16:03:01.092709+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40180	185.216.71.152	4258	TCP
2024-12-22T16:03:02.378310+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40182	185.216.71.152	4258	TCP
2024-12-22T16:03:03.696757+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40184	185.216.71.152	4258	TCP
2024-12-22T16:03:05.234030+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40186	185.216.71.152	4258	TCP
2024-12-22T16:03:06.547784+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40188	185.216.71.152	4258	TCP
2024-12-22T16:03:07.828436+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40190	185.216.71.152	4258	TCP
2024-12-22T16:03:09.114381+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40192	185.216.71.152	4258	TCP
2024-12-22T16:03:10.411572+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40194	185.216.71.152	4258	TCP
2024-12-22T16:03:11.678351+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40196	185.216.71.152	4258	TCP
2024-12-22T16:03:12.950892+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40198	185.216.71.152	4258	TCP
2024-12-22T16:03:14.246008+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40200	185.216.71.152	4258	TCP
2024-12-22T16:03:15.536132+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40202	185.216.71.152	4258	TCP
2024-12-22T16:03:16.867073+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40204	185.216.71.152	4258	TCP
2024-12-22T16:03:18.163944+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40206	185.216.71.152	4258	TCP
2024-12-22T16:03:19.499174+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40208	185.216.71.152	4258	TCP
2024-12-22T16:03:20.824895+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40210	185.216.71.152	4258	TCP
2024-12-22T16:03:22.093614+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40212	185.216.71.152	4258	TCP
2024-12-22T16:03:23.378548+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40214	185.216.71.152	4258	TCP
2024-12-22T16:03:24.665118+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40216	185.216.71.152	4258	TCP
2024-12-22T16:03:25.963331+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40218	185.216.71.152	4258	TCP
2024-12-22T16:03:27.265153+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40220	185.216.71.152	4258	TCP
2024-12-22T16:03:28.551465+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40222	185.216.71.152	4258	TCP
2024-12-22T16:03:29.826086+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40224	185.216.71.152	4258	TCP
2024-12-22T16:03:31.099926+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40226	185.216.71.152	4258	TCP
2024-12-22T16:03:32.376088+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40228	185.216.71.152	4258	TCP
2024-12-22T16:03:33.658160+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40230	185.216.71.152	4258	TCP
2024-12-22T16:03:34.949536+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40232	185.216.71.152	4258	TCP
2024-12-22T16:03:36.270744+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40234	185.216.71.152	4258	TCP
2024-12-22T16:03:37.557603+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40236	185.216.71.152	4258	TCP
2024-12-22T16:03:38.826726+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40238	185.216.71.152	4258	TCP
2024-12-22T16:03:40.117028+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40240	185.216.71.152	4258	TCP
2024-12-22T16:03:41.402351+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40242	185.216.71.152	4258	TCP
2024-12-22T16:03:42.672803+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40244	185.216.71.152	4258	TCP
2024-12-22T16:03:43.984218+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40246	185.216.71.152	4258	TCP
2024-12-22T16:03:45.267790+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40248	185.216.71.152	4258	TCP
2024-12-22T16:03:46.579720+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40250	185.216.71.152	4258	TCP
2024-12-22T16:03:47.877946+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40252	185.216.71.152	4258	TCP
2024-12-22T16:03:49.311819+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40254	185.216.71.152	4258	TCP
2024-12-22T16:03:50.619165+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40256	185.216.71.152	4258	TCP
2024-12-22T16:03:54.898343+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40258	185.216.71.152	4258	TCP
2024-12-22T16:03:56.343483+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40260	185.216.71.152	4258	TCP
2024-12-22T16:03:57.641019+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40262	185.216.71.152	4258	TCP
2024-12-22T16:04:02.053546+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40264	185.216.71.152	4258	TCP
2024-12-22T16:04:03.389695+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40266	185.216.71.152	4258	TCP
2024-12-22T16:04:04.993584+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40268	185.216.71.152	4258	TCP
2024-12-22T16:04:06.346216+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40270	185.216.71.152	4258	TCP
2024-12-22T16:04:07.650857+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40272	185.216.71.152	4258	TCP
2024-12-22T16:04:08.941576+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40274	185.216.71.152	4258	TCP
2024-12-22T16:04:10.570182+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40276	185.216.71.152	4258	TCP
2024-12-22T16:04:11.947795+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40278	185.216.71.152	4258	TCP
2024-12-22T16:04:13.247358+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40280	185.216.71.152	4258	TCP
2024-12-22T16:04:14.526975+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40282	185.216.71.152	4258	TCP
2024-12-22T16:04:15.796795+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40284	185.216.71.152	4258	TCP
2024-12-22T16:04:17.254331+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40286	185.216.71.152	4258	TCP
2024-12-22T16:04:18.645848+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40288	185.216.71.152	4258	TCP
2024-12-22T16:04:20.007428+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40290	185.216.71.152	4258	TCP
2024-12-22T16:04:21.345387+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40292	185.216.71.152	4258	TCP
2024-12-22T16:04:22.615979+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40294	185.216.71.152	4258	TCP
2024-12-22T16:04:23.898790+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40296	185.216.71.152	4258	TCP
2024-12-22T16:04:25.185532+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40298	185.216.71.152	4258	TCP
2024-12-22T16:04:26.467260+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40300	185.216.71.152	4258	TCP
2024-12-22T16:04:27.766575+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40302	185.216.71.152	4258	TCP
2024-12-22T16:04:29.056450+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40304	185.216.71.152	4258	TCP
2024-12-22T16:04:30.338329+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40306	185.216.71.152	4258	TCP
2024-12-22T16:04:31.625341+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40308	185.216.71.152	4258	TCP
2024-12-22T16:04:32.925833+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40310	185.216.71.152	4258	TCP
2024-12-22T16:04:34.194398+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40314	185.216.71.152	4258	TCP
2024-12-22T16:04:35.474664+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40316	185.216.71.152	4258	TCP
2024-12-22T16:04:36.752599+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40318	185.216.71.152	4258	TCP
2024-12-22T16:04:38.030777+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40320	185.216.71.152	4258	TCP
2024-12-22T16:04:39.319461+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40322	185.216.71.152	4258	TCP
2024-12-22T16:04:40.602833+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40324	185.216.71.152	4258	TCP
2024-12-22T16:04:41.891497+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40326	185.216.71.152	4258	TCP
2024-12-22T16:04:43.171866+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40328	185.216.71.152	4258	TCP
2024-12-22T16:04:44.458482+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40330	185.216.71.152	4258	TCP
2024-12-22T16:04:45.741128+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40332	185.216.71.152	4258	TCP
2024-12-22T16:04:47.036711+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40334	185.216.71.152	4258	TCP
2024-12-22T16:04:48.330668+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40336	185.216.71.152	4258	TCP
2024-12-22T16:04:49.637036+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40338	185.216.71.152	4258	TCP
2024-12-22T16:04:50.917716+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40340	185.216.71.152	4258	TCP
2024-12-22T16:04:52.217575+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40342	185.216.71.152	4258	TCP
2024-12-22T16:04:53.537149+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40344	185.216.71.152	4258	TCP
2024-12-22T16:04:54.824682+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40346	185.216.71.152	4258	TCP
2024-12-22T16:04:56.136902+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40348	185.216.71.152	4258	TCP
2024-12-22T16:04:57.426142+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40350	185.216.71.152	4258	TCP
2024-12-22T16:04:58.738597+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40352	185.216.71.152	4258	TCP
2024-12-22T16:05:00.005590+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40354	185.216.71.152	4258	TCP
2024-12-22T16:05:01.280758+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40356	185.216.71.152	4258	TCP
2024-12-22T16:05:02.565690+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40358	185.216.71.152	4258	TCP
2024-12-22T16:05:03.856444+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40360	185.216.71.152	4258	TCP
2024-12-22T16:05:05.143490+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40362	185.216.71.152	4258	TCP
2024-12-22T16:05:06.422326+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40364	185.216.71.152	4258	TCP
2024-12-22T16:05:07.721750+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40366	185.216.71.152	4258	TCP
2024-12-22T16:05:09.019487+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40368	185.216.71.152	4258	TCP
2024-12-22T16:05:10.313228+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40370	185.216.71.152	4258	TCP
2024-12-22T16:05:11.599753+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40372	185.216.71.152	4258	TCP
2024-12-22T16:05:12.883833+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40374	185.216.71.152	4258	TCP
2024-12-22T16:05:14.170592+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40376	185.216.71.152	4258	TCP
2024-12-22T16:05:15.439358+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40378	185.216.71.152	4258	TCP
2024-12-22T16:05:16.715338+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40380	185.216.71.152	4258	TCP
2024-12-22T16:05:17.991406+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40382	185.216.71.152	4258	TCP
2024-12-22T16:05:19.368800+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40384	185.216.71.152	4258	TCP
2024-12-22T16:05:20.642505+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40386	185.216.71.152	4258	TCP
2024-12-22T16:05:22.047466+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40388	185.216.71.152	4258	TCP
2024-12-22T16:05:23.395243+0100	2843713	1	A Network Trojan was detected	192.168.2.13	40390	185.216.71.152	4258	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: hidakibest.x86.elf

Avira: detected

Found malware configuration

Source: hidakibest.x86.elf

Malware Configuration Extractor: Gafgyt {"C2 url": "185.216.71.152:4258"}

Multi AV Scanner detection for submitted file

Source: hidakibest.x86.elf	ReversingLabs: Detection: 60%
Source: hidakibest.x86.elf	Virustotal: Detection: 50%			Perma Link

Machine Learning detection for sample

Source: hidakibest.x86.elf

Joe Sandbox ML: detected

Spreading

Opens /proc/net/* files useful for finding connected devices and routers

Source: /tmp/hidakibest.x86.elf (PID: 5511)

Opens: /proc/net/route

Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40086 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40080 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40092 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40094 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40098 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40082 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40084 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40112 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40090 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40114 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40120 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40096 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40102 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40126 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40124 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40088 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40122 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40110 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40138 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40142 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40116 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40104 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40100 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40128 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40118 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40146 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40144 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40130 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40132 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40134 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40140 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40106 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40158 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40152 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40166 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40164 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40150 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40174 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40108 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40160 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40184 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40180 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40190 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40178 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40194 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40196 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40156 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40198 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40148 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40200 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40186 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40204 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40208 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40210 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40202 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40212 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40216 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40220 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40218 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40222 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40136 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40224 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40172 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40176 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40162 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40228 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40240 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40230 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40188 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40248 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40250 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40242 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40252 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40170 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40168 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40246 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40244 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40154 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40256 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40182 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40238 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40262 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40254 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40258 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40266 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40232 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40192 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40270 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40268 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40264 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40236 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40272 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40280 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40276 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40274 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40214 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40284 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40278 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40286 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40206 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40234 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40226 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40260 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40290 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40288 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40294 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40292 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40296 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40298 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40282 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40300 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40304 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40302 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40308 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40310 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40316 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40306 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40314 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40320 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40322 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40326 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40324 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40328 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40330 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40332 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40336 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40338 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40340 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40342 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40318 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40334 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40344 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40346 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40348 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40350 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40352 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40354 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40356 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40358 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40366 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40364 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40368 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40362 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40372 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40374 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40360 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40376 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40380 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40378 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40384 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40388 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40386 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40390 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40382 -> 185.216.71.152:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:40370 -> 185.216.71.152:4258

Source: global traffic

TCP traffic: 192.168.2.13:40080 -> 185.216.71.152:4258

Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.152

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

Source: hidakibest.x86.elf	String found in binary or memory: http://fast.no/support/crawler.asp)
Source: hidakibest.x86.elf	String found in binary or memory: http://feedback.redkolibri.com/
Source: hidakibest.x86.elf	String found in binary or memory: http://www.baidu.com/search/spider.htm)
Source: hidakibest.x86.elf	String found in binary or memory: http://www.baidu.com/search/spider.html)
Source: hidakibest.x86.elf	String found in binary or memory: http://www.billybobbot.com/crawler/)

System Summary

Malicious sample detected (through community Yara rule)

Source: hidakibest.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: hidakibest.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 Author: unknown
Source: hidakibest.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: hidakibest.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 Author: unknown
Source: hidakibest.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: hidakibest.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: hidakibest.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_09c3070e Author: unknown
Source: hidakibest.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: hidakibest.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: hidakibest.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_779e142f Author: unknown
Source: hidakibest.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_cf84c9f2 Author: unknown
Source: hidakibest.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_859042a0 Author: unknown
Source: hidakibest.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: hidakibest.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_e4a1982b Author: unknown
Source: 5511.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5511.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 Author: unknown
Source: 5511.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 5511.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 Author: unknown
Source: 5511.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5511.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 5511.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_09c3070e Author: unknown
Source: 5511.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 5511.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 5511.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_779e142f Author: unknown
Source: 5511.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_cf84c9f2 Author: unknown
Source: 5511.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_859042a0 Author: unknown
Source: 5511.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 5511.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_e4a1982b Author: unknown
Source: 5512.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5512.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 Author: unknown
Source: 5512.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 5512.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 Author: unknown
Source: 5512.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5512.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 5512.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_09c3070e Author: unknown
Source: 5512.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 5512.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 5512.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_779e142f Author: unknown
Source: 5512.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_cf84c9f2 Author: unknown
Source: 5512.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_859042a0 Author: unknown
Source: 5512.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 5512.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_e4a1982b Author: unknown
Source: Process Memory Space: hidakibest.x86.elf PID: 5511, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: hidakibest.x86.elf PID: 5511, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: hidakibest.x86.elf PID: 5512, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: hidakibest.x86.elf PID: 5512, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown

Source: hidakibest.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: hidakibest.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = cdd0bb9ce40a000bb86b0c76616fe71fb7dbb87a044ddd778b7a07fdf804b877, id = a6a2adb9-9d54-42d4-abed-5b30d8062e97, last_modified = 2021-09-16
Source: hidakibest.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: hidakibest.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 1c5df68501b688905484ed47dc588306828aa7c114644428e22e5021bb39bd4a, id = f3d83a74-2888-435a-9a3c-b7de25084e9a, last_modified = 2021-09-16
Source: hidakibest.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: hidakibest.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: hidakibest.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_09c3070e reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 84fad96b60b297736c149e14de12671ff778bff427ab7684df2c541a6f6d7e7d, id = 09c3070e-4b71-45a0-aa62-0cc6e496644a, last_modified = 2021-09-16
Source: hidakibest.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: hidakibest.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: hidakibest.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_779e142f reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 83377b6fa77fda4544c409487d2d2c1ddcef8f7d4120f49a18888c7536f3969f, id = 779e142f-b867-46e6-b1fb-9105976f42fd, last_modified = 2021-09-16
Source: hidakibest.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_cf84c9f2 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = bb766b356c3e8706740e3bb9b4a7171d8eb5137e09fc7ab6952412fa55e2dcfc, id = cf84c9f2-7435-4faf-8c5f-d14945ffad7a, last_modified = 2021-09-16
Source: hidakibest.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_859042a0 reference_sample = 41615d3f3f27f04669166fdee3996d77890016304ee87851a5f90804d6d4a0b0, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a27bcaa16edceda3dc5a80803372c907a7efd00736c7859c5a9d6a2cf56a8eec, id = 859042a0-a424-4c83-944b-ed182b342998, last_modified = 2021-09-16
Source: hidakibest.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: hidakibest.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_e4a1982b os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d9f852c28433128b0fd330bee35f7bd4aada5226e9ca865fe5cd8cca52b2a622, id = e4a1982b-928a-4da5-b497-cedc1d26e845, last_modified = 2021-09-16
Source: 5511.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5511.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = cdd0bb9ce40a000bb86b0c76616fe71fb7dbb87a044ddd778b7a07fdf804b877, id = a6a2adb9-9d54-42d4-abed-5b30d8062e97, last_modified = 2021-09-16
Source: 5511.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 5511.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 1c5df68501b688905484ed47dc588306828aa7c114644428e22e5021bb39bd4a, id = f3d83a74-2888-435a-9a3c-b7de25084e9a, last_modified = 2021-09-16
Source: 5511.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5511.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 5511.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_09c3070e reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 84fad96b60b297736c149e14de12671ff778bff427ab7684df2c541a6f6d7e7d, id = 09c3070e-4b71-45a0-aa62-0cc6e496644a, last_modified = 2021-09-16
Source: 5511.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 5511.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 5511.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_779e142f reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 83377b6fa77fda4544c409487d2d2c1ddcef8f7d4120f49a18888c7536f3969f, id = 779e142f-b867-46e6-b1fb-9105976f42fd, last_modified = 2021-09-16
Source: 5511.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_cf84c9f2 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = bb766b356c3e8706740e3bb9b4a7171d8eb5137e09fc7ab6952412fa55e2dcfc, id = cf84c9f2-7435-4faf-8c5f-d14945ffad7a, last_modified = 2021-09-16
Source: 5511.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_859042a0 reference_sample = 41615d3f3f27f04669166fdee3996d77890016304ee87851a5f90804d6d4a0b0, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a27bcaa16edceda3dc5a80803372c907a7efd00736c7859c5a9d6a2cf56a8eec, id = 859042a0-a424-4c83-944b-ed182b342998, last_modified = 2021-09-16
Source: 5511.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 5511.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_e4a1982b os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d9f852c28433128b0fd330bee35f7bd4aada5226e9ca865fe5cd8cca52b2a622, id = e4a1982b-928a-4da5-b497-cedc1d26e845, last_modified = 2021-09-16
Source: 5512.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5512.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = cdd0bb9ce40a000bb86b0c76616fe71fb7dbb87a044ddd778b7a07fdf804b877, id = a6a2adb9-9d54-42d4-abed-5b30d8062e97, last_modified = 2021-09-16
Source: 5512.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 5512.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 1c5df68501b688905484ed47dc588306828aa7c114644428e22e5021bb39bd4a, id = f3d83a74-2888-435a-9a3c-b7de25084e9a, last_modified = 2021-09-16
Source: 5512.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5512.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 5512.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_09c3070e reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 84fad96b60b297736c149e14de12671ff778bff427ab7684df2c541a6f6d7e7d, id = 09c3070e-4b71-45a0-aa62-0cc6e496644a, last_modified = 2021-09-16
Source: 5512.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 5512.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 5512.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_779e142f reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 83377b6fa77fda4544c409487d2d2c1ddcef8f7d4120f49a18888c7536f3969f, id = 779e142f-b867-46e6-b1fb-9105976f42fd, last_modified = 2021-09-16
Source: 5512.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_cf84c9f2 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = bb766b356c3e8706740e3bb9b4a7171d8eb5137e09fc7ab6952412fa55e2dcfc, id = cf84c9f2-7435-4faf-8c5f-d14945ffad7a, last_modified = 2021-09-16
Source: 5512.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_859042a0 reference_sample = 41615d3f3f27f04669166fdee3996d77890016304ee87851a5f90804d6d4a0b0, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a27bcaa16edceda3dc5a80803372c907a7efd00736c7859c5a9d6a2cf56a8eec, id = 859042a0-a424-4c83-944b-ed182b342998, last_modified = 2021-09-16
Source: 5512.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 5512.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_e4a1982b os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d9f852c28433128b0fd330bee35f7bd4aada5226e9ca865fe5cd8cca52b2a622, id = e4a1982b-928a-4da5-b497-cedc1d26e845, last_modified = 2021-09-16
Source: Process Memory Space: hidakibest.x86.elf PID: 5511, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: hidakibest.x86.elf PID: 5511, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: hidakibest.x86.elf PID: 5512, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: hidakibest.x86.elf PID: 5512, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.spre.troj.linELF@0/0@2/0

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match	File source: hidakibest.x86.elf, type: SAMPLE
Source: Yara match	File source: 5511.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5512.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY

Yara detected Mirai

Source: Yara match	File source: hidakibest.x86.elf, type: SAMPLE
Source: Yara match	File source: 5511.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5512.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: hidakibest.x86.elf PID: 5511, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: hidakibest.x86.elf PID: 5512, type: MEMORYSTR

Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36
Source: Initial sample	User agent string found: Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; rv:2.2) Gecko/20110201
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.2; U; ru) Presto/2.5.22 Version/10.51
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko
Source: Initial sample	User agent string found: Mozilla/5.0 (Android; Linux armv7l; rv:9.0) Gecko/20111216 Firefox/9.0 Fennec/9.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60
Source: Initial sample	User agent string found: Mozilla/5.0 (iPad; U; CPU OS 5_1 like Mac OS X) AppleWebKit/531.21.10 (KHTML, like Gecko) Version/4.0.4 Mobile/7B367 Safari/531.21.10 UCBrowser/3.4.3.532
Source: Initial sample	User agent string found: Mozilla/5.0 (Nintendo WiiU) AppleWebKit/536.30 (KHTML, like Gecko) NX/3.0.4.2.12 NintendoBrowser/4.3.1.11264.US
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:25.0) Gecko/20100101 Firefox/25.0
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; pl) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; en) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; ja) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; cn) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; fr) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20100101 Firefox/12.0
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; U; Linux x86_64; de; rv:1.9.2.8) Gecko/20100723 Ubuntu/10.04 (lucid) Firefox/3.6.8
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; rv:13.0) Gecko/20100101 Firefox/13.0.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:11.0) Gecko/20100101 Firefox/11.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:13.0) Gecko/20100101 Firefox/13.0.1
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.289 Version/12.01
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.02
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.0) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.112 Safari/535.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36

Remote Access Functionality

Detected Mirai

Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin

Yara detected Gafgyt

Source: Yara match	File source: hidakibest.x86.elf, type: SAMPLE
Source: Yara match	File source: 5511.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5512.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY

Yara detected Mirai

Source: Yara match	File source: hidakibest.x86.elf, type: SAMPLE
Source: Yara match	File source: 5511.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5512.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: hidakibest.x86.elf PID: 5511, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: hidakibest.x86.elf PID: 5512, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	OS Credential Dumping	1 Remote System Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

Threatname: Gafgyt

{"C2 url": "185.216.71.152:4258"}

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
hidakibest.x86.elf	61%	ReversingLabs	Linux.Trojan.Mirai
hidakibest.x86.elf	50%	Virustotal		Browse
hidakibest.x86.elf	100%	Avira	EXP/ELF.Mirai.Z.A
hidakibest.x86.elf	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.25	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
185.216.71.152:4258	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://www.baidu.com/search/spider.html)	hidakibest.x86.elf	false	high
http://www.billybobbot.com/crawler/)	hidakibest.x86.elf	false	unknown
http://fast.no/support/crawler.asp)	hidakibest.x86.elf	false	unknown
http://feedback.redkolibri.com/	hidakibest.x86.elf	false	unknown
http://www.baidu.com/search/spider.htm)	hidakibest.x86.elf	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.216.71.152	unknown	Germany		43659	CLOUDCOMPUTINGDE	true

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
185.216.71.152	hidakibest.arm4.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	hidakibest.mpsl.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	hidakibest.arm7.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	hidakibest.sparc.elf	Get hash	malicious	Gafgyt, Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	hidakibest.mpsl.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	hidakibest.arm7.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	hidakibest.sparc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.25
	Space.arm6.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	most-mpsl.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	arm.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	byte.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.25
	x86_64.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.24
	m68k.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.24
	vlxx.arm6.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.25

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDCOMPUTINGDE	hidakibest.arm4.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.216.71.152
	hidakibest.mpsl.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.216.71.152
	hidakibest.arm7.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.216.71.152
	hidakibest.sparc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.216.71.152
	https://www.google.gr/url?url=https://pniuvlpkjqhdwff&exox=rvhqtix&eaydny=ysf&gzfds=lqrwiz&nci=qtwmzch&iccvb=yhwtsp&vtqs=avtajyu&oagvzgp=irlq&mvdoc=embwrj&yylmwei=tmn&mntt=qqcvuhkd&lkydbjfiod=izjcgyubqc&q=amp/anre6g6.j%c2%adh%c2%adhn%c2%adt%c2%addd%c2%adsm%c2%ado%c2%admcw%c2%adw%c2%adgu%c2%adno.com%e2%80%8b/99twfh3p8&gcyx=ncgobia&yfevoul=wtloixvv&hukl=qfkmtky&nlhwnbr=bwkoiopy&eqfw=bmcpntp&vlvegw=zdbpajeyq&ghrv=kcdfwrl&kyddme=myxsnvtxf&asco=mgumegd&dvvibf=hzfexefeg&osme=bdyguyp&njtjvd=bkelfwmxg&bxrb=ltpyjsv&girpat=lswjchrwc&qapj=wwwowde&vahefc=ghseyzgyf&ahaj=zfqmkuo&pfsfeu=ttucmtamu&sffs=oxaajjo&hbwhgy=mgfzglmmo&bdwl=oifsufx&befsmv=jskhtmnps&sfjy=powmsnr&zixjqp=jyttdwbmu&fzkp=hztiqjm&jmzuvc=ufyoeqgfi&zujr=jxtbdtg&plvxoh=fxumxxddw&nkin=ykbzrdh&lghzli=agvbttfta&suag=ioudcjc&zpptpx=dxacgdnox&hmfz=yueoymp&fnshpz=wgayslegy&gjtg=qcjjozv&rymask=thcxzfpca&zcgn=ywtonnx&kqrpog=kgfvcqswk&imwa=wlvocxf&ggqznt=budaflbgp&zjhr=zscgach&esrhmq=qjdngljnl&ppoz=nhwzlik&zejsqg=vnvpaymyl&dnqb=kjswpyt&kunwbg=pzauoqliz&bqlz=qabnsnu&dlfnsr=dakxdfzen&uffg=uwnswdr&ywjevz=bnvkfavcb&rrob=celdmvn&czdusr=sjfjazfqw&ipgr=exylggn&fltcvh=sdfsricvf&byfs=apntxot&javhwh=nyphchiee&owbh=haflpez&mbyvqw=pdzpxeedx&ejov=taakkyw&oylsfz=qnzuplrnz&hxrq=ovegslq&duqjcc=pjwdpyvec&uoec=pjouxrb&eiezwk=okbkttiao&knji=kcmfaqe&qmathj=vymnqrvxa&gajs=riewukz&czxhiu=uysriqpma&avwe=gssbenk&jnwgpb=iqkroelwx&sjyt=zhxfzpx&liqoqs=bbajxgpxm&dqqu=ztzooam&haagcu=gkijlwgjy&mnsq=uervedi&yckhpb=ngqrbrqpc&pkne=nwisdfz&eqsiqu=mlrhvpuav	Get hash	malicious	Unknown	Browse	85.31.47.165
	6G4au3vWsI.lnk	Get hash	malicious	Unknown	Browse	80.76.51.231
	tegga.hta	Get hash	malicious	Xmrig	Browse	185.216.68.189
	KzHndnydSG.dll	Get hash	malicious	CobaltStrike	Browse	185.216.71.202
	bot.sh4.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	80.76.51.45
	bot.arm.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	80.76.51.45

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, not stripped
Entropy (8bit):	5.870943191415174
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	hidakibest.x86.elf
File size:	108'630 bytes
MD5:	589d6374c72c1721be71a3a5e3de4a09
SHA1:	e3dea83cde3691800e8751c9e5d7730761eeec6e
SHA256:	aad6878d2aa36a8eb4f95279b6ffea26d83b53df9e27f921b83a986a819d041e
SHA512:	473015e18b1c8c70bfaeb4b156df9b4299ef529877eeb329f00cafe34a4c7fd96d83e00e007baa79712d255ea5182da4e74d31ca084de3fa0df55411ae1aa40b
SSDEEP:	3072:j6dye4BmJQqphaZw/1vc45AzkSXmdRWaLHgb4:dqphaZcErmdRWaDgb4
TLSH:	6EB35C07DA21807AC09B43B21BDF96219D23B4FD1772310B33E5AEE4AF095859F9D786
File Content Preview:	.ELF..............>.......@.....@........>..........@.8...@.......................@.......@...../......./......... .............0.......0.a.....0.a.....8)......8......... .....Q.td....................................................H...._........H........

Static ELF Info

ELF header
Class:	ELF64
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Advanced Micro Devices X86-64
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x400194
Flags:	0x0
ELF Header Size:	64
Program Header Offset:	64
Program Header Size:	56
Number of Program Headers:	3
Section Header Offset:	81648
Section Header Size:	64
Number of Section Headers:	15
Header String Table Index:	12

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x4000e8	0xe8	0x13	0x0	0x6	AX	0	0	1
.text	PROGBITS	0x400100	0x100	0xbde4	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x40bee4	0xbee4	0xe	0x0	0x6	AX	0	0	1
.rodata	PROGBITS	0x40bf00	0xbf00	0x4b2f	0x0	0x2	A	0	0	32
.eh_frame	PROGBITS	0x610a30	0x10a30	0x22fc	0x0	0x3	WA	0	0	8
.ctors	PROGBITS	0x612d30	0x12d30	0x10	0x0	0x3	WA	0	0	8
.dtors	PROGBITS	0x612d40	0x12d40	0x10	0x0	0x3	WA	0	0	8
.jcr	PROGBITS	0x612d50	0x12d50	0x8	0x0	0x3	WA	0	0	8
.data	PROGBITS	0x612d60	0x12d60	0x608	0x0	0x3	WA	0	0	32
.bss	NOBITS	0x613380	0x13368	0x6ae8	0x0	0x3	WA	0	0	32
.comment	PROGBITS	0x0	0x13368	0xb1c	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x13e84	0x66	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x142b0	0x4380	0x18	0x0		14	249	8
.strtab	STRTAB	0x0	0x18630	0x2226	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x10a2f	0x10a2f	6.3958	0x5	R E	0x200000	.init .text .fini .rodata
LOAD	0x10a30	0x610a30	0x610a30	0x2938	0x9438	3.5672	0x6	RW	0x200000	.eh_frame .ctors .dtors .jcr .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x8

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x4000e8	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x400100	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x40bee4	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x40bf00	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x610a30	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x612d30	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x612d40	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x612d50	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x612d60	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x613380	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	11
C.1.3849	.symtab	0x410820	40	OBJECT	<unknown>	DEFAULT	4
C.53.5637	.symtab	0x40d620	208	OBJECT	<unknown>	DEFAULT	4
C.60.5739	.symtab	0x40e140	2256	OBJECT	<unknown>	DEFAULT	4
Q	.symtab	0x613400	16384	OBJECT	<unknown>	DEFAULT	10
Randhex	.symtab	0x401841	385	FUNC	<unknown>	DEFAULT	2
SendSTD	.symtab	0x4014b4	405	FUNC	<unknown>	DEFAULT	2
UDPRAW	.symtab	0x401745	252	FUNC	<unknown>	DEFAULT	2
_Exit	.symtab	0x403630	43	FUNC	<unknown>	DEFAULT	2
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x612d38	0	OBJECT	<unknown>	DEFAULT	6
__CTOR_LIST__	.symtab	0x612d30	0	OBJECT	<unknown>	DEFAULT	6
__C_ctype_b	.symtab	0x612f88	8	OBJECT	<unknown>	DEFAULT	9
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x40eab0	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x613350	8	OBJECT	<unknown>	DEFAULT	9
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x410520	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x612f98	8	OBJECT	<unknown>	DEFAULT	9
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x40edb0	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x612d48	0	OBJECT	<unknown>	DEFAULT	7
__DTOR_LIST__	.symtab	0x612d40	0	OBJECT	<unknown>	DEFAULT	7
__EH_FRAME_BEGIN__	.symtab	0x610a30	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x612d28	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x612f88	8	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_tolower	.symtab	0x613350	8	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_toupper	.symtab	0x612f98	8	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_b	.symtab	0x612f90	8	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_tolower	.symtab	0x613358	8	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_toupper	.symtab	0x612fa0	8	OBJECT	<unknown>	HIDDEN	9
__GI___errno_location	.symtab	0x4038cc	6	FUNC	<unknown>	HIDDEN	2
__GI___fcntl_nocancel	.symtab	0x4035cc	100	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x408a14	222	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x4051d4	14	FUNC	<unknown>	HIDDEN	2
__GI___h_errno_location	.symtab	0x407604	6	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x403568	100	FUNC	<unknown>	HIDDEN	2
__GI___sigaddset	.symtab	0x405678	28	FUNC	<unknown>	HIDDEN	2
__GI___sigdelset	.symtab	0x405694	30	FUNC	<unknown>	HIDDEN	2
__GI___sigismember	.symtab	0x405658	32	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x406df4	70	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x406e6f	58	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x4051e4	196	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x403630	43	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x4063bc	200	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x406860	18	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x409b34	43	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0x40365c	38	FUNC	<unknown>	HIDDEN	2
__GI_clock_getres	.symtab	0x407190	41	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x403684	41	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0x407338	147	FUNC	<unknown>	HIDDEN	2
__GI_config_close	.symtab	0x4078ce	43	FUNC	<unknown>	HIDDEN	2
__GI_config_open	.symtab	0x4078f9	46	FUNC	<unknown>	HIDDEN	2
__GI_config_read	.symtab	0x40760c	706	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x405464	43	FUNC	<unknown>	HIDDEN	2
__GI_errno	.symtab	0x619658	4	OBJECT	<unknown>	HIDDEN	10
__GI_exit	.symtab	0x4069d4	95	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x4079f8	269	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x403568	100	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x4088d0	322	FUNC	<unknown>	HIDDEN	2
__GI_fgetc	.symtab	0x408704	128	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x408a14	222	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x408784	116	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x408af4	116	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x407b08	10	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x4036b0	38	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x4049c8	56	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x409f04	5	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x409f0c	225	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x409b60	82	FUNC	<unknown>	HIDDEN	2
__GI_fstat64	.symtab	0x409b60	82	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x404a00	128	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x408a14	222	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x4071bc	36	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x4071e0	8	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x4071e8	8	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x4071f0	8	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname	.symtab	0x405414	10	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2	.symtab	0x405420	65	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2_r	.symtab	0x4093a4	761	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x40b5b0	802	FUNC	<unknown>	HIDDEN	2
__GI_gethostname	.symtab	0x40b8d4	94	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x4071f8	19	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x4036d8	8	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x40720c	40	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x405490	41	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x407234	8	FUNC	<unknown>	HIDDEN	2
__GI_h_errno	.symtab	0x61965c	4	OBJECT	<unknown>	HIDDEN	10
__GI_htonl	.symtab	0x405388	5	FUNC	<unknown>	HIDDEN	2
__GI_htons	.symtab	0x405380	8	FUNC	<unknown>	HIDDEN	2
__GI_inet_addr	.symtab	0x4053f4	29	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x40931c	135	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa	.symtab	0x4053e9	10	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa_r	.symtab	0x40539c	77	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x40a68f	518	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x40a3af	493	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x4067a4	185	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x4036e0	101	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x4052f4	25	FUNC	<unknown>	HIDDEN	2
__GI_isspace	.symtab	0x403898	18	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x403748	44	FUNC	<unknown>	HIDDEN	2
__GI_lseek	.symtab	0x40bdd4	45	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x40b9d8	5	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x408ce0	236	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x404b60	102	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x408dcc	702	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x408b70	90	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x40908c	233	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x404bd0	210	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x407160	48	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x409bb4	42	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x40723c	38	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x407264	38	FUNC	<unknown>	HIDDEN	2
__GI_ntohl	.symtab	0x405395	5	FUNC	<unknown>	HIDDEN	2
__GI_ntohs	.symtab	0x40538d	8	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x403774	106	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0x407461	157	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x40b934	41	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x4096a0	18	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x406490	72	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x406693	90	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x40a1e4	189	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x4037e0	39	FUNC	<unknown>	HIDDEN	2
__GI_readdir64	.symtab	0x407574	143	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x4054f0	11	FUNC	<unknown>	HIDDEN	2
__GI_recvfrom	.symtab	0x4054fc	45	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x40728c	74	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x403808	44	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x40552c	11	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x405538	48	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x403834	38	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x405568	53	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x4065e8	171	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x4070ed	114	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x4055d0	133	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x4072d8	47	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x406a34	142	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x4055a0	47	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x4038d4	149	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x4066ed	183	FUNC	<unknown>	HIDDEN	2
__GI_stat	.symtab	0x40b960	79	FUNC	<unknown>	HIDDEN	2
__GI_stat64	.symtab	0x40b960	79	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x4052b8	48	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x404cb0	417	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul	.symtab	0x409178	268	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x404e54	33	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x404e54	33	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x404e80	213	FUNC	<unknown>	HIDDEN	2
__GI_strcspn	.symtab	0x408bd0	135	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x40b9e0	54	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x404f60	225	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x40a2a4	131	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x405044	201	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x40a158	140	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x409284	53	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x408c58	135	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x405110	193	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x4052e8	10	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x4092bc	94	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x406874	10	FUNC	<unknown>	HIDDEN	2
__GI_strtoll	.symtab	0x406874	10	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x406ba3	560	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x405310	110	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x40385c	8	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x4038ac	30	FUNC	<unknown>	HIDDEN	2
__GI_uname	.symtab	0x40b9b0	38	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x40396c	189	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x407308	47	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x403864	7	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x407928	68	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x40797c	123	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x40796c	15	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x40386c	42	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x612d50	0	OBJECT	<unknown>	DEFAULT	8
__JCR_LIST__	.symtab	0x612d50	0	OBJECT	<unknown>	DEFAULT	8
__app_fini	.symtab	0x619648	8	OBJECT	<unknown>	HIDDEN	10
__atexit_lock	.symtab	0x613310	40	OBJECT	<unknown>	DEFAULT	9
__bss_start	.symtab	0x613368	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x406e3a	53	FUNC	<unknown>	DEFAULT	2
__close_nameservers	.symtab	0x40b510	109	FUNC	<unknown>	HIDDEN	2
__ctype_b	.symtab	0x612f90	8	OBJECT	<unknown>	DEFAULT	9
__ctype_tolower	.symtab	0x613358	8	OBJECT	<unknown>	DEFAULT	9
__ctype_toupper	.symtab	0x612fa0	8	OBJECT	<unknown>	DEFAULT	9
__curbrk	.symtab	0x619660	8	OBJECT	<unknown>	HIDDEN	10
__data_start	.symtab	0x612d70	0	NOTYPE	<unknown>	DEFAULT	9
__decode_dotted	.symtab	0x40a898	280	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x40badc	156	FUNC	<unknown>	HIDDEN	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__dns_lookup	.symtab	0x40a9b0	1853	FUNC	<unknown>	HIDDEN	2
__do_global_ctors_aux	.symtab	0x40beb0	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x400100	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x612d60	0	OBJECT	<unknown>	HIDDEN	9
__encode_dotted	.symtab	0x40be04	162	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x40ba18	193	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x40bb78	80	FUNC	<unknown>	HIDDEN	2
__environ	.symtab	0x619638	8	OBJECT	<unknown>	DEFAULT	10
__errno_location	.symtab	0x4038cc	6	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x619628	8	OBJECT	<unknown>	HIDDEN	10
__fcntl_nocancel	.symtab	0x4035cc	100	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x408a14	222	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x612d2c	0	NOTYPE	<unknown>	HIDDEN	5
__fini_array_start	.symtab	0x612d2c	0	NOTYPE	<unknown>	HIDDEN	5
__get_hosts_byname_r	.symtab	0x40b580	48	FUNC	<unknown>	HIDDEN	2
__getdents	.symtab	0x409de4	288	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x409de4	288	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x4071f8	19	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x4051d4	14	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__h_errno_location	.symtab	0x407604	6	FUNC	<unknown>	DEFAULT	2
__h_errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__init_array_end	.symtab	0x612d2c	0	NOTYPE	<unknown>	HIDDEN	5
__init_array_start	.symtab	0x612d2c	0	NOTYPE	<unknown>	HIDDEN	5
__libc_close	.symtab	0x403684	41	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x405464	43	FUNC	<unknown>	DEFAULT	2
__libc_fcntl	.symtab	0x403568	100	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x4036b0	38	FUNC	<unknown>	DEFAULT	2
__libc_lseek	.symtab	0x40bdd4	45	FUNC	<unknown>	DEFAULT	2
__libc_lseek64	.symtab	0x40b9d8	5	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0x407264	38	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x403774	106	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x4037e0	39	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x4054f0	11	FUNC	<unknown>	DEFAULT	2
__libc_recvfrom	.symtab	0x4054fc	45	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x403808	44	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x40552c	11	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x405538	48	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x4070ed	114	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x619630	8	OBJECT	<unknown>	DEFAULT	10
__libc_waitpid	.symtab	0x403864	7	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x40386c	42	FUNC	<unknown>	DEFAULT	2
__local_nameserver	.symtab	0x410a10	16	OBJECT	<unknown>	HIDDEN	4
__malloc_consolidate	.symtab	0x406046	407	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x4056b4	110	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x6131d0	40	OBJECT	<unknown>	DEFAULT	9
__malloc_state	.symtab	0x619760	1752	OBJECT	<unknown>	DEFAULT	10
__malloc_trim	.symtab	0x405fb0	150	FUNC	<unknown>	DEFAULT	2
__nameserver	.symtab	0x619e58	8	OBJECT	<unknown>	HIDDEN	10
__nameservers	.symtab	0x619e60	4	OBJECT	<unknown>	HIDDEN	10
__open_etc_hosts	.symtab	0x40bbc8	10	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x40b145	968	FUNC	<unknown>	HIDDEN	2
__pagesize	.symtab	0x619640	8	OBJECT	<unknown>	DEFAULT	10
__preinit_array_end	.symtab	0x612d2c	0	NOTYPE	<unknown>	HIDDEN	5
__preinit_array_start	.symtab	0x612d2c	0	NOTYPE	<unknown>	HIDDEN	5
__progname	.symtab	0x613340	8	OBJECT	<unknown>	DEFAULT	9
__progname_full	.symtab	0x613348	8	OBJECT	<unknown>	DEFAULT	9
__pthread_initialize_minimal	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0x406dd7	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x406dd4	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x406dd4	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x406dd4	3	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x406dd4	3	FUNC	<unknown>	DEFAULT	2
__read_etc_hosts_r	.symtab	0x40bbd2	511	FUNC	<unknown>	HIDDEN	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__res_sync	.symtab	0x619e48	8	OBJECT	<unknown>	HIDDEN	10
__resolv_attempts	.symtab	0x613365	1	OBJECT	<unknown>	HIDDEN	9
__resolv_lock	.symtab	0x619670	40	OBJECT	<unknown>	DEFAULT	10
__resolv_timeout	.symtab	0x613364	1	OBJECT	<unknown>	HIDDEN	9
__restore_rt	.symtab	0x4070e4	0	NOTYPE	<unknown>	DEFAULT	2
__rtld_fini	.symtab	0x619650	8	OBJECT	<unknown>	HIDDEN	10
__searchdomain	.symtab	0x619e50	8	OBJECT	<unknown>	HIDDEN	10
__searchdomains	.symtab	0x619e64	4	OBJECT	<unknown>	HIDDEN	10
__sigaddset	.symtab	0x405678	28	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x405694	30	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x405658	32	FUNC	<unknown>	DEFAULT	2
__stdin	.symtab	0x612fc8	8	OBJECT	<unknown>	DEFAULT	9
__stdio_READ	.symtab	0x409ff0	58	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x407b14	171	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x40a02c	131	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x407df4	259	FUNC	<unknown>	HIDDEN	2
__stdio_init_mutex	.symtab	0x403a8b	15	FUNC	<unknown>	HIDDEN	2
__stdio_mutex_initializer.4920	.symtab	0x40f0b0	40	OBJECT	<unknown>	DEFAULT	4
__stdio_rfill	.symtab	0x40a0b0	37	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x40a134	31	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x40a0d8	90	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x407ef8	149	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x403b24	39	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x612fd0	8	OBJECT	<unknown>	DEFAULT	9
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uClibc_fini	.symtab	0x406df4	70	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x406e6f	58	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x406ea9	570	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x613338	8	OBJECT	<unknown>	HIDDEN	9
__xpg_strerror_r	.symtab	0x4051e4	196	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__xstat32_conv	.symtab	0x409c8c	172	FUNC	<unknown>	HIDDEN	2
__xstat64_conv	.symtab	0x409be0	172	FUNC	<unknown>	HIDDEN	2
__xstat_conv	.symtab	0x409d38	172	FUNC	<unknown>	HIDDEN	2
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_bss_custom_printf_spec	.symtab	0x619410	10	OBJECT	<unknown>	DEFAULT	10
_charpad	.symtab	0x403b4c	77	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_custom_printf_arginfo	.symtab	0x6196b0	80	OBJECT	<unknown>	HIDDEN	10
_custom_printf_handler	.symtab	0x619700	80	OBJECT	<unknown>	HIDDEN	10
_custom_printf_spec	.symtab	0x6131c0	8	OBJECT	<unknown>	HIDDEN	9
_dl_aux_init	.symtab	0x409b1c	23	FUNC	<unknown>	DEFAULT	2
_dl_phdr	.symtab	0x619e38	8	OBJECT	<unknown>	DEFAULT	10
_dl_phnum	.symtab	0x619e40	8	OBJECT	<unknown>	DEFAULT	10
_edata	.symtab	0x613368	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x619e68	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_errno	.symtab	0x619658	4	OBJECT	<unknown>	DEFAULT	10
_exit	.symtab	0x403630	43	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x40bee4	0	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x617410	8192	OBJECT	<unknown>	DEFAULT	10
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x403b99	120	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x4080e4	1565	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_h_errno	.symtab	0x61965c	4	OBJECT	<unknown>	DEFAULT	10
_init	.symtab	0x4000e8	0	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x407f90	85	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_init	.symtab	0x4042c8	114	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x404562	1126	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x40433c	67	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x404380	436	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x404534	46	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x406de2	18	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x406dda	8	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_sigintr	.symtab	0x619750	8	OBJECT	<unknown>	HIDDEN	10
_start	.symtab	0x400194	42	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x407bc0	563	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x403a2c	95	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x612fd8	8	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_add_lock	.symtab	0x612fe0	40	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_dec_use	.symtab	0x4087f8	216	FUNC	<unknown>	HIDDEN	2
_stdio_openlist_del_count	.symtab	0x617404	4	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_del_lock	.symtab	0x613010	40	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_use_count	.symtab	0x617400	4	OBJECT	<unknown>	DEFAULT	10
_stdio_streams	.symtab	0x613040	384	OBJECT	<unknown>	DEFAULT	9
_stdio_term	.symtab	0x403a9a	135	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x613038	4	OBJECT	<unknown>	DEFAULT	9
_stdlib_strto_l	.symtab	0x406880	339	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x407fe8	46	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x40f1b0	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x408018	201	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x403c11	1716	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x4063bc	200	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
atoi	.symtab	0x406860	18	FUNC	<unknown>	DEFAULT	2
atoi.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bcopy	.symtab	0x4052a8	14	FUNC	<unknown>	DEFAULT	2
bcopy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
been_there_done_that	.symtab	0x619620	4	OBJECT	<unknown>	DEFAULT	10
bot.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
brk	.symtab	0x409b34	43	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x4055d0	133	FUNC	<unknown>	DEFAULT	2
buf.3312	.symtab	0x619430	16	OBJECT	<unknown>	DEFAULT	10
buf.5843	.symtab	0x619440	448	OBJECT	<unknown>	DEFAULT	10
bzero	.symtab	0x404a80	210	FUNC	<unknown>	DEFAULT	2
c	.symtab	0x612f7c	4	OBJECT	<unknown>	DEFAULT	9
calloc	.symtab	0x4096b4	248	FUNC	<unknown>	DEFAULT	2
calloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
chdir	.symtab	0x40365c	38	FUNC	<unknown>	DEFAULT	2
chdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
clock_getres	.symtab	0x407190	41	FUNC	<unknown>	DEFAULT	2
clock_getres.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x403684	41	FUNC	<unknown>	DEFAULT	2
close.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
closedir	.symtab	0x407338	147	FUNC	<unknown>	DEFAULT	2
closedir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
closenameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
commServer	.symtab	0x612d80	8	OBJECT	<unknown>	DEFAULT	9
completed.5156	.symtab	0x613380	1	OBJECT	<unknown>	DEFAULT	10
connect	.symtab	0x405464	43	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connectTimeout	.symtab	0x4010c3	582	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
currentServer	.symtab	0x612f78	4	OBJECT	<unknown>	DEFAULT	9
data_start	.symtab	0x612d70	0	NOTYPE	<unknown>	DEFAULT	9
decoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dns	.symtab	0x612d88	8	OBJECT	<unknown>	DEFAULT	9
dnslookup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ	.symtab	0x619638	8	OBJECT	<unknown>	DEFAULT	10
errno	.symtab	0x619658	4	OBJECT	<unknown>	DEFAULT	10
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x4069d4	95	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x410870	208	OBJECT	<unknown>	DEFAULT	4
fclose	.symtab	0x4079f8	269	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x403568	100	FUNC	<unknown>	DEFAULT	2
fd_to_DIR	.symtab	0x4073cc	149	FUNC	<unknown>	DEFAULT	2
fdgets	.symtab	0x400323	130	FUNC	<unknown>	DEFAULT	2
fdopendir	.symtab	0x4074fe	115	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x4088d0	322	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc	.symtab	0x408704	128	FUNC	<unknown>	DEFAULT	2
fgetc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x408a14	222	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x408784	116	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x408af4	116	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fmt	.symtab	0x410850	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x407b08	10	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0x4036b0	38	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs_unlocked	.symtab	0x4049c8	56	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x400150	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x4061dd	451	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x409f04	5	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x409f04	5	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x409f0c	225	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fstat	.symtab	0x409b60	82	FUNC	<unknown>	DEFAULT	2
fstat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fstat64	.symtab	0x409b60	82	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked	.symtab	0x404a00	128	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getArch	.symtab	0x4026b9	11	FUNC	<unknown>	DEFAULT	2
getHost	.symtab	0x400e44	65	FUNC	<unknown>	DEFAULT	2
getOurIP	.symtab	0x4003a5	485	FUNC	<unknown>	DEFAULT	2
getRandomIP	.symtab	0x4002f4	47	FUNC	<unknown>	DEFAULT	2
get_hosts_byname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getc	.symtab	0x408704	128	FUNC	<unknown>	DEFAULT	2
getc_unlocked	.symtab	0x408a14	222	FUNC	<unknown>	DEFAULT	2
getdents64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdtablesize	.symtab	0x4071bc	36	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x4071e0	8	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x4071e8	8	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x4071f0	8	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname	.symtab	0x405414	10	FUNC	<unknown>	DEFAULT	2
gethostbyname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname2	.symtab	0x405420	65	FUNC	<unknown>	DEFAULT	2
gethostbyname2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname2_r	.symtab	0x4093a4	761	FUNC	<unknown>	DEFAULT	2
gethostbyname2_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r	.symtab	0x40b5b0	802	FUNC	<unknown>	DEFAULT	2
gethostbyname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostname	.symtab	0x40b8d4	94	FUNC	<unknown>	DEFAULT	2
gethostname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpagesize	.symtab	0x4071f8	19	FUNC	<unknown>	DEFAULT	2
getpagesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x4036d8	8	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x40720c	40	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit64	.symtab	0x40720c	40	FUNC	<unknown>	DEFAULT	2
getsockname	.symtab	0x405490	41	FUNC	<unknown>	DEFAULT	2
getsockname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x4054bc	50	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x407234	8	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
h_errno	.symtab	0x61965c	4	OBJECT	<unknown>	DEFAULT	10
hoste.5842	.symtab	0x619600	32	OBJECT	<unknown>	DEFAULT	10
htonl	.symtab	0x405388	5	FUNC	<unknown>	DEFAULT	2
htons	.symtab	0x405380	8	FUNC	<unknown>	DEFAULT	2
i.4975	.symtab	0x612f80	4	OBJECT	<unknown>	DEFAULT	9
index	.symtab	0x404cb0	417	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x4053f4	29	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x40931c	135	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa	.symtab	0x4053e9	10	FUNC	<unknown>	DEFAULT	2
inet_ntoa.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa_r	.symtab	0x40539c	77	FUNC	<unknown>	DEFAULT	2
inet_ntop	.symtab	0x40a68f	518	FUNC	<unknown>	DEFAULT	2
inet_ntop4	.symtab	0x40a59c	243	FUNC	<unknown>	DEFAULT	2
inet_pton	.symtab	0x40a3af	493	FUNC	<unknown>	DEFAULT	2
inet_pton4	.symtab	0x40a328	135	FUNC	<unknown>	DEFAULT	2
initConnection	.symtab	0x402f38	296	FUNC	<unknown>	DEFAULT	2
init_rand	.symtab	0x4001c0	126	FUNC	<unknown>	DEFAULT	2
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initstate	.symtab	0x406532	110	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x4067a4	185	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x4036e0	101	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isatty	.symtab	0x4052f4	25	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isspace	.symtab	0x403898	18	FUNC	<unknown>	DEFAULT	2
isspace.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0x403748	44	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
last_id.5904	.symtab	0x613360	2	OBJECT	<unknown>	DEFAULT	9
last_ns_num.5903	.symtab	0x619668	4	OBJECT	<unknown>	DEFAULT	10
listFork	.symtab	0x401309	211	FUNC	<unknown>	DEFAULT	2
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek	.symtab	0x40bdd4	45	FUNC	<unknown>	DEFAULT	2
lseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x40b9d8	5	FUNC	<unknown>	DEFAULT	2
macAddress	.symtab	0x6133f0	6	OBJECT	<unknown>	DEFAULT	10
main	.symtab	0x403060	1285	FUNC	<unknown>	DEFAULT	2
mainCommSock	.symtab	0x6133e0	4	OBJECT	<unknown>	DEFAULT	10
malloc	.symtab	0x405722	2187	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
malloc_trim	.symtab	0x4063a0	28	FUNC	<unknown>	DEFAULT	2
memchr	.symtab	0x408ce0	236	FUNC	<unknown>	DEFAULT	2
memchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memcpy	.symtab	0x404b60	102	FUNC	<unknown>	DEFAULT	2
memmove	.symtab	0x408dcc	702	FUNC	<unknown>	DEFAULT	2
memmove.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mempcpy	.symtab	0x408b70	90	FUNC	<unknown>	DEFAULT	2
memrchr	.symtab	0x40908c	233	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x404bd0	210	FUNC	<unknown>	DEFAULT	2
mmap	.symtab	0x407160	48	FUNC	<unknown>	DEFAULT	2
mmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mremap	.symtab	0x409bb4	42	FUNC	<unknown>	DEFAULT	2
mremap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
munmap	.symtab	0x40723c	38	FUNC	<unknown>	DEFAULT	2
munmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mylock	.symtab	0x613200	40	OBJECT	<unknown>	DEFAULT	9
mylock	.symtab	0x613230	40	OBJECT	<unknown>	DEFAULT	9
nanosleep	.symtab	0x407264	38	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
next_start.1699	.symtab	0x619420	8	OBJECT	<unknown>	DEFAULT	10
nprocessors_onln	.symtab	0x406ac4	223	FUNC	<unknown>	DEFAULT	2
ntohl	.symtab	0x405395	5	FUNC	<unknown>	DEFAULT	2
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0x40538d	8	FUNC	<unknown>	DEFAULT	2
ntop.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
numpids	.symtab	0x6133e8	8	OBJECT	<unknown>	DEFAULT	10
object.5168	.symtab	0x6133a0	48	OBJECT	<unknown>	DEFAULT	10
open	.symtab	0x403774	106	FUNC	<unknown>	DEFAULT	2
open.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opendir	.symtab	0x407461	157	FUNC	<unknown>	DEFAULT	2
opendir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opennameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ourIP	.symtab	0x6196a0	4	OBJECT	<unknown>	DEFAULT	10
ovhl7	.symtab	0x4019c2	3319	FUNC	<unknown>	DEFAULT	2
p.5154	.symtab	0x612d68	0	OBJECT	<unknown>	DEFAULT	9
parse_config.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pids	.symtab	0x6196a8	8	OBJECT	<unknown>	DEFAULT	10
poll	.symtab	0x40b934	41	FUNC	<unknown>	DEFAULT	2
poll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prefix.5143	.symtab	0x40f0e8	12	OBJECT	<unknown>	DEFAULT	4
print	.symtab	0x4008b3	1084	FUNC	<unknown>	DEFAULT	2
printchar	.symtab	0x400640	75	FUNC	<unknown>	DEFAULT	2
printi	.symtab	0x400772	321	FUNC	<unknown>	DEFAULT	2
prints	.symtab	0x40068b	231	FUNC	<unknown>	DEFAULT	2
processCmd	.symtab	0x4026c4	2164	FUNC	<unknown>	DEFAULT	2
program_invocation_name	.symtab	0x613348	8	OBJECT	<unknown>	DEFAULT	9
program_invocation_short_name	.symtab	0x613340	8	OBJECT	<unknown>	DEFAULT	9
qual_chars.5150	.symtab	0x40f100	20	OBJECT	<unknown>	DEFAULT	4
raise	.symtab	0x4096a0	18	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x406484	11	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand_cmwc	.symtab	0x40023e	182	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x406490	72	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x40fd10	40	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x406693	90	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randtbl	.symtab	0x613290	128	OBJECT	<unknown>	DEFAULT	9
rawmemchr	.symtab	0x40a1e4	189	FUNC	<unknown>	DEFAULT	2
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read	.symtab	0x4037e0	39	FUNC	<unknown>	DEFAULT	2
read.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read_etc_hosts_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
readdir64	.symtab	0x407574	143	FUNC	<unknown>	DEFAULT	2
readdir64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
realloc	.symtab	0x4097ac	878	FUNC	<unknown>	DEFAULT	2
realloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recv	.symtab	0x4054f0	11	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recvLine	.symtab	0x400e85	574	FUNC	<unknown>	DEFAULT	2
recvfrom	.symtab	0x4054fc	45	FUNC	<unknown>	DEFAULT	2
recvfrom.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
resolv_conf_mtime.5885	.symtab	0x619698	4	OBJECT	<unknown>	DEFAULT	10
rindex	.symtab	0x409284	53	FUNC	<unknown>	DEFAULT	2
sbrk	.symtab	0x40728c	74	FUNC	<unknown>	DEFAULT	2
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
select	.symtab	0x403808	44	FUNC	<unknown>	DEFAULT	2
select.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send	.symtab	0x40552c	11	FUNC	<unknown>	DEFAULT	2
send.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sendto	.symtab	0x405538	48	FUNC	<unknown>	DEFAULT	2
sendto.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsid	.symtab	0x403834	38	FUNC	<unknown>	DEFAULT	2
setsid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsockopt	.symtab	0x405568	53	FUNC	<unknown>	DEFAULT	2
setsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate	.symtab	0x4064d8	90	FUNC	<unknown>	DEFAULT	2
setstate_r	.symtab	0x4065e8	171	FUNC	<unknown>	DEFAULT	2
sigaction	.symtab	0x4070ed	114	FUNC	<unknown>	DEFAULT	2
sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
signal	.symtab	0x4055d0	133	FUNC	<unknown>	DEFAULT	2
signal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigprocmask	.symtab	0x4072d8	47	FUNC	<unknown>	DEFAULT	2
sigprocmask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigsetops.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
skip_and_NUL_space	.symtab	0x40b119	44	FUNC	<unknown>	DEFAULT	2
skip_nospace	.symtab	0x40b0f0	41	FUNC	<unknown>	DEFAULT	2
sleep	.symtab	0x406a34	142	FUNC	<unknown>	DEFAULT	2
sleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket	.symtab	0x4055a0	47	FUNC	<unknown>	DEFAULT	2
socket.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket_connect	.symtab	0x4013dc	216	FUNC	<unknown>	DEFAULT	2
sockprintf	.symtab	0x400cef	341	FUNC	<unknown>	DEFAULT	2
spec_and_mask.5149	.symtab	0x40f120	16	OBJECT	<unknown>	DEFAULT	4
spec_base.5142	.symtab	0x40f0f4	7	OBJECT	<unknown>	DEFAULT	4
spec_chars.5146	.symtab	0x40f180	21	OBJECT	<unknown>	DEFAULT	4
spec_flags.5145	.symtab	0x40f198	8	OBJECT	<unknown>	DEFAULT	4
spec_or_mask.5148	.symtab	0x40f130	16	OBJECT	<unknown>	DEFAULT	4
spec_ranges.5147	.symtab	0x40f140	9	OBJECT	<unknown>	DEFAULT	4
sprintf	.symtab	0x4038d4	149	FUNC	<unknown>	DEFAULT	2
sprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
srand	.symtab	0x4065a0	72	FUNC	<unknown>	DEFAULT	2
srandom	.symtab	0x4065a0	72	FUNC	<unknown>	DEFAULT	2
srandom_r	.symtab	0x4066ed	183	FUNC	<unknown>	DEFAULT	2
stat	.symtab	0x40b960	79	FUNC	<unknown>	DEFAULT	2
stat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
stat64	.symtab	0x40b960	79	FUNC	<unknown>	DEFAULT	2
stderr	.symtab	0x612fc0	8	OBJECT	<unknown>	DEFAULT	9
stdin	.symtab	0x612fb0	8	OBJECT	<unknown>	DEFAULT	9
stdout	.symtab	0x612fb8	8	OBJECT	<unknown>	DEFAULT	9
strcasecmp	.symtab	0x4052b8	48	FUNC	<unknown>	DEFAULT	2
strcasecmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchr	.symtab	0x404cb0	417	FUNC	<unknown>	DEFAULT	2
strchrnul	.symtab	0x409178	268	FUNC	<unknown>	DEFAULT	2
strchrnul.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcmp	.symtab	0x404e54	33	FUNC	<unknown>	DEFAULT	2
strcoll	.symtab	0x404e54	33	FUNC	<unknown>	DEFAULT	2
strcpy	.symtab	0x404e80	213	FUNC	<unknown>	DEFAULT	2
strcspn	.symtab	0x408bd0	135	FUNC	<unknown>	DEFAULT	2
strdup	.symtab	0x40b9e0	54	FUNC	<unknown>	DEFAULT	2
strdup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strerror_r	.symtab	0x4051e4	196	FUNC	<unknown>	DEFAULT	2
strlen	.symtab	0x404f60	225	FUNC	<unknown>	DEFAULT	2
strncpy	.symtab	0x40a2a4	131	FUNC	<unknown>	DEFAULT	2
strncpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strnlen	.symtab	0x405044	201	FUNC	<unknown>	DEFAULT	2
strnlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strpbrk	.symtab	0x40a158	140	FUNC	<unknown>	DEFAULT	2
strrchr	.symtab	0x409284	53	FUNC	<unknown>	DEFAULT	2
strrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strspn	.symtab	0x408c58	135	FUNC	<unknown>	DEFAULT	2
strstr	.symtab	0x405110	193	FUNC	<unknown>	DEFAULT	2
strstr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtoimax	.symtab	0x406874	10	FUNC	<unknown>	DEFAULT	2
strtok	.symtab	0x4052e8	10	FUNC	<unknown>	DEFAULT	2
strtok.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok_r	.symtab	0x4092bc	94	FUNC	<unknown>	DEFAULT	2
strtok_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtol	.symtab	0x406874	10	FUNC	<unknown>	DEFAULT	2
strtol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtoll	.symtab	0x406874	10	FUNC	<unknown>	DEFAULT	2
strtoq	.symtab	0x406874	10	FUNC	<unknown>	DEFAULT	2
sysconf	.symtab	0x406ba3	560	FUNC	<unknown>	DEFAULT	2
sysconf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcgetattr	.symtab	0x405310	110	FUNC	<unknown>	DEFAULT	2
tcgetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
time	.symtab	0x40385c	8	FUNC	<unknown>	DEFAULT	2
time.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
toupper	.symtab	0x4038ac	30	FUNC	<unknown>	DEFAULT	2
toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
trim	.symtab	0x40058a	182	FUNC	<unknown>	DEFAULT	2
type_codes	.symtab	0x40f150	24	OBJECT	<unknown>	DEFAULT	4
type_sizes	.symtab	0x40f168	12	OBJECT	<unknown>	DEFAULT	4
uname	.symtab	0x40b9b0	38	FUNC	<unknown>	DEFAULT	2
uname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
unknown.1721	.symtab	0x40f1a0	14	OBJECT	<unknown>	DEFAULT	4
unsafe_state	.symtab	0x613260	40	OBJECT	<unknown>	DEFAULT	9
useragents	.symtab	0x612da0	472	OBJECT	<unknown>	DEFAULT	9
vsnprintf	.symtab	0x40396c	189	FUNC	<unknown>	DEFAULT	2
vsnprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wait4	.symtab	0x407308	47	FUNC	<unknown>	DEFAULT	2
wait4.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
waitpid	.symtab	0x403864	7	FUNC	<unknown>	DEFAULT	2
waitpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcrtomb	.symtab	0x407928	68	FUNC	<unknown>	DEFAULT	2
wcrtomb.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsnrtombs	.symtab	0x40797c	123	FUNC	<unknown>	DEFAULT	2
wcsnrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsrtombs	.symtab	0x40796c	15	FUNC	<unknown>	DEFAULT	2
wcsrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
write	.symtab	0x40386c	42	FUNC	<unknown>	DEFAULT	2
write.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
xdigits.3743	.symtab	0x4109a0	17	OBJECT	<unknown>	DEFAULT	4
xstatconv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
xtdcustom	.symtab	0x401649	252	FUNC	<unknown>	DEFAULT	2

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-22T16:01:49.632718+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40080	185.216.71.152	4258	TCP
2024-12-22T16:01:51.048407+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40082	185.216.71.152	4258	TCP
2024-12-22T16:01:52.346879+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40084	185.216.71.152	4258	TCP
2024-12-22T16:01:53.748559+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40086	185.216.71.152	4258	TCP
2024-12-22T16:01:55.054006+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40088	185.216.71.152	4258	TCP
2024-12-22T16:01:56.425320+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40090	185.216.71.152	4258	TCP
2024-12-22T16:01:57.738775+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40092	185.216.71.152	4258	TCP
2024-12-22T16:01:59.023455+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40094	185.216.71.152	4258	TCP
2024-12-22T16:02:00.334599+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40096	185.216.71.152	4258	TCP
2024-12-22T16:02:01.728305+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40098	185.216.71.152	4258	TCP
2024-12-22T16:02:06.013122+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40100	185.216.71.152	4258	TCP
2024-12-22T16:02:07.305566+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40102	185.216.71.152	4258	TCP
2024-12-22T16:02:08.594028+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40104	185.216.71.152	4258	TCP
2024-12-22T16:02:10.035379+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40106	185.216.71.152	4258	TCP
2024-12-22T16:02:14.402679+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40108	185.216.71.152	4258	TCP
2024-12-22T16:02:15.786294+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40110	185.216.71.152	4258	TCP
2024-12-22T16:02:17.065021+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40112	185.216.71.152	4258	TCP
2024-12-22T16:02:18.345001+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40114	185.216.71.152	4258	TCP
2024-12-22T16:02:19.618033+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40116	185.216.71.152	4258	TCP
2024-12-22T16:02:20.913416+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40118	185.216.71.152	4258	TCP
2024-12-22T16:02:22.200367+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40120	185.216.71.152	4258	TCP
2024-12-22T16:02:23.495954+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40122	185.216.71.152	4258	TCP
2024-12-22T16:02:24.766335+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40124	185.216.71.152	4258	TCP
2024-12-22T16:02:26.065161+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40126	185.216.71.152	4258	TCP
2024-12-22T16:02:27.342565+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40128	185.216.71.152	4258	TCP
2024-12-22T16:02:28.628761+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40130	185.216.71.152	4258	TCP
2024-12-22T16:02:29.913656+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40132	185.216.71.152	4258	TCP
2024-12-22T16:02:31.212950+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40134	185.216.71.152	4258	TCP
2024-12-22T16:02:32.483293+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40136	185.216.71.152	4258	TCP
2024-12-22T16:02:33.857557+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40138	185.216.71.152	4258	TCP
2024-12-22T16:02:35.158313+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40140	185.216.71.152	4258	TCP
2024-12-22T16:02:36.458912+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40142	185.216.71.152	4258	TCP
2024-12-22T16:02:37.730644+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40144	185.216.71.152	4258	TCP
2024-12-22T16:02:39.008822+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40146	185.216.71.152	4258	TCP
2024-12-22T16:02:40.288516+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40148	185.216.71.152	4258	TCP
2024-12-22T16:02:41.577548+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40150	185.216.71.152	4258	TCP
2024-12-22T16:02:42.892204+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40152	185.216.71.152	4258	TCP
2024-12-22T16:02:44.172311+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40154	185.216.71.152	4258	TCP
2024-12-22T16:02:45.469612+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40156	185.216.71.152	4258	TCP
2024-12-22T16:02:46.769824+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40158	185.216.71.152	4258	TCP
2024-12-22T16:02:48.067839+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40160	185.216.71.152	4258	TCP
2024-12-22T16:02:49.343720+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40162	185.216.71.152	4258	TCP
2024-12-22T16:02:50.635745+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40164	185.216.71.152	4258	TCP
2024-12-22T16:02:51.929405+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40166	185.216.71.152	4258	TCP
2024-12-22T16:02:53.204865+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40168	185.216.71.152	4258	TCP
2024-12-22T16:02:54.479561+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40170	185.216.71.152	4258	TCP
2024-12-22T16:02:55.811001+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40172	185.216.71.152	4258	TCP
2024-12-22T16:02:57.128836+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40174	185.216.71.152	4258	TCP
2024-12-22T16:02:58.408282+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40176	185.216.71.152	4258	TCP
2024-12-22T16:02:59.762257+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40178	185.216.71.152	4258	TCP
2024-12-22T16:03:01.092709+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40180	185.216.71.152	4258	TCP
2024-12-22T16:03:02.378310+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40182	185.216.71.152	4258	TCP
2024-12-22T16:03:03.696757+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40184	185.216.71.152	4258	TCP
2024-12-22T16:03:05.234030+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40186	185.216.71.152	4258	TCP
2024-12-22T16:03:06.547784+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40188	185.216.71.152	4258	TCP
2024-12-22T16:03:07.828436+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40190	185.216.71.152	4258	TCP
2024-12-22T16:03:09.114381+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40192	185.216.71.152	4258	TCP
2024-12-22T16:03:10.411572+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40194	185.216.71.152	4258	TCP
2024-12-22T16:03:11.678351+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40196	185.216.71.152	4258	TCP
2024-12-22T16:03:12.950892+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40198	185.216.71.152	4258	TCP
2024-12-22T16:03:14.246008+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40200	185.216.71.152	4258	TCP
2024-12-22T16:03:15.536132+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40202	185.216.71.152	4258	TCP
2024-12-22T16:03:16.867073+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40204	185.216.71.152	4258	TCP
2024-12-22T16:03:18.163944+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40206	185.216.71.152	4258	TCP
2024-12-22T16:03:19.499174+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40208	185.216.71.152	4258	TCP
2024-12-22T16:03:20.824895+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40210	185.216.71.152	4258	TCP
2024-12-22T16:03:22.093614+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40212	185.216.71.152	4258	TCP
2024-12-22T16:03:23.378548+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40214	185.216.71.152	4258	TCP
2024-12-22T16:03:24.665118+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40216	185.216.71.152	4258	TCP
2024-12-22T16:03:25.963331+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40218	185.216.71.152	4258	TCP
2024-12-22T16:03:27.265153+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40220	185.216.71.152	4258	TCP
2024-12-22T16:03:28.551465+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40222	185.216.71.152	4258	TCP
2024-12-22T16:03:29.826086+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40224	185.216.71.152	4258	TCP
2024-12-22T16:03:31.099926+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40226	185.216.71.152	4258	TCP
2024-12-22T16:03:32.376088+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40228	185.216.71.152	4258	TCP
2024-12-22T16:03:33.658160+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40230	185.216.71.152	4258	TCP
2024-12-22T16:03:34.949536+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40232	185.216.71.152	4258	TCP
2024-12-22T16:03:36.270744+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40234	185.216.71.152	4258	TCP
2024-12-22T16:03:37.557603+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40236	185.216.71.152	4258	TCP
2024-12-22T16:03:38.826726+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40238	185.216.71.152	4258	TCP
2024-12-22T16:03:40.117028+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40240	185.216.71.152	4258	TCP
2024-12-22T16:03:41.402351+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40242	185.216.71.152	4258	TCP
2024-12-22T16:03:42.672803+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40244	185.216.71.152	4258	TCP
2024-12-22T16:03:43.984218+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40246	185.216.71.152	4258	TCP
2024-12-22T16:03:45.267790+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40248	185.216.71.152	4258	TCP
2024-12-22T16:03:46.579720+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40250	185.216.71.152	4258	TCP
2024-12-22T16:03:47.877946+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40252	185.216.71.152	4258	TCP
2024-12-22T16:03:49.311819+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40254	185.216.71.152	4258	TCP
2024-12-22T16:03:50.619165+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40256	185.216.71.152	4258	TCP
2024-12-22T16:03:54.898343+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40258	185.216.71.152	4258	TCP
2024-12-22T16:03:56.343483+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40260	185.216.71.152	4258	TCP
2024-12-22T16:03:57.641019+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40262	185.216.71.152	4258	TCP
2024-12-22T16:04:02.053546+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40264	185.216.71.152	4258	TCP
2024-12-22T16:04:03.389695+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40266	185.216.71.152	4258	TCP
2024-12-22T16:04:04.993584+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40268	185.216.71.152	4258	TCP
2024-12-22T16:04:06.346216+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40270	185.216.71.152	4258	TCP
2024-12-22T16:04:07.650857+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40272	185.216.71.152	4258	TCP
2024-12-22T16:04:08.941576+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40274	185.216.71.152	4258	TCP
2024-12-22T16:04:10.570182+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40276	185.216.71.152	4258	TCP
2024-12-22T16:04:11.947795+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40278	185.216.71.152	4258	TCP
2024-12-22T16:04:13.247358+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40280	185.216.71.152	4258	TCP
2024-12-22T16:04:14.526975+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40282	185.216.71.152	4258	TCP
2024-12-22T16:04:15.796795+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40284	185.216.71.152	4258	TCP
2024-12-22T16:04:17.254331+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40286	185.216.71.152	4258	TCP
2024-12-22T16:04:18.645848+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40288	185.216.71.152	4258	TCP
2024-12-22T16:04:20.007428+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40290	185.216.71.152	4258	TCP
2024-12-22T16:04:21.345387+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40292	185.216.71.152	4258	TCP
2024-12-22T16:04:22.615979+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40294	185.216.71.152	4258	TCP
2024-12-22T16:04:23.898790+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40296	185.216.71.152	4258	TCP
2024-12-22T16:04:25.185532+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40298	185.216.71.152	4258	TCP
2024-12-22T16:04:26.467260+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40300	185.216.71.152	4258	TCP
2024-12-22T16:04:27.766575+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40302	185.216.71.152	4258	TCP
2024-12-22T16:04:29.056450+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40304	185.216.71.152	4258	TCP
2024-12-22T16:04:30.338329+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40306	185.216.71.152	4258	TCP
2024-12-22T16:04:31.625341+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40308	185.216.71.152	4258	TCP
2024-12-22T16:04:32.925833+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40310	185.216.71.152	4258	TCP
2024-12-22T16:04:34.194398+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40314	185.216.71.152	4258	TCP
2024-12-22T16:04:35.474664+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40316	185.216.71.152	4258	TCP
2024-12-22T16:04:36.752599+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40318	185.216.71.152	4258	TCP
2024-12-22T16:04:38.030777+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40320	185.216.71.152	4258	TCP
2024-12-22T16:04:39.319461+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40322	185.216.71.152	4258	TCP
2024-12-22T16:04:40.602833+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40324	185.216.71.152	4258	TCP
2024-12-22T16:04:41.891497+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40326	185.216.71.152	4258	TCP
2024-12-22T16:04:43.171866+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40328	185.216.71.152	4258	TCP
2024-12-22T16:04:44.458482+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40330	185.216.71.152	4258	TCP
2024-12-22T16:04:45.741128+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40332	185.216.71.152	4258	TCP
2024-12-22T16:04:47.036711+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40334	185.216.71.152	4258	TCP
2024-12-22T16:04:48.330668+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40336	185.216.71.152	4258	TCP
2024-12-22T16:04:49.637036+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40338	185.216.71.152	4258	TCP
2024-12-22T16:04:50.917716+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40340	185.216.71.152	4258	TCP
2024-12-22T16:04:52.217575+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40342	185.216.71.152	4258	TCP
2024-12-22T16:04:53.537149+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40344	185.216.71.152	4258	TCP
2024-12-22T16:04:54.824682+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40346	185.216.71.152	4258	TCP
2024-12-22T16:04:56.136902+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40348	185.216.71.152	4258	TCP
2024-12-22T16:04:57.426142+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40350	185.216.71.152	4258	TCP
2024-12-22T16:04:58.738597+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40352	185.216.71.152	4258	TCP
2024-12-22T16:05:00.005590+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40354	185.216.71.152	4258	TCP
2024-12-22T16:05:01.280758+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40356	185.216.71.152	4258	TCP
2024-12-22T16:05:02.565690+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40358	185.216.71.152	4258	TCP
2024-12-22T16:05:03.856444+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40360	185.216.71.152	4258	TCP
2024-12-22T16:05:05.143490+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40362	185.216.71.152	4258	TCP
2024-12-22T16:05:06.422326+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40364	185.216.71.152	4258	TCP
2024-12-22T16:05:07.721750+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40366	185.216.71.152	4258	TCP
2024-12-22T16:05:09.019487+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40368	185.216.71.152	4258	TCP
2024-12-22T16:05:10.313228+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40370	185.216.71.152	4258	TCP
2024-12-22T16:05:11.599753+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40372	185.216.71.152	4258	TCP
2024-12-22T16:05:12.883833+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40374	185.216.71.152	4258	TCP
2024-12-22T16:05:14.170592+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40376	185.216.71.152	4258	TCP
2024-12-22T16:05:15.439358+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40378	185.216.71.152	4258	TCP
2024-12-22T16:05:16.715338+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40380	185.216.71.152	4258	TCP
2024-12-22T16:05:17.991406+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40382	185.216.71.152	4258	TCP
2024-12-22T16:05:19.368800+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40384	185.216.71.152	4258	TCP
2024-12-22T16:05:20.642505+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40386	185.216.71.152	4258	TCP
2024-12-22T16:05:22.047466+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40388	185.216.71.152	4258	TCP
2024-12-22T16:05:23.395243+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	40390	185.216.71.152	4258	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 22, 2024 16:01:49.510858059 CET	40080	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:01:49.632405996 CET	4258	40080	185.216.71.152	192.168.2.13
Dec 22, 2024 16:01:49.632718086 CET	40080	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:01:49.632718086 CET	40080	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:01:49.752758026 CET	4258	40080	185.216.71.152	192.168.2.13
Dec 22, 2024 16:01:50.926750898 CET	4258	40080	185.216.71.152	192.168.2.13
Dec 22, 2024 16:01:50.927216053 CET	4258	40080	185.216.71.152	192.168.2.13
Dec 22, 2024 16:01:50.927310944 CET	40080	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:01:50.927310944 CET	40080	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:01:50.928577900 CET	40082	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:01:51.047209978 CET	4258	40080	185.216.71.152	192.168.2.13
Dec 22, 2024 16:01:51.048145056 CET	4258	40082	185.216.71.152	192.168.2.13
Dec 22, 2024 16:01:51.048407078 CET	40082	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:01:51.048407078 CET	40082	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:01:51.168462992 CET	4258	40082	185.216.71.152	192.168.2.13
Dec 22, 2024 16:01:52.225222111 CET	4258	40082	185.216.71.152	192.168.2.13
Dec 22, 2024 16:01:52.225263119 CET	4258	40082	185.216.71.152	192.168.2.13
Dec 22, 2024 16:01:52.225573063 CET	40082	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:01:52.225573063 CET	40082	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:01:52.226711035 CET	40084	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:01:52.346580982 CET	4258	40082	185.216.71.152	192.168.2.13
Dec 22, 2024 16:01:52.346729040 CET	4258	40084	185.216.71.152	192.168.2.13
Dec 22, 2024 16:01:52.346878052 CET	40084	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:01:52.346879005 CET	40084	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:01:52.466542006 CET	4258	40084	185.216.71.152	192.168.2.13
Dec 22, 2024 16:01:53.627489090 CET	4258	40084	185.216.71.152	192.168.2.13
Dec 22, 2024 16:01:53.627655029 CET	4258	40084	185.216.71.152	192.168.2.13
Dec 22, 2024 16:01:53.627839088 CET	40084	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:01:53.627840042 CET	40084	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:01:53.628763914 CET	40086	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:01:53.747632980 CET	4258	40084	185.216.71.152	192.168.2.13
Dec 22, 2024 16:01:53.748317957 CET	4258	40086	185.216.71.152	192.168.2.13
Dec 22, 2024 16:01:53.748558998 CET	40086	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:01:53.748558998 CET	40086	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:01:53.868535995 CET	4258	40086	185.216.71.152	192.168.2.13
Dec 22, 2024 16:01:54.932174921 CET	4258	40086	185.216.71.152	192.168.2.13
Dec 22, 2024 16:01:54.932199955 CET	4258	40086	185.216.71.152	192.168.2.13
Dec 22, 2024 16:01:54.932583094 CET	40086	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:01:54.932583094 CET	40086	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:01:54.934011936 CET	40088	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:01:55.052491903 CET	4258	40086	185.216.71.152	192.168.2.13
Dec 22, 2024 16:01:55.053632975 CET	4258	40088	185.216.71.152	192.168.2.13
Dec 22, 2024 16:01:55.054006100 CET	40088	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:01:55.054006100 CET	40088	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:01:55.176054955 CET	4258	40088	185.216.71.152	192.168.2.13
Dec 22, 2024 16:01:56.302954912 CET	4258	40088	185.216.71.152	192.168.2.13
Dec 22, 2024 16:01:56.302978039 CET	4258	40088	185.216.71.152	192.168.2.13
Dec 22, 2024 16:01:56.303256035 CET	40088	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:01:56.303256989 CET	40088	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:01:56.304758072 CET	40090	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:01:56.424027920 CET	4258	40088	185.216.71.152	192.168.2.13
Dec 22, 2024 16:01:56.425093889 CET	4258	40090	185.216.71.152	192.168.2.13
Dec 22, 2024 16:01:56.425318956 CET	40090	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:01:56.425319910 CET	40090	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:01:56.546081066 CET	4258	40090	185.216.71.152	192.168.2.13
Dec 22, 2024 16:01:57.617580891 CET	4258	40090	185.216.71.152	192.168.2.13
Dec 22, 2024 16:01:57.617605925 CET	4258	40090	185.216.71.152	192.168.2.13
Dec 22, 2024 16:01:57.617916107 CET	40090	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:01:57.617917061 CET	40090	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:01:57.618953943 CET	40092	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:01:57.737741947 CET	4258	40090	185.216.71.152	192.168.2.13
Dec 22, 2024 16:01:57.738549948 CET	4258	40092	185.216.71.152	192.168.2.13
Dec 22, 2024 16:01:57.738774061 CET	40092	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:01:57.738775015 CET	40092	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:01:57.858481884 CET	4258	40092	185.216.71.152	192.168.2.13
Dec 22, 2024 16:01:58.901911020 CET	4258	40092	185.216.71.152	192.168.2.13
Dec 22, 2024 16:01:58.901994944 CET	4258	40092	185.216.71.152	192.168.2.13
Dec 22, 2024 16:01:58.902185917 CET	40092	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:01:58.902185917 CET	40092	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:01:58.903691053 CET	40094	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:01:59.022416115 CET	4258	40092	185.216.71.152	192.168.2.13
Dec 22, 2024 16:01:59.023224115 CET	4258	40094	185.216.71.152	192.168.2.13
Dec 22, 2024 16:01:59.023454905 CET	40094	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:01:59.023454905 CET	40094	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:01:59.143678904 CET	4258	40094	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:00.211908102 CET	4258	40094	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:00.211932898 CET	4258	40094	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:00.212948084 CET	40094	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:00.213021040 CET	40094	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:00.214456081 CET	40096	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:00.333147049 CET	4258	40094	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:00.334184885 CET	4258	40096	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:00.334598064 CET	40096	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:00.334599018 CET	40096	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:00.454657078 CET	4258	40096	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:01.605534077 CET	4258	40096	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:01.605559111 CET	4258	40096	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:01.606152058 CET	40096	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:01.606152058 CET	40096	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:01.607908964 CET	40098	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:01.726078987 CET	4258	40096	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:01.727612972 CET	4258	40098	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:01.727943897 CET	40098	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:01.728305101 CET	40098	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:01.848573923 CET	4258	40098	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:05.890690088 CET	4258	40098	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:05.890744925 CET	4258	40098	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:05.891134977 CET	40098	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:05.891135931 CET	40098	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:05.892873049 CET	40100	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:06.011235952 CET	4258	40098	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:06.012707949 CET	4258	40100	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:06.013120890 CET	40100	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:06.013122082 CET	40100	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:06.133197069 CET	4258	40100	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:07.182192087 CET	4258	40100	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:07.182254076 CET	4258	40100	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:07.182656050 CET	40100	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:07.182656050 CET	40100	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:07.185214996 CET	40102	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:07.302877903 CET	4258	40100	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:07.305043936 CET	4258	40102	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:07.305335045 CET	40102	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:07.305566072 CET	40102	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:07.425586939 CET	4258	40102	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:08.471533060 CET	4258	40102	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:08.471581936 CET	4258	40102	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:08.471815109 CET	40102	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:08.472033024 CET	40102	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:08.473622084 CET	40104	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:08.592098951 CET	4258	40102	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:08.593451977 CET	4258	40104	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:08.593889952 CET	40104	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:08.594027996 CET	40104	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:08.713952065 CET	4258	40104	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:09.913125038 CET	4258	40104	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:09.913170099 CET	4258	40104	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:09.913435936 CET	40104	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:09.913717031 CET	40104	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:09.915432930 CET	40106	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:10.033127069 CET	4258	40104	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:10.035015106 CET	4258	40106	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:10.035378933 CET	40106	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:10.035378933 CET	40106	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:10.155181885 CET	4258	40106	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:14.279284000 CET	4258	40106	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:14.279309988 CET	4258	40106	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:14.279719114 CET	40106	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:14.279719114 CET	40106	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:14.282205105 CET	40108	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:14.399425983 CET	4258	40106	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:14.402226925 CET	4258	40108	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:14.402606964 CET	40108	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:14.402678967 CET	40108	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:14.523766041 CET	4258	40108	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:15.664622068 CET	4258	40108	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:15.664645910 CET	4258	40108	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:15.664926052 CET	40108	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:15.664962053 CET	40108	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:15.666271925 CET	40110	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:15.784571886 CET	4258	40108	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:15.786072969 CET	4258	40110	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:15.786262989 CET	40110	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:15.786293983 CET	40110	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:15.906168938 CET	4258	40110	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:16.942668915 CET	4258	40110	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:16.942759991 CET	4258	40110	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:16.943046093 CET	40110	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:16.943046093 CET	40110	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:16.944605112 CET	40112	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:17.063244104 CET	4258	40110	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:17.064706087 CET	4258	40112	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:17.065021038 CET	40112	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:17.065021038 CET	40112	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:17.185017109 CET	4258	40112	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:18.223244905 CET	4258	40112	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:18.223264933 CET	4258	40112	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:18.223450899 CET	40112	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:18.223565102 CET	40112	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:18.224739075 CET	40114	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:18.343437910 CET	4258	40112	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:18.344683886 CET	4258	40114	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:18.344902039 CET	40114	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:18.345000982 CET	40114	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:18.465915918 CET	4258	40114	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:19.495631933 CET	4258	40114	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:19.495733976 CET	4258	40114	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:19.495939970 CET	40114	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:19.495976925 CET	40114	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:19.497401953 CET	40116	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:19.617374897 CET	4258	40114	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:19.617634058 CET	4258	40116	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:19.618031979 CET	40116	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:19.618032932 CET	40116	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:19.738318920 CET	4258	40116	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:20.790812016 CET	4258	40116	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:20.790858984 CET	4258	40116	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:20.791373014 CET	40116	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:20.791373014 CET	40116	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:20.793154001 CET	40118	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:20.911103964 CET	4258	40116	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:20.912947893 CET	4258	40118	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:20.913414955 CET	40118	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:20.913415909 CET	40118	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:21.033329964 CET	4258	40118	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:22.078181982 CET	4258	40118	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:22.078555107 CET	4258	40118	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:22.078584909 CET	40118	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:22.079135895 CET	40118	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:22.080133915 CET	40120	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:22.199590921 CET	4258	40118	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:22.200129032 CET	4258	40120	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:22.200336933 CET	40120	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:22.200366974 CET	40120	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:22.320900917 CET	4258	40120	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:23.374660015 CET	4258	40120	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:23.374706984 CET	4258	40120	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:23.374835968 CET	40120	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:23.374835968 CET	40120	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:23.376113892 CET	40122	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:23.494582891 CET	4258	40120	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:23.495770931 CET	4258	40122	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:23.495953083 CET	40122	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:23.495954037 CET	40122	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:23.616153002 CET	4258	40122	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:24.643991947 CET	4258	40122	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:24.644042015 CET	4258	40122	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:24.644170046 CET	40122	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:24.644212961 CET	40122	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:24.645454884 CET	40124	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:24.764839888 CET	4258	40122	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:24.765970945 CET	4258	40124	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:24.766335011 CET	40124	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:24.766335011 CET	40124	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:24.887382030 CET	4258	40124	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:25.943876982 CET	4258	40124	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:25.943897963 CET	4258	40124	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:25.944288015 CET	40124	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:25.944288015 CET	40124	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:25.945034027 CET	40126	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:26.064301014 CET	4258	40124	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:26.064889908 CET	4258	40126	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:26.065160036 CET	40126	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:26.065160990 CET	40126	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:26.185375929 CET	4258	40126	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:27.221512079 CET	4258	40126	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:27.221632004 CET	4258	40126	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:27.221739054 CET	40126	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:27.221739054 CET	40126	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:27.222866058 CET	40128	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:27.341686964 CET	4258	40126	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:27.342442989 CET	4258	40128	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:27.342545033 CET	40128	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:27.342565060 CET	40128	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:27.462219000 CET	4258	40128	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:28.507349968 CET	4258	40128	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:28.507373095 CET	4258	40128	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:28.507615089 CET	40128	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:28.507615089 CET	40128	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:28.509015083 CET	40130	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:28.627405882 CET	4258	40128	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:28.628618002 CET	4258	40130	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:28.628761053 CET	40130	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:28.628761053 CET	40130	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:28.748389959 CET	4258	40130	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:29.792026043 CET	4258	40130	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:29.792071104 CET	4258	40130	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:29.792196989 CET	40130	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:29.792306900 CET	40130	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:29.793524981 CET	40132	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:29.912187099 CET	4258	40130	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:29.913245916 CET	4258	40132	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:29.913655043 CET	40132	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:29.913655996 CET	40132	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:30.033612967 CET	4258	40132	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:31.091257095 CET	4258	40132	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:31.091309071 CET	4258	40132	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:31.091403008 CET	40132	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:31.091442108 CET	40132	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:31.092472076 CET	40134	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:31.211441994 CET	4258	40132	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:31.212719917 CET	4258	40134	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:31.212949991 CET	40134	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:31.212949991 CET	40134	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:31.334115982 CET	4258	40134	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:32.361074924 CET	4258	40134	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:32.361099958 CET	4258	40134	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:32.361526966 CET	40134	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:32.361527920 CET	40134	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:32.362854958 CET	40136	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:32.481734991 CET	4258	40134	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:32.482764006 CET	4258	40136	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:32.483026028 CET	40136	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:32.483293056 CET	40136	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:32.603121996 CET	4258	40136	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:33.735519886 CET	4258	40136	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:33.735579967 CET	4258	40136	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:33.735753059 CET	40136	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:33.736005068 CET	40136	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:33.737278938 CET	40138	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:33.856399059 CET	4258	40136	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:33.857244968 CET	4258	40138	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:33.857557058 CET	40138	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:33.857557058 CET	40138	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:33.978406906 CET	4258	40138	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:35.036334991 CET	4258	40138	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:35.036534071 CET	4258	40138	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:35.036669970 CET	40138	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:35.036669970 CET	40138	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:35.038305998 CET	40140	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:35.156487942 CET	4258	40138	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:35.158032894 CET	4258	40140	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:35.158313036 CET	40140	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:35.158313036 CET	40140	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:35.279274940 CET	4258	40140	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:36.336756945 CET	4258	40140	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:36.336920023 CET	4258	40140	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:36.337095022 CET	40140	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:36.337095022 CET	40140	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:36.337873936 CET	40142	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:36.458574057 CET	4258	40140	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:36.458626986 CET	4258	40142	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:36.458910942 CET	40142	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:36.458911896 CET	40142	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:36.578908920 CET	4258	40142	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:37.607512951 CET	4258	40142	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:37.607683897 CET	4258	40142	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:37.607734919 CET	40142	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:37.607825041 CET	40142	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:37.609672070 CET	40144	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:37.727863073 CET	4258	40142	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:37.730340004 CET	4258	40144	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:37.730510950 CET	40144	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:37.730643988 CET	40144	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:37.850809097 CET	4258	40144	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:38.886548996 CET	4258	40144	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:38.886600018 CET	4258	40144	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:38.886856079 CET	40144	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:38.886856079 CET	40144	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:38.888520002 CET	40146	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:39.007194042 CET	4258	40144	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:39.008395910 CET	4258	40146	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:39.008821011 CET	40146	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:39.008821964 CET	40146	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:39.128874063 CET	4258	40146	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:40.166737080 CET	4258	40146	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:40.167109966 CET	4258	40146	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:40.167148113 CET	40146	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:40.167263985 CET	40146	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:40.168535948 CET	40148	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:40.287065983 CET	4258	40146	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:40.288202047 CET	4258	40148	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:40.288516045 CET	40148	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:40.288516045 CET	40148	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:40.408174038 CET	4258	40148	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:41.456542969 CET	4258	40148	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:41.456579924 CET	4258	40148	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:41.456769943 CET	40148	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:41.456769943 CET	40148	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:41.457529068 CET	40150	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:41.576494932 CET	4258	40148	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:41.577178001 CET	4258	40150	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:41.577548027 CET	40150	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:41.577548027 CET	40150	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:41.697257042 CET	4258	40150	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:42.769318104 CET	4258	40150	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:42.769368887 CET	4258	40150	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:42.769646883 CET	40150	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:42.769646883 CET	40150	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:42.771971941 CET	40152	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:42.889995098 CET	4258	40150	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:42.891741037 CET	4258	40152	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:42.892107010 CET	40152	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:42.892204046 CET	40152	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:43.012178898 CET	4258	40152	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:44.049710989 CET	4258	40152	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:44.049761057 CET	4258	40152	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:44.050040007 CET	40152	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:44.050040007 CET	40152	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:44.051954985 CET	40154	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:44.170135975 CET	4258	40152	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:44.171988964 CET	4258	40154	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:44.172311068 CET	40154	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:44.172311068 CET	40154	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:44.293848991 CET	4258	40154	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:45.348335981 CET	4258	40154	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:45.348386049 CET	4258	40154	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:45.348675966 CET	40154	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:45.348675966 CET	40154	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:45.349813938 CET	40156	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:45.468764067 CET	4258	40154	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:45.469389915 CET	4258	40156	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:45.469611883 CET	40156	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:45.469611883 CET	40156	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:45.589508057 CET	4258	40156	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:46.647809982 CET	4258	40156	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:46.647861004 CET	4258	40156	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:46.648189068 CET	40156	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:46.648542881 CET	40156	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:46.649672031 CET	40158	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:46.768429995 CET	4258	40156	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:46.769366980 CET	4258	40158	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:46.769645929 CET	40158	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:46.769824028 CET	40158	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:46.889657974 CET	4258	40158	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:47.946902990 CET	4258	40158	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:47.946928024 CET	4258	40158	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:47.947092056 CET	40158	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:47.947092056 CET	40158	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:47.948096991 CET	40160	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:48.066745996 CET	4258	40158	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:48.067725897 CET	4258	40160	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:48.067838907 CET	40160	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:48.067838907 CET	40160	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:48.187695980 CET	4258	40160	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:49.222606897 CET	4258	40160	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:49.222701073 CET	4258	40160	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:49.222805023 CET	40160	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:49.222884893 CET	40160	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:49.223788023 CET	40162	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:49.342492104 CET	4258	40160	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:49.343493938 CET	4258	40162	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:49.343719959 CET	40162	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:49.343719959 CET	40162	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:49.464771032 CET	4258	40162	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:50.513856888 CET	4258	40162	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:50.513950109 CET	4258	40162	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:50.514203072 CET	40162	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:50.514203072 CET	40162	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:50.515352964 CET	40164	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:50.634530067 CET	4258	40162	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:50.635509968 CET	4258	40164	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:50.635689020 CET	40164	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:50.635745049 CET	40164	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:50.755412102 CET	4258	40164	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:51.808377028 CET	4258	40164	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:51.808434010 CET	4258	40164	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:51.808582067 CET	40164	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:51.808633089 CET	40164	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:51.809617996 CET	40166	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:51.928369999 CET	4258	40164	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:51.929157972 CET	4258	40166	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:51.929344893 CET	40166	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:51.929404974 CET	40166	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:52.049204111 CET	4258	40166	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:53.083532095 CET	4258	40166	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:53.083672047 CET	40166	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:53.083726883 CET	4258	40166	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:53.083839893 CET	40166	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:53.084657907 CET	40168	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:53.204031944 CET	4258	40166	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:53.204600096 CET	4258	40168	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:53.204807043 CET	40168	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:53.204864979 CET	40168	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:53.325082064 CET	4258	40168	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:54.358681917 CET	4258	40168	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:54.358706951 CET	4258	40168	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:54.358906031 CET	40168	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:54.358956099 CET	40168	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:54.359755039 CET	40170	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:54.478641033 CET	4258	40168	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:54.479378939 CET	4258	40170	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:54.479517937 CET	40170	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:54.479561090 CET	40170	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:54.599396944 CET	4258	40170	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:55.689074993 CET	4258	40170	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:55.689130068 CET	4258	40170	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:55.689323902 CET	40170	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:55.689402103 CET	40170	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:55.691143036 CET	40172	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:55.809025049 CET	4258	40170	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:55.810789108 CET	4258	40172	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:55.810951948 CET	40172	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:55.811001062 CET	40172	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:55.931621075 CET	4258	40172	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:57.007770061 CET	4258	40172	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:57.007792950 CET	4258	40172	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:57.007930994 CET	40172	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:57.008022070 CET	40172	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:57.008754969 CET	40174	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:57.127640963 CET	4258	40172	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:57.128429890 CET	4258	40174	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:57.128779888 CET	40174	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:57.128835917 CET	40174	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:57.248644114 CET	4258	40174	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:58.286923885 CET	4258	40174	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:58.286990881 CET	4258	40174	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:58.287415981 CET	40174	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:58.287491083 CET	40174	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:58.288502932 CET	40176	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:58.407186031 CET	4258	40174	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:58.408080101 CET	4258	40176	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:58.408227921 CET	40176	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:58.408282042 CET	40176	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:58.529156923 CET	4258	40176	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:59.641349077 CET	4258	40176	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:59.641393900 CET	4258	40176	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:59.641563892 CET	40176	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:59.641654968 CET	40176	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:59.642498016 CET	40178	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:59.761440039 CET	4258	40176	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:59.762063026 CET	4258	40178	185.216.71.152	192.168.2.13
Dec 22, 2024 16:02:59.762218952 CET	40178	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:59.762257099 CET	40178	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:02:59.882421970 CET	4258	40178	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:00.972012043 CET	4258	40178	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:00.972095966 CET	4258	40178	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:00.972146034 CET	40178	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:00.972186089 CET	40178	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:00.972721100 CET	40180	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:01.091814995 CET	4258	40178	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:01.092472076 CET	4258	40180	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:01.092626095 CET	40180	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:01.092709064 CET	40180	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:01.212629080 CET	4258	40180	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:02.257333040 CET	4258	40180	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:02.257354975 CET	4258	40180	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:02.257585049 CET	40180	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:02.257673025 CET	40180	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:02.258392096 CET	40182	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:02.377774954 CET	4258	40180	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:02.378007889 CET	4258	40182	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:02.378309965 CET	40182	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:02.378309965 CET	40182	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:02.498481989 CET	4258	40182	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:03.574803114 CET	4258	40182	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:03.574947119 CET	4258	40182	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:03.575244904 CET	40182	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:03.575244904 CET	40182	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:03.576117039 CET	40184	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:03.696156979 CET	4258	40182	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:03.696505070 CET	4258	40184	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:03.696727037 CET	40184	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:03.696757078 CET	40184	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:03.816946983 CET	4258	40184	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:05.111748934 CET	4258	40184	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:05.112114906 CET	40184	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:05.113229990 CET	40186	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:05.231730938 CET	4258	40184	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:05.233838081 CET	4258	40186	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:05.233975887 CET	40186	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:05.234030008 CET	40186	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:05.353652954 CET	4258	40186	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:06.426580906 CET	4258	40186	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:06.426640034 CET	4258	40186	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:06.426801920 CET	40186	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:06.426888943 CET	40186	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:06.427798986 CET	40188	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:06.546410084 CET	4258	40186	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:06.547370911 CET	4258	40188	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:06.547784090 CET	40188	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:06.547784090 CET	40188	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:06.667496920 CET	4258	40188	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:07.704593897 CET	4258	40188	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:07.704668045 CET	4258	40188	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:07.704936028 CET	40188	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:07.705013037 CET	40188	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:07.705951929 CET	40190	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:07.827088118 CET	4258	40188	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:07.828028917 CET	4258	40190	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:07.828360081 CET	40190	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:07.828435898 CET	40190	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:07.948368073 CET	4258	40190	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:08.993124008 CET	4258	40190	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:08.993338108 CET	40190	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:08.993541002 CET	4258	40190	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:08.993644953 CET	40190	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:08.994611025 CET	40192	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:09.113284111 CET	4258	40190	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:09.114166975 CET	4258	40192	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:09.114321947 CET	40192	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:09.114381075 CET	40192	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:09.234812975 CET	4258	40192	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:10.290457964 CET	4258	40192	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:10.290538073 CET	4258	40192	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:10.290705919 CET	40192	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:10.290787935 CET	40192	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:10.291616917 CET	40194	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:10.410671949 CET	4258	40192	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:10.411349058 CET	4258	40194	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:10.411524057 CET	40194	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:10.411571980 CET	40194	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:10.531229973 CET	4258	40194	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:11.557630062 CET	4258	40194	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:11.557699919 CET	4258	40194	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:11.557833910 CET	40194	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:11.557835102 CET	40194	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:11.558378935 CET	40196	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:11.677783012 CET	4258	40194	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:11.678030968 CET	4258	40196	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:11.678349972 CET	40196	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:11.678350925 CET	40196	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:11.798424959 CET	4258	40196	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:12.828963041 CET	4258	40196	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:12.829055071 CET	4258	40196	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:12.829257965 CET	40196	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:12.829257965 CET	40196	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:12.829891920 CET	40198	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:12.950432062 CET	4258	40196	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:12.950740099 CET	4258	40198	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:12.950891972 CET	40198	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:12.950891972 CET	40198	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:13.070810080 CET	4258	40198	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:14.125169039 CET	4258	40198	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:14.125350952 CET	4258	40198	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:14.125355005 CET	40198	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:14.125444889 CET	40198	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:14.126245975 CET	40200	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:14.245034933 CET	4258	40198	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:14.245810032 CET	4258	40200	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:14.246007919 CET	40200	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:14.246007919 CET	40200	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:14.365957022 CET	4258	40200	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:15.414804935 CET	4258	40200	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:15.414839983 CET	4258	40200	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:15.415251017 CET	40200	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:15.415421963 CET	40200	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:15.416273117 CET	40202	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:15.535118103 CET	4258	40200	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:15.535911083 CET	4258	40202	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:15.536091089 CET	40202	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:15.536132097 CET	40202	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:15.655705929 CET	4258	40202	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:16.745985031 CET	4258	40202	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:16.746191978 CET	4258	40202	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:16.746263981 CET	40202	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:16.746314049 CET	40202	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:16.747145891 CET	40204	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:16.866329908 CET	4258	40202	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:16.866836071 CET	4258	40204	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:16.867014885 CET	40204	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:16.867073059 CET	40204	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:16.986680984 CET	4258	40204	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:18.042114973 CET	4258	40204	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:18.042155027 CET	4258	40204	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:18.042464972 CET	40204	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:18.042465925 CET	40204	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:18.043437958 CET	40206	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:18.163024902 CET	4258	40204	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:18.163752079 CET	4258	40206	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:18.163856983 CET	40206	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:18.163944006 CET	40206	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:18.283674002 CET	4258	40206	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:19.378001928 CET	4258	40206	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:19.378084898 CET	4258	40206	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:19.378165960 CET	40206	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:19.378328085 CET	40206	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:19.379151106 CET	40208	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:19.498107910 CET	4258	40206	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:19.498807907 CET	4258	40208	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:19.499012947 CET	40208	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:19.499174118 CET	40208	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:19.618918896 CET	4258	40208	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:20.704004049 CET	4258	40208	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:20.704093933 CET	4258	40208	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:20.704345942 CET	40208	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:20.704345942 CET	40208	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:20.705187082 CET	40210	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:20.824146986 CET	4258	40208	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:20.824667931 CET	4258	40210	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:20.824816942 CET	40210	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:20.824894905 CET	40210	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:20.944492102 CET	4258	40210	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:21.972039938 CET	4258	40210	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:21.972071886 CET	4258	40210	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:21.972362041 CET	40210	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:21.972513914 CET	40210	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:21.973246098 CET	40212	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:22.092145920 CET	4258	40210	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:22.093307972 CET	4258	40212	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:22.093612909 CET	40212	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:22.093614101 CET	40212	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:22.213383913 CET	4258	40212	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:23.257936954 CET	4258	40212	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:23.257966042 CET	4258	40212	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:23.258225918 CET	40212	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:23.258225918 CET	40212	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:23.258722067 CET	40214	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:23.378132105 CET	4258	40212	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:23.378343105 CET	4258	40214	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:23.378547907 CET	40214	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:23.378547907 CET	40214	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:23.498310089 CET	4258	40214	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:24.543553114 CET	4258	40214	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:24.543667078 CET	4258	40214	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:24.543740034 CET	40214	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:24.543787956 CET	40214	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:24.544621944 CET	40216	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:24.664165020 CET	4258	40214	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:24.664985895 CET	4258	40216	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:24.665096045 CET	40216	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:24.665117979 CET	40216	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:24.784689903 CET	4258	40216	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:25.842180967 CET	4258	40216	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:25.842261076 CET	4258	40216	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:25.842394114 CET	40216	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:25.842514038 CET	40216	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:25.843327999 CET	40218	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:25.962147951 CET	4258	40216	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:25.962927103 CET	4258	40218	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:25.963330030 CET	40218	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:25.963330984 CET	40218	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:26.083761930 CET	4258	40218	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:27.144023895 CET	4258	40218	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:27.144154072 CET	4258	40218	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:27.144429922 CET	40218	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:27.144504070 CET	40218	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:27.145287991 CET	40220	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:27.264276981 CET	4258	40218	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:27.264941931 CET	4258	40220	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:27.265089035 CET	40220	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:27.265152931 CET	40220	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:27.384803057 CET	4258	40220	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:28.430748940 CET	4258	40220	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:28.430809021 CET	4258	40220	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:28.430929899 CET	40220	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:28.430984974 CET	40220	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:28.431644917 CET	40222	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:28.550654888 CET	4258	40220	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:28.551201105 CET	4258	40222	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:28.551378012 CET	40222	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:28.551465034 CET	40222	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:28.671386003 CET	4258	40222	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:29.704756021 CET	4258	40222	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:29.704807043 CET	4258	40222	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:29.705033064 CET	40222	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:29.705152988 CET	40222	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:29.705943108 CET	40224	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:29.825253010 CET	4258	40222	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:29.825849056 CET	4258	40224	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:29.825985909 CET	40224	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:29.826086044 CET	40224	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:29.945636034 CET	4258	40224	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:30.979037046 CET	4258	40224	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:30.979125023 CET	4258	40224	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:30.979343891 CET	40224	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:30.979423046 CET	40224	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:30.980123043 CET	40226	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:31.099097967 CET	4258	40224	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:31.099757910 CET	4258	40226	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:31.099925995 CET	40226	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:31.099925995 CET	40226	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:31.219831944 CET	4258	40226	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:32.255306959 CET	4258	40226	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:32.255417109 CET	4258	40226	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:32.255511999 CET	40226	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:32.255546093 CET	40226	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:32.256093025 CET	40228	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:32.375423908 CET	4258	40226	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:32.375849009 CET	4258	40228	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:32.376013041 CET	40228	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:32.376087904 CET	40228	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:32.496712923 CET	4258	40228	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:33.537611008 CET	4258	40228	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:33.537641048 CET	4258	40228	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:33.537764072 CET	40228	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:33.537765026 CET	40228	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:33.538327932 CET	40230	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:33.657895088 CET	4258	40228	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:33.658041000 CET	4258	40230	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:33.658159971 CET	40230	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:33.658159971 CET	40230	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:33.778489113 CET	4258	40230	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:34.828495979 CET	4258	40230	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:34.828581095 CET	4258	40230	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:34.828676939 CET	40230	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:34.828722000 CET	40230	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:34.829240084 CET	40232	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:34.948445082 CET	4258	40230	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:34.949379921 CET	4258	40232	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:34.949489117 CET	40232	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:34.949536085 CET	40232	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:35.069360971 CET	4258	40232	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:36.149836063 CET	4258	40232	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:36.149876118 CET	4258	40232	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:36.149988890 CET	40232	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:36.150027037 CET	40232	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:36.150526047 CET	40234	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:36.270062923 CET	4258	40232	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:36.270509005 CET	4258	40234	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:36.270709038 CET	40234	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:36.270744085 CET	40234	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:36.390486002 CET	4258	40234	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:37.435915947 CET	4258	40234	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:37.435950994 CET	4258	40234	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:37.436105013 CET	40234	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:37.436167002 CET	40234	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:37.437378883 CET	40236	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:37.556454897 CET	4258	40234	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:37.557404995 CET	4258	40236	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:37.557527065 CET	40236	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:37.557602882 CET	40236	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:37.677335024 CET	4258	40236	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:38.704885006 CET	4258	40236	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:38.705111980 CET	4258	40236	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:38.705280066 CET	40236	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:38.705343008 CET	40236	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:38.706134081 CET	40238	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:38.825694084 CET	4258	40236	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:38.826478958 CET	4258	40238	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:38.826725960 CET	40238	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:38.826725960 CET	40238	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:38.947165012 CET	4258	40238	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:39.996165991 CET	4258	40238	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:39.996284962 CET	40238	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:39.996351004 CET	4258	40238	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:39.996454000 CET	40238	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:39.997129917 CET	40240	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:40.116344929 CET	4258	40238	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:40.116928101 CET	4258	40240	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:40.116995096 CET	40240	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:40.117027998 CET	40240	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:40.236627102 CET	4258	40240	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:41.279066086 CET	4258	40240	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:41.279200077 CET	40240	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:41.279280901 CET	4258	40240	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:41.279397964 CET	40240	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:41.280352116 CET	40242	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:41.401473999 CET	4258	40240	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:41.402136087 CET	4258	40242	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:41.402273893 CET	40242	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:41.402350903 CET	40242	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:41.522289038 CET	4258	40242	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:42.549328089 CET	4258	40242	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:42.549350023 CET	4258	40242	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:42.549498081 CET	40242	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:42.549545050 CET	40242	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:42.550204039 CET	40244	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:42.672224998 CET	4258	40242	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:42.672642946 CET	4258	40244	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:42.672760010 CET	40244	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:42.672802925 CET	40244	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:42.793190002 CET	4258	40244	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:43.862839937 CET	4258	40244	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:43.862900019 CET	4258	40244	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:43.863040924 CET	40244	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:43.863147020 CET	40244	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:43.864182949 CET	40246	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:43.982975006 CET	4258	40244	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:43.983985901 CET	4258	40246	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:43.984133005 CET	40246	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:43.984217882 CET	40246	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:44.106422901 CET	4258	40246	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:45.147023916 CET	4258	40246	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:45.147046089 CET	4258	40246	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:45.147249937 CET	40246	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:45.147373915 CET	40246	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:45.148123026 CET	40248	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:45.266928911 CET	4258	40246	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:45.267663002 CET	4258	40248	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:45.267741919 CET	40248	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:45.267790079 CET	40248	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:45.387578964 CET	4258	40248	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:46.458619118 CET	4258	40248	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:46.458636045 CET	4258	40248	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:46.458805084 CET	40248	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:46.458899021 CET	40248	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:46.460022926 CET	40250	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:46.578769922 CET	4258	40248	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:46.579538107 CET	4258	40250	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:46.579670906 CET	40250	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:46.579720020 CET	40250	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:46.699430943 CET	4258	40250	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:47.757158995 CET	4258	40250	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:47.757245064 CET	4258	40250	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:47.757297039 CET	40250	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:47.757343054 CET	40250	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:47.757971048 CET	40252	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:47.877429008 CET	4258	40250	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:47.877856970 CET	4258	40252	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:47.877944946 CET	40252	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:47.877945900 CET	40252	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:47.998137951 CET	4258	40252	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:49.190984011 CET	4258	40252	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:49.191037893 CET	4258	40252	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:49.191210985 CET	40252	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:49.191301107 CET	40252	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:49.192044973 CET	40254	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:49.310916901 CET	4258	40252	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:49.311616898 CET	4258	40254	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:49.311753988 CET	40254	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:49.311819077 CET	40254	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:49.431437969 CET	4258	40254	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:50.492288113 CET	4258	40254	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:50.492312908 CET	4258	40254	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:50.492455959 CET	40254	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:50.492594004 CET	40254	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:50.493421078 CET	40256	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:50.618407011 CET	4258	40254	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:50.619024038 CET	4258	40256	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:50.619103909 CET	40256	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:50.619164944 CET	40256	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:50.738816023 CET	4258	40256	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:54.777870893 CET	4258	40256	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:54.777964115 CET	4258	40256	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:54.778031111 CET	40256	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:54.778157949 CET	40256	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:54.778712034 CET	40258	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:54.897661924 CET	4258	40256	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:54.898210049 CET	4258	40258	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:54.898343086 CET	40258	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:54.898343086 CET	40258	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:55.185148001 CET	4258	40258	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:56.219568014 CET	4258	40258	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:56.219665051 CET	4258	40258	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:56.219691992 CET	40258	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:56.219722986 CET	40258	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:56.220285892 CET	40260	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:56.342475891 CET	4258	40258	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:56.343250990 CET	4258	40260	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:56.343441010 CET	40260	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:56.343482971 CET	40260	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:56.463128090 CET	4258	40260	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:57.519978046 CET	4258	40260	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:57.519996881 CET	4258	40260	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:57.520325899 CET	40260	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:57.520416021 CET	40260	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:57.521234035 CET	40262	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:57.640012026 CET	4258	40260	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:57.640846014 CET	4258	40262	185.216.71.152	192.168.2.13
Dec 22, 2024 16:03:57.640958071 CET	40262	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:57.641019106 CET	40262	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:03:57.760639906 CET	4258	40262	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:01.930366039 CET	4258	40262	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:01.930381060 CET	4258	40262	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:01.930560112 CET	40262	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:01.930560112 CET	40262	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:01.931387901 CET	40264	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:02.052172899 CET	4258	40262	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:02.053420067 CET	4258	40264	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:02.053545952 CET	40264	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:02.053545952 CET	40264	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:02.173187971 CET	4258	40264	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:03.268698931 CET	4258	40264	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:03.268857002 CET	4258	40264	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:03.268893957 CET	40264	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:03.268992901 CET	40264	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:03.269777060 CET	40266	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:03.388942957 CET	4258	40264	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:03.389513969 CET	4258	40266	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:03.389694929 CET	40266	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:03.389694929 CET	40266	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:03.509363890 CET	4258	40266	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:04.871848106 CET	4258	40266	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:04.871877909 CET	4258	40266	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:04.872152090 CET	40266	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:04.872153044 CET	40266	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:04.873322010 CET	40268	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:04.992464066 CET	4258	40266	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:04.993385077 CET	4258	40268	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:04.993505001 CET	40268	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:04.993583918 CET	40268	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:05.113698959 CET	4258	40268	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:06.225162983 CET	4258	40268	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:06.225294113 CET	4258	40268	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:06.225435972 CET	40268	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:06.225519896 CET	40268	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:06.226341009 CET	40270	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:06.345099926 CET	4258	40268	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:06.345953941 CET	4258	40270	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:06.346173048 CET	40270	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:06.346215963 CET	40270	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:06.467462063 CET	4258	40270	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:07.528709888 CET	4258	40270	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:07.528764963 CET	4258	40270	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:07.529066086 CET	40270	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:07.529156923 CET	40270	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:07.529953003 CET	40272	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:07.649766922 CET	4258	40270	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:07.650687933 CET	4258	40272	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:07.650819063 CET	40272	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:07.650856972 CET	40272	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:07.770586014 CET	4258	40272	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:08.820384026 CET	4258	40272	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:08.820674896 CET	40272	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:08.820847988 CET	4258	40272	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:08.820952892 CET	40272	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:08.821964979 CET	40274	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:08.940489054 CET	4258	40272	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:08.941406012 CET	4258	40274	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:08.941514015 CET	40274	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:08.941576004 CET	40274	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:09.061116934 CET	4258	40274	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:10.448921919 CET	4258	40274	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:10.449265957 CET	40274	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:10.450200081 CET	40276	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:10.569036961 CET	4258	40274	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:10.569812059 CET	4258	40276	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:10.570091009 CET	40276	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:10.570182085 CET	40276	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:10.689790964 CET	4258	40276	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:11.826641083 CET	4258	40276	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:11.826766014 CET	4258	40276	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:11.827030897 CET	40276	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:11.827126980 CET	40276	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:11.827941895 CET	40278	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:11.947011948 CET	4258	40276	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:11.947608948 CET	4258	40278	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:11.947710991 CET	40278	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:11.947794914 CET	40278	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:12.067446947 CET	4258	40278	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:13.126125097 CET	4258	40278	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:13.126295090 CET	4258	40278	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:13.126395941 CET	40278	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:13.126475096 CET	40278	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:13.127298117 CET	40280	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:13.246395111 CET	4258	40278	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:13.247159004 CET	4258	40280	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:13.247358084 CET	40280	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:13.247358084 CET	40280	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:13.367760897 CET	4258	40280	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:14.405916929 CET	4258	40280	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:14.406011105 CET	4258	40280	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:14.406209946 CET	40280	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:14.406285048 CET	40280	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:14.407087088 CET	40282	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:14.525974035 CET	4258	40280	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:14.526686907 CET	4258	40282	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:14.526927948 CET	40282	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:14.526974916 CET	40282	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:14.646611929 CET	4258	40282	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:15.674398899 CET	4258	40282	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:15.674493074 CET	4258	40282	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:15.674635887 CET	40282	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:15.674710989 CET	40282	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:15.675617933 CET	40284	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:15.794243097 CET	4258	40282	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:15.796494961 CET	4258	40284	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:15.796740055 CET	40284	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:15.796794891 CET	40284	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:15.916384935 CET	4258	40284	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:17.133358955 CET	4258	40284	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:17.133394003 CET	4258	40284	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:17.133543015 CET	40284	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:17.133640051 CET	40284	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:17.134399891 CET	40286	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:17.253300905 CET	4258	40284	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:17.254031897 CET	4258	40286	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:17.254260063 CET	40286	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:17.254331112 CET	40286	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:17.373903990 CET	4258	40286	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:18.524383068 CET	4258	40286	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:18.524485111 CET	4258	40286	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:18.524791002 CET	40286	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:18.524878025 CET	40286	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:18.525875092 CET	40288	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:18.644798040 CET	4258	40286	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:18.645642042 CET	4258	40288	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:18.645808935 CET	40288	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:18.645848036 CET	40288	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:18.765553951 CET	4258	40288	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:19.885993004 CET	4258	40288	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:19.886043072 CET	4258	40288	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:19.886329889 CET	40288	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:19.886384964 CET	40288	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:19.887600899 CET	40290	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:20.006162882 CET	4258	40288	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:20.007195950 CET	4258	40290	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:20.007375002 CET	40290	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:20.007427931 CET	40290	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:20.127134085 CET	4258	40290	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:21.224348068 CET	4258	40290	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:21.224400043 CET	4258	40290	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:21.224555969 CET	40290	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:21.224622011 CET	40290	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:21.225415945 CET	40292	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:21.344623089 CET	4258	40290	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:21.345134974 CET	4258	40292	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:21.345218897 CET	40292	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:21.345386982 CET	40292	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:21.465014935 CET	4258	40292	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:22.493062019 CET	4258	40292	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:22.493119955 CET	4258	40292	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:22.493489027 CET	40292	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:22.493489027 CET	40292	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:22.495104074 CET	40294	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:22.613656044 CET	4258	40292	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:22.615581036 CET	4258	40294	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:22.615978956 CET	40294	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:22.615978956 CET	40294	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:22.736018896 CET	4258	40294	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:23.777112961 CET	4258	40294	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:23.777195930 CET	4258	40294	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:23.777451038 CET	40294	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:23.777451038 CET	40294	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:23.778587103 CET	40296	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:23.897191048 CET	4258	40294	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:23.898541927 CET	4258	40296	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:23.898789883 CET	40296	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:23.898789883 CET	40296	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:24.018779993 CET	4258	40296	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:25.064338923 CET	4258	40296	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:25.064393997 CET	4258	40296	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:25.064773083 CET	40296	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:25.064773083 CET	40296	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:25.065506935 CET	40298	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:25.184567928 CET	4258	40296	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:25.185092926 CET	4258	40298	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:25.185338020 CET	40298	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:25.185532093 CET	40298	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:25.305303097 CET	4258	40298	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:26.345428944 CET	4258	40298	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:26.345549107 CET	4258	40298	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:26.345771074 CET	40298	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:26.345772028 CET	40298	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:26.346765041 CET	40300	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:26.465984106 CET	4258	40298	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:26.466861963 CET	4258	40300	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:26.467259884 CET	40300	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:26.467259884 CET	40300	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:26.587726116 CET	4258	40300	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:27.644155979 CET	4258	40300	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:27.644237041 CET	4258	40300	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:27.644418001 CET	40300	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:27.644418001 CET	40300	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:27.644980907 CET	40302	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:27.765958071 CET	4258	40300	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:27.766247034 CET	4258	40302	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:27.766549110 CET	40302	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:27.766575098 CET	40302	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:27.888290882 CET	4258	40302	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:28.935342073 CET	4258	40302	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:28.935404062 CET	4258	40302	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:28.935882092 CET	40302	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:28.935883045 CET	40302	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:28.936492920 CET	40304	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:29.055686951 CET	4258	40302	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:29.056122065 CET	4258	40304	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:29.056354046 CET	40304	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:29.056449890 CET	40304	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:29.176043987 CET	4258	40304	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:30.217243910 CET	4258	40304	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:30.217329979 CET	4258	40304	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:30.217490911 CET	40304	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:30.217490911 CET	40304	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:30.218383074 CET	40306	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:30.337227106 CET	4258	40304	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:30.338021040 CET	4258	40306	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:30.338329077 CET	40306	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:30.338329077 CET	40306	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:30.457962036 CET	4258	40306	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:31.503242970 CET	4258	40306	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:31.503304005 CET	4258	40306	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:31.503657103 CET	40306	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:31.503657103 CET	40306	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:31.504395962 CET	40308	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:31.624990940 CET	4258	40306	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:31.625030994 CET	4258	40308	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:31.625340939 CET	40308	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:31.625340939 CET	40308	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:31.745091915 CET	4258	40308	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:32.803626060 CET	4258	40308	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:32.803821087 CET	40308	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:32.804198027 CET	4258	40308	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:32.804295063 CET	40308	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:32.805201054 CET	40310	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:32.924746990 CET	4258	40308	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:32.925529003 CET	4258	40310	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:32.925762892 CET	40310	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:32.925832987 CET	40310	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:33.046555042 CET	4258	40310	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:34.048120975 CET	35038	53	192.168.2.13	8.8.8.8
Dec 22, 2024 16:04:34.074009895 CET	4258	40310	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:34.074032068 CET	4258	40310	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:34.074075937 CET	40310	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:34.074114084 CET	40310	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:34.074681044 CET	40314	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:34.168834925 CET	53	35038	8.8.8.8	192.168.2.13
Dec 22, 2024 16:04:34.168916941 CET	35038	53	192.168.2.13	8.8.8.8
Dec 22, 2024 16:04:34.168970108 CET	35038	53	192.168.2.13	8.8.8.8
Dec 22, 2024 16:04:34.169007063 CET	35038	53	192.168.2.13	8.8.8.8
Dec 22, 2024 16:04:34.193691015 CET	4258	40310	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:34.194261074 CET	4258	40314	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:34.194330931 CET	40314	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:34.194397926 CET	40314	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:34.288952112 CET	53	35038	8.8.8.8	192.168.2.13
Dec 22, 2024 16:04:34.289078951 CET	53	35038	8.8.8.8	192.168.2.13
Dec 22, 2024 16:04:34.315341949 CET	4258	40314	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:35.254025936 CET	53	35038	8.8.8.8	192.168.2.13
Dec 22, 2024 16:04:35.254328966 CET	35038	53	192.168.2.13	8.8.8.8
Dec 22, 2024 16:04:35.353126049 CET	4258	40314	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:35.353204012 CET	40314	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:35.353316069 CET	4258	40314	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:35.353399038 CET	40314	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:35.354938030 CET	40316	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:35.473602057 CET	4258	40314	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:35.474579096 CET	4258	40316	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:35.474641085 CET	40316	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:35.474663973 CET	40316	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:35.489944935 CET	53	35038	8.8.8.8	192.168.2.13
Dec 22, 2024 16:04:35.490010977 CET	35038	53	192.168.2.13	8.8.8.8
Dec 22, 2024 16:04:35.594280958 CET	4258	40316	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:36.627676964 CET	4258	40316	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:36.627832890 CET	4258	40316	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:36.627895117 CET	40316	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:36.627896070 CET	40316	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:36.628583908 CET	40318	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:36.748087883 CET	4258	40316	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:36.748456001 CET	4258	40318	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:36.752599001 CET	40318	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:36.752599001 CET	40318	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:36.873928070 CET	4258	40318	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:37.254352093 CET	53	35038	8.8.8.8	192.168.2.13
Dec 22, 2024 16:04:37.254755974 CET	35038	53	192.168.2.13	8.8.8.8
Dec 22, 2024 16:04:37.374648094 CET	53	35038	8.8.8.8	192.168.2.13
Dec 22, 2024 16:04:37.908454895 CET	4258	40318	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:37.908524036 CET	4258	40318	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:37.908860922 CET	40318	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:37.908860922 CET	40318	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:37.909564018 CET	40320	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:38.029563904 CET	4258	40318	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:38.030543089 CET	4258	40320	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:38.030776978 CET	40320	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:38.030776978 CET	40320	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:38.150815964 CET	4258	40320	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:39.198420048 CET	4258	40320	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:39.198466063 CET	4258	40320	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:39.198688030 CET	40320	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:39.198880911 CET	40320	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:39.199534893 CET	40322	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:39.318746090 CET	4258	40320	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:39.319330931 CET	4258	40322	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:39.319459915 CET	40322	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:39.319461107 CET	40322	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:39.439265966 CET	4258	40322	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:40.481967926 CET	4258	40322	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:40.482105017 CET	4258	40322	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:40.482206106 CET	40322	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:40.482263088 CET	40322	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:40.483011007 CET	40324	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:40.602509975 CET	4258	40322	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:40.602730036 CET	4258	40324	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:40.602814913 CET	40324	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:40.602833033 CET	40324	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:40.722461939 CET	4258	40324	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:41.770518064 CET	4258	40324	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:41.770554066 CET	4258	40324	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:41.770744085 CET	40324	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:41.770777941 CET	40324	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:41.771553993 CET	40326	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:41.890810966 CET	4258	40324	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:41.891339064 CET	4258	40326	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:41.891458035 CET	40326	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:41.891496897 CET	40326	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:42.011120081 CET	4258	40326	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:43.051127911 CET	4258	40326	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:43.051224947 CET	4258	40326	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:43.051388979 CET	40326	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:43.051388979 CET	40326	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:43.051990986 CET	40328	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:43.171166897 CET	4258	40326	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:43.171679020 CET	4258	40328	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:43.171811104 CET	40328	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:43.171865940 CET	40328	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:43.291822910 CET	4258	40328	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:44.336869955 CET	4258	40328	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:44.336992025 CET	4258	40328	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:44.337413073 CET	40328	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:44.337641954 CET	40328	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:44.338610888 CET	40330	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:44.457326889 CET	4258	40328	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:44.458246946 CET	4258	40330	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:44.458374977 CET	40330	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:44.458482027 CET	40330	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:44.578201056 CET	4258	40330	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:45.620281935 CET	4258	40330	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:45.620356083 CET	4258	40330	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:45.620465994 CET	40330	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:45.620554924 CET	40330	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:45.621258974 CET	40332	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:45.740286112 CET	4258	40330	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:45.740880966 CET	4258	40332	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:45.741061926 CET	40332	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:45.741127968 CET	40332	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:45.860763073 CET	4258	40332	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:46.915348053 CET	4258	40332	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:46.915427923 CET	4258	40332	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:46.915591955 CET	40332	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:46.915704966 CET	40332	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:46.916892052 CET	40334	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:47.035525084 CET	4258	40332	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:47.036470890 CET	4258	40334	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:47.036647081 CET	40334	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:47.036710978 CET	40334	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:47.156447887 CET	4258	40334	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:48.209346056 CET	4258	40334	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:48.209407091 CET	4258	40334	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:48.209578991 CET	40334	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:48.209673882 CET	40334	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:48.210908890 CET	40336	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:48.329374075 CET	4258	40334	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:48.330476999 CET	4258	40336	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:48.330611944 CET	40336	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:48.330667973 CET	40336	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:48.450423956 CET	4258	40336	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:49.512772083 CET	4258	40336	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:49.512834072 CET	4258	40336	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:49.513175964 CET	40336	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:49.513261080 CET	40336	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:49.515321970 CET	40338	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:49.633151054 CET	4258	40336	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:49.636637926 CET	4258	40338	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:49.636815071 CET	40338	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:49.637036085 CET	40338	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:49.757245064 CET	4258	40338	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:50.796444893 CET	4258	40338	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:50.796499014 CET	4258	40338	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:50.796778917 CET	40338	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:50.796778917 CET	40338	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:50.797806978 CET	40340	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:50.916812897 CET	4258	40338	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:50.917437077 CET	4258	40340	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:50.917665958 CET	40340	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:50.917716026 CET	40340	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:51.038716078 CET	4258	40340	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:52.096257925 CET	4258	40340	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:52.096334934 CET	4258	40340	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:52.096498966 CET	40340	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:52.096581936 CET	40340	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:52.097776890 CET	40342	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:52.216526985 CET	4258	40340	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:52.217366934 CET	4258	40342	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:52.217524052 CET	40342	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:52.217575073 CET	40342	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:52.337110043 CET	4258	40342	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:53.415292025 CET	4258	40342	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:53.415499926 CET	4258	40342	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:53.415530920 CET	40342	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:53.415806055 CET	40342	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:53.417022943 CET	40344	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:53.535942078 CET	4258	40342	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:53.536963940 CET	4258	40344	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:53.537067890 CET	40344	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:53.537148952 CET	40344	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:53.656934977 CET	4258	40344	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:54.703201056 CET	4258	40344	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:54.703263044 CET	4258	40344	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:54.703378916 CET	40344	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:54.703577995 CET	40344	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:54.704746962 CET	40346	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:54.823263884 CET	4258	40344	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:54.824317932 CET	4258	40346	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:54.824564934 CET	40346	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:54.824681997 CET	40346	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:54.944458961 CET	4258	40346	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:56.012499094 CET	4258	40346	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:56.012556076 CET	4258	40346	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:56.012952089 CET	40346	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:56.012952089 CET	40346	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:56.013931990 CET	40348	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:56.135814905 CET	4258	40346	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:56.136362076 CET	4258	40348	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:56.136655092 CET	40348	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:56.136902094 CET	40348	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:56.256373882 CET	4258	40348	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:57.304517031 CET	4258	40348	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:57.304570913 CET	4258	40348	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:57.304785013 CET	40348	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:57.304894924 CET	40348	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:57.306390047 CET	40350	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:57.424532890 CET	4258	40348	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:57.425990105 CET	4258	40350	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:57.426109076 CET	40350	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:57.426141977 CET	40350	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:57.546201944 CET	4258	40350	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:58.616779089 CET	4258	40350	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:58.617134094 CET	40350	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:58.617448092 CET	4258	40350	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:58.617559910 CET	40350	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:58.618767977 CET	40352	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:58.737157106 CET	4258	40350	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:58.738347054 CET	4258	40352	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:58.738548994 CET	40352	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:58.738596916 CET	40352	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:58.858577967 CET	4258	40352	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:59.884717941 CET	4258	40352	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:59.884771109 CET	4258	40352	185.216.71.152	192.168.2.13
Dec 22, 2024 16:04:59.884886980 CET	40352	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:59.884958029 CET	40352	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:04:59.885693073 CET	40354	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:00.004549026 CET	4258	40352	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:00.005316019 CET	4258	40354	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:00.005546093 CET	40354	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:00.005589962 CET	40354	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:00.125293970 CET	4258	40354	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:01.159122944 CET	4258	40354	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:01.159255981 CET	4258	40354	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:01.159353971 CET	40354	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:01.159401894 CET	40354	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:01.160273075 CET	40356	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:01.279604912 CET	4258	40354	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:01.280528069 CET	4258	40356	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:01.280705929 CET	40356	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:01.280757904 CET	40356	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:01.400387049 CET	4258	40356	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:02.444263935 CET	4258	40356	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:02.444488049 CET	40356	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:02.444516897 CET	4258	40356	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:02.444590092 CET	40356	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:02.445678949 CET	40358	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:02.564304113 CET	4258	40356	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:02.565294027 CET	4258	40358	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:02.565613985 CET	40358	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:02.565690041 CET	40358	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:02.685415030 CET	4258	40358	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:03.734713078 CET	4258	40358	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:03.734755039 CET	4258	40358	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:03.735001087 CET	40358	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:03.735095024 CET	40358	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:03.736326933 CET	40360	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:03.854741096 CET	4258	40358	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:03.856146097 CET	4258	40360	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:03.856343985 CET	40360	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:03.856443882 CET	40360	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:03.976049900 CET	4258	40360	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:05.021939993 CET	4258	40360	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:05.021975040 CET	4258	40360	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:05.022097111 CET	40360	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:05.022274971 CET	40360	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:05.023685932 CET	40362	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:05.142000914 CET	4258	40360	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:05.143335104 CET	4258	40362	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:05.143490076 CET	40362	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:05.143490076 CET	40362	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:05.263246059 CET	4258	40362	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:06.300898075 CET	4258	40362	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:06.300945997 CET	4258	40362	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:06.301249027 CET	40362	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:06.301340103 CET	40362	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:06.302498102 CET	40364	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:06.421161890 CET	4258	40362	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:06.422141075 CET	4258	40364	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:06.422288895 CET	40364	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:06.422326088 CET	40364	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:06.541924953 CET	4258	40364	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:07.600090027 CET	4258	40364	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:07.600156069 CET	4258	40364	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:07.600339890 CET	40364	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:07.600410938 CET	40364	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:07.601840973 CET	40366	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:07.720454931 CET	4258	40364	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:07.721499920 CET	4258	40366	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:07.721704006 CET	40366	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:07.721750021 CET	40366	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:07.841500998 CET	4258	40366	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:08.898094893 CET	4258	40366	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:08.898127079 CET	4258	40366	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:08.898464918 CET	40366	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:08.898545980 CET	40366	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:08.899559975 CET	40368	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:09.018233061 CET	4258	40366	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:09.019187927 CET	4258	40368	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:09.019366980 CET	40368	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:09.019486904 CET	40368	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:09.139383078 CET	4258	40368	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:10.190052032 CET	4258	40368	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:10.190071106 CET	4258	40368	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:10.190248966 CET	40368	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:10.190305948 CET	40368	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:10.191394091 CET	40370	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:10.311979055 CET	4258	40368	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:10.312930107 CET	4258	40370	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:10.313178062 CET	40370	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:10.313227892 CET	40370	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:10.432979107 CET	4258	40370	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:11.478894949 CET	4258	40370	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:11.478952885 CET	4258	40370	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:11.479196072 CET	40370	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:11.479196072 CET	40370	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:11.479919910 CET	40372	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:11.598946095 CET	4258	40370	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:11.599554062 CET	4258	40372	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:11.599694967 CET	40372	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:11.599752903 CET	40372	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:11.719638109 CET	4258	40372	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:12.761599064 CET	4258	40372	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:12.761650085 CET	4258	40372	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:12.761842012 CET	40372	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:12.761948109 CET	40372	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:12.762934923 CET	40374	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:12.882431030 CET	4258	40372	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:12.883563995 CET	4258	40374	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:12.883793116 CET	40374	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:12.883832932 CET	40374	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:13.003720999 CET	4258	40374	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:14.049551964 CET	4258	40374	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:14.049626112 CET	4258	40374	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:14.049809933 CET	40374	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:14.049809933 CET	40374	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:14.050781012 CET	40376	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:14.169656992 CET	4258	40374	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:14.170423031 CET	4258	40376	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:14.170530081 CET	40376	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:14.170592070 CET	40376	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:14.290219069 CET	4258	40376	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:15.317737103 CET	4258	40376	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:15.317922115 CET	40376	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:15.317944050 CET	4258	40376	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:15.318036079 CET	40376	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:15.319544077 CET	40378	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:15.437556982 CET	4258	40376	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:15.439146042 CET	4258	40378	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:15.439279079 CET	40378	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:15.439357996 CET	40378	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:15.558825970 CET	4258	40378	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:16.593446970 CET	4258	40378	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:16.593486071 CET	4258	40378	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:16.593612909 CET	40378	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:16.593873024 CET	40378	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:16.594887972 CET	40380	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:16.713463068 CET	4258	40378	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:16.714915991 CET	4258	40380	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:16.715337038 CET	40380	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:16.715337992 CET	40380	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:16.835347891 CET	4258	40380	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:17.869079113 CET	4258	40380	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:17.869404078 CET	4258	40380	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:17.869657040 CET	40380	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:17.869657993 CET	40380	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:17.871351957 CET	40382	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:17.989500046 CET	4258	40380	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:17.991044998 CET	4258	40382	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:17.991405964 CET	40382	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:17.991405964 CET	40382	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:18.111072063 CET	4258	40382	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:19.246918917 CET	4258	40382	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:19.246978998 CET	4258	40382	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:19.247211933 CET	40382	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:19.247211933 CET	40382	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:19.248523951 CET	40384	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:19.367337942 CET	4258	40382	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:19.368613958 CET	4258	40384	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:19.368730068 CET	40384	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:19.368799925 CET	40384	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:19.488390923 CET	4258	40384	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:20.521420956 CET	4258	40384	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:20.521462917 CET	4258	40384	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:20.521637917 CET	40384	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:20.521729946 CET	40384	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:20.522660971 CET	40386	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:20.641711950 CET	4258	40384	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:20.642313957 CET	4258	40386	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:20.642421007 CET	40386	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:20.642504930 CET	40386	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:20.762226105 CET	4258	40386	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:21.925904989 CET	4258	40386	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:21.925936937 CET	4258	40386	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:21.926286936 CET	40386	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:21.926388979 CET	40386	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:21.927706003 CET	40388	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:22.046004057 CET	4258	40386	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:22.047296047 CET	4258	40388	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:22.047465086 CET	40388	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:22.047466040 CET	40388	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:22.167299986 CET	4258	40388	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:23.274017096 CET	4258	40388	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:23.274102926 CET	4258	40388	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:23.274318933 CET	40388	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:23.274471045 CET	40388	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:23.275253057 CET	40390	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:23.394186020 CET	4258	40388	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:23.394889116 CET	4258	40390	185.216.71.152	192.168.2.13
Dec 22, 2024 16:05:23.395180941 CET	40390	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:23.395242929 CET	40390	4258	192.168.2.13	185.216.71.152
Dec 22, 2024 16:05:23.514802933 CET	4258	40390	185.216.71.152	192.168.2.13

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 22, 2024 16:04:34.168970108 CET	192.168.2.13	8.8.8.8	0x57dc	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Dec 22, 2024 16:04:34.169007063 CET	192.168.2.13	8.8.8.8	0xd7f7	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 22, 2024 16:04:35.489944935 CET	8.8.8.8	192.168.2.13	0x57dc	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false
Dec 22, 2024 16:04:35.489944935 CET	8.8.8.8	192.168.2.13	0x57dc	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: hidakibest.x86.elf PID: 5511, Parent PID: 5437

General

Start time (UTC):	15:01:48
Start date (UTC):	22/12/2024
Path:	/tmp/hidakibest.x86.elf
Arguments:	/tmp/hidakibest.x86.elf
File size:	108630 bytes
MD5 hash:	589d6374c72c1721be71a3a5e3de4a09

Chronological Activities

Analysis Process: hidakibest.x86.elf PID: 5512, Parent PID: 5511

General

Start time (UTC):	15:01:48
Start date (UTC):	22/12/2024
Path:	/tmp/hidakibest.x86.elf
Arguments:	-
File size:	108630 bytes
MD5 hash:	589d6374c72c1721be71a3a5e3de4a09

Chronological Activities

Analysis Process: hidakibest.x86.elf PID: 5513, Parent PID: 5512

General

Start time (UTC):	15:01:48
Start date (UTC):	22/12/2024
Path:	/tmp/hidakibest.x86.elf
Arguments:	-
File size:	108630 bytes
MD5 hash:	589d6374c72c1721be71a3a5e3de4a09

Description:	Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping or `net view` using Net .
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report hidakibest.x86.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Threatname: Gafgyt

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: hidakibest.x86.elf PID: 5511, Parent PID: 5437

General

Chronological Activities

Analysis Process: hidakibest.x86.elf PID: 5512, Parent PID: 5511

General

Chronological Activities

Analysis Process: hidakibest.x86.elf PID: 5513, Parent PID: 5512

General

Chronological Activities

Linux Analysis Report
hidakibest.x86.elf