Edit tour

Linux Analysis Report
hidakibest.x86.elf

Overview

General Information

Sample name:	hidakibest.x86.elf
Analysis ID:	1579504
MD5:	f61f0d03b7c554e0d1917610b48d325f
SHA1:	98e61b10061ecc747c3665e49e33a69253c144cf
SHA256:	2d5f99b8427db46e273f78b14013d53431319649884a0d346a8f71f7e3aad28f
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai, Gafgyt

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Detected Mirai

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Gafgyt

Yara detected Mirai

Machine Learning detection for sample

Opens /proc/net/* files useful for finding connected devices and routers

Detected TCP or UDP traffic on non-standard ports

Sample contains strings that are user agent strings indicative of HTTP manipulation

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1579504
Start date and time:	2024-12-22 16:14:41 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	hidakibest.x86.elf
Detection:	MAL
Classification:	mal100.spre.troj.linELF@0/0@2/0

Warnings

VT rate limit hit for: 31.172.83.147:4258

Runtime Messages

Command:	/tmp/hidakibest.x86.elf
PID:	5573
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

hidakibest.x86.elf (PID: 5573, Parent: 5492, MD5: f61f0d03b7c554e0d1917610b48d325f) Arguments: /tmp/hidakibest.x86.elf

hidakibest.x86.elf New Fork (PID: 5574, Parent: 5573)

hidakibest.x86.elf New Fork (PID: 5575, Parent: 5574)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
hidakibest.x86.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
hidakibest.x86.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
hidakibest.x86.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xc920:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc934:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc948:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc95c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc970:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc984:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc998:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca10:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca24:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca38:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca4c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca60:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca74:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca88:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca9c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcab0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
hidakibest.x86.elf	Linux_Trojan_Gafgyt_a6a2adb9	unknown	unknown	0x8b1:$a: CC 01 C2 89 55 B4 8B 45 B4 C9 C3 55 48 89 E5 48 81 EC 90 00
hidakibest.x86.elf	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x59e8:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
hidakibest.x86.elf	Linux_Trojan_Gafgyt_f3d83a74	unknown	unknown	0x7d8:$a: DC 00 74 1B 83 7D E0 0A 75 15 83 7D E4 00 79 0F C7 45 C8 01 00
hidakibest.x86.elf	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0x619f:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
hidakibest.x86.elf	Linux_Trojan_Gafgyt_31796a40	unknown	unknown	0x156d:$a: 14 48 63 D0 48 8D 45 C0 48 8D 70 04 48 8B 45 E8 48 8B 40 18 48 0x18ef:$a: 14 48 63 D0 48 8D 45 C0 48 8D 70 04 48 8B 45 E8 48 8B 40 18 48
hidakibest.x86.elf	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xc8cc:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
hidakibest.x86.elf	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0x3842:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x397c:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
hidakibest.x86.elf	Linux_Trojan_Gafgyt_09c3070e	unknown	unknown	0xf72:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 0x1025:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 0x1258:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83
hidakibest.x86.elf	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0x831e:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
hidakibest.x86.elf	Linux_Trojan_Gafgyt_d0c57a2e	unknown	unknown	0xa45a:$a: 07 0F B6 57 01 C1 E0 08 09 D0 89 06 0F BE 47 02 C1 E8 1F 89
hidakibest.x86.elf	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0x5d5f:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
hidakibest.x86.elf	Linux_Trojan_Gafgyt_779e142f	unknown	unknown	0x700:$a: EC 8B 45 E8 83 E0 02 85 C0 74 07 C7 45 D8 30 00 00 00 8B 45 E8 83
hidakibest.x86.elf	Linux_Trojan_Gafgyt_cf84c9f2	unknown	unknown	0x31f:$a: 55 48 89 E5 48 83 EC 30 48 89 7D E8 89 75 E4 89 55 E0 C7 45 F8 01 00
hidakibest.x86.elf	Linux_Trojan_Gafgyt_0cd591cd	unknown	unknown	0x84da:$a: 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D
hidakibest.x86.elf	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0x602a:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
hidakibest.x86.elf	Linux_Trojan_Gafgyt_e4a1982b	unknown	unknown	0x313:$a: 8B 45 EC F7 D0 21 D0 33 45 FC C9 C3 55 48 89 E5 48 83 EC 30 48 89
hidakibest.x86.elf	Linux_Trojan_Gafgyt_32eb0c81	unknown	unknown	0x74d:$a: D4 48 FF 45 F0 48 8B 45 F0 0F B6 00 84 C0 75 DB EB 12 48 8B
hidakibest.x86.elf	Linux_Trojan_Gafgyt_a33a8363	unknown	unknown	0x86d3:$a: 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E
Click to see the 16 entries

Memory Dumps

Source	Rule	Description	Author	Strings
5573.1.0000000000400000.0000000000410000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
5573.1.0000000000400000.0000000000410000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5573.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xc920:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc934:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc948:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc95c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc970:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc984:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc998:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca10:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca24:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca38:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca4c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca60:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca74:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca88:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca9c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcab0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5573.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_a6a2adb9	unknown	unknown	0x8b1:$a: CC 01 C2 89 55 B4 8B 45 B4 C9 C3 55 48 89 E5 48 81 EC 90 00
5573.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x59e8:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
5573.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_f3d83a74	unknown	unknown	0x7d8:$a: DC 00 74 1B 83 7D E0 0A 75 15 83 7D E4 00 79 0F C7 45 C8 01 00
5573.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0x619f:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
5573.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_31796a40	unknown	unknown	0x156d:$a: 14 48 63 D0 48 8D 45 C0 48 8D 70 04 48 8B 45 E8 48 8B 40 18 48 0x18ef:$a: 14 48 63 D0 48 8D 45 C0 48 8D 70 04 48 8B 45 E8 48 8B 40 18 48
5574.1.0000000000400000.0000000000410000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
5573.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xc8cc:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
5573.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0x3842:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x397c:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
5573.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_09c3070e	unknown	unknown	0xf72:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 0x1025:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 0x1258:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83
5573.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0x831e:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
5573.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_d0c57a2e	unknown	unknown	0xa45a:$a: 07 0F B6 57 01 C1 E0 08 09 D0 89 06 0F BE 47 02 C1 E8 1F 89
5573.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0x5d5f:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
5573.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_779e142f	unknown	unknown	0x700:$a: EC 8B 45 E8 83 E0 02 85 C0 74 07 C7 45 D8 30 00 00 00 8B 45 E8 83
5573.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_cf84c9f2	unknown	unknown	0x31f:$a: 55 48 89 E5 48 83 EC 30 48 89 7D E8 89 75 E4 89 55 E0 C7 45 F8 01 00
5573.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_0cd591cd	unknown	unknown	0x84da:$a: 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D
5573.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0x602a:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
5573.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_e4a1982b	unknown	unknown	0x313:$a: 8B 45 EC F7 D0 21 D0 33 45 FC C9 C3 55 48 89 E5 48 83 EC 30 48 89
5573.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_32eb0c81	unknown	unknown	0x74d:$a: D4 48 FF 45 F0 48 8B 45 F0 0F B6 00 84 C0 75 DB EB 12 48 8B
5573.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_a33a8363	unknown	unknown	0x86d3:$a: 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E
5574.1.0000000000400000.0000000000410000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5574.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xc920:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc934:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc948:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc95c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc970:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc984:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc998:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca10:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca24:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca38:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca4c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca60:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca74:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca88:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca9c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcab0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5574.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_a6a2adb9	unknown	unknown	0x8b1:$a: CC 01 C2 89 55 B4 8B 45 B4 C9 C3 55 48 89 E5 48 81 EC 90 00
5574.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x59e8:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
5574.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_f3d83a74	unknown	unknown	0x7d8:$a: DC 00 74 1B 83 7D E0 0A 75 15 83 7D E4 00 79 0F C7 45 C8 01 00
5574.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0x619f:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
5574.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_31796a40	unknown	unknown	0x156d:$a: 14 48 63 D0 48 8D 45 C0 48 8D 70 04 48 8B 45 E8 48 8B 40 18 48 0x18ef:$a: 14 48 63 D0 48 8D 45 C0 48 8D 70 04 48 8B 45 E8 48 8B 40 18 48
5574.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xc8cc:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
5574.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0x3842:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x397c:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
5574.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_09c3070e	unknown	unknown	0xf72:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 0x1025:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 0x1258:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83
5574.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0x831e:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
5574.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_d0c57a2e	unknown	unknown	0xa45a:$a: 07 0F B6 57 01 C1 E0 08 09 D0 89 06 0F BE 47 02 C1 E8 1F 89
5574.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0x5d5f:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
5574.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_779e142f	unknown	unknown	0x700:$a: EC 8B 45 E8 83 E0 02 85 C0 74 07 C7 45 D8 30 00 00 00 8B 45 E8 83
5574.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_cf84c9f2	unknown	unknown	0x31f:$a: 55 48 89 E5 48 83 EC 30 48 89 7D E8 89 75 E4 89 55 E0 C7 45 F8 01 00
5574.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_0cd591cd	unknown	unknown	0x84da:$a: 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D
5574.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0x602a:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
5574.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_e4a1982b	unknown	unknown	0x313:$a: 8B 45 EC F7 D0 21 D0 33 45 FC C9 C3 55 48 89 E5 48 83 EC 30 48 89
5574.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_32eb0c81	unknown	unknown	0x74d:$a: D4 48 FF 45 F0 48 8B 45 F0 0F B6 00 84 C0 75 DB EB 12 48 8B
5574.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_a33a8363	unknown	unknown	0x86d3:$a: 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E
Process Memory Space: hidakibest.x86.elf PID: 5573	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: hidakibest.x86.elf PID: 5573	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x2fd0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2fe4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2ff8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x300c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3020:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3034:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3048:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x305c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3070:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3084:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3098:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x30ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x30c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x30d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x30e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x30fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3110:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3124:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3138:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x314c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3160:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: hidakibest.x86.elf PID: 5573	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x2f83:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x33f5:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: hidakibest.x86.elf PID: 5574	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: hidakibest.x86.elf PID: 5574	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x34e2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x34f6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x350a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x351e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3532:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3546:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x355a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x356e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3582:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3596:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x35aa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x35be:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x35d2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x35e6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x35fa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x360e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3622:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3636:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x364a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x365e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3672:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: hidakibest.x86.elf PID: 5574	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x3495:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x3907:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Click to see the 43 entries

Suricata Signatures

ETPRO MALWARE ELF/Mirai Variant CnC Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-22T16:15:42.885616+0100	2843713	1	A Network Trojan was detected	192.168.2.14	56888	31.172.83.147	4258	TCP
2024-12-22T16:15:44.141654+0100	2843713	1	A Network Trojan was detected	192.168.2.14	56890	31.172.83.147	4258	TCP
2024-12-22T16:15:45.330479+0100	2843713	1	A Network Trojan was detected	192.168.2.14	56892	31.172.83.147	4258	TCP
2024-12-22T16:15:46.524108+0100	2843713	1	A Network Trojan was detected	192.168.2.14	56894	31.172.83.147	4258	TCP
2024-12-22T16:15:47.756588+0100	2843713	1	A Network Trojan was detected	192.168.2.14	56896	31.172.83.147	4258	TCP
2024-12-22T16:15:48.970420+0100	2843713	1	A Network Trojan was detected	192.168.2.14	56898	31.172.83.147	4258	TCP
2024-12-22T16:15:50.158997+0100	2843713	1	A Network Trojan was detected	192.168.2.14	56900	31.172.83.147	4258	TCP
2024-12-22T16:15:51.347352+0100	2843713	1	A Network Trojan was detected	192.168.2.14	56902	31.172.83.147	4258	TCP
2024-12-22T16:15:52.966497+0100	2843713	1	A Network Trojan was detected	192.168.2.14	56904	31.172.83.147	4258	TCP
2024-12-22T16:15:54.166100+0100	2843713	1	A Network Trojan was detected	192.168.2.14	56906	31.172.83.147	4258	TCP
2024-12-22T16:15:55.359589+0100	2843713	1	A Network Trojan was detected	192.168.2.14	56908	31.172.83.147	4258	TCP
2024-12-22T16:15:56.547552+0100	2843713	1	A Network Trojan was detected	192.168.2.14	56910	31.172.83.147	4258	TCP
2024-12-22T16:15:57.735387+0100	2843713	1	A Network Trojan was detected	192.168.2.14	56912	31.172.83.147	4258	TCP
2024-12-22T16:15:58.930285+0100	2843713	1	A Network Trojan was detected	192.168.2.14	56914	31.172.83.147	4258	TCP
2024-12-22T16:16:00.131501+0100	2843713	1	A Network Trojan was detected	192.168.2.14	56916	31.172.83.147	4258	TCP
2024-12-22T16:16:01.320168+0100	2843713	1	A Network Trojan was detected	192.168.2.14	56918	31.172.83.147	4258	TCP
2024-12-22T16:16:02.512246+0100	2843713	1	A Network Trojan was detected	192.168.2.14	56920	31.172.83.147	4258	TCP
2024-12-22T16:16:03.700101+0100	2843713	1	A Network Trojan was detected	192.168.2.14	56922	31.172.83.147	4258	TCP
2024-12-22T16:16:04.898086+0100	2843713	1	A Network Trojan was detected	192.168.2.14	56924	31.172.83.147	4258	TCP
2024-12-22T16:16:06.096476+0100	2843713	1	A Network Trojan was detected	192.168.2.14	56926	31.172.83.147	4258	TCP
2024-12-22T16:16:07.293872+0100	2843713	1	A Network Trojan was detected	192.168.2.14	56928	31.172.83.147	4258	TCP
2024-12-22T16:16:08.500738+0100	2843713	1	A Network Trojan was detected	192.168.2.14	56930	31.172.83.147	4258	TCP
2024-12-22T16:16:09.698343+0100	2843713	1	A Network Trojan was detected	192.168.2.14	56932	31.172.83.147	4258	TCP
2024-12-22T16:16:10.886941+0100	2843713	1	A Network Trojan was detected	192.168.2.14	56934	31.172.83.147	4258	TCP
2024-12-22T16:16:12.077965+0100	2843713	1	A Network Trojan was detected	192.168.2.14	56936	31.172.83.147	4258	TCP
2024-12-22T16:16:13.267675+0100	2843713	1	A Network Trojan was detected	192.168.2.14	56938	31.172.83.147	4258	TCP
2024-12-22T16:16:14.458533+0100	2843713	1	A Network Trojan was detected	192.168.2.14	56940	31.172.83.147	4258	TCP
2024-12-22T16:16:15.708122+0100	2843713	1	A Network Trojan was detected	192.168.2.14	56942	31.172.83.147	4258	TCP
2024-12-22T16:16:16.897939+0100	2843713	1	A Network Trojan was detected	192.168.2.14	56944	31.172.83.147	4258	TCP
2024-12-22T16:16:18.183468+0100	2843713	1	A Network Trojan was detected	192.168.2.14	56946	31.172.83.147	4258	TCP
2024-12-22T16:16:19.376805+0100	2843713	1	A Network Trojan was detected	192.168.2.14	56948	31.172.83.147	4258	TCP
2024-12-22T16:16:20.762045+0100	2843713	1	A Network Trojan was detected	192.168.2.14	56950	31.172.83.147	4258	TCP
2024-12-22T16:16:22.115485+0100	2843713	1	A Network Trojan was detected	192.168.2.14	56952	31.172.83.147	4258	TCP
2024-12-22T16:16:23.320940+0100	2843713	1	A Network Trojan was detected	192.168.2.14	56954	31.172.83.147	4258	TCP
2024-12-22T16:16:24.520145+0100	2843713	1	A Network Trojan was detected	192.168.2.14	56956	31.172.83.147	4258	TCP
2024-12-22T16:16:25.867225+0100	2843713	1	A Network Trojan was detected	192.168.2.14	56958	31.172.83.147	4258	TCP
2024-12-22T16:16:27.098865+0100	2843713	1	A Network Trojan was detected	192.168.2.14	56960	31.172.83.147	4258	TCP
2024-12-22T16:16:28.287746+0100	2843713	1	A Network Trojan was detected	192.168.2.14	56962	31.172.83.147	4258	TCP
2024-12-22T16:16:29.475774+0100	2843713	1	A Network Trojan was detected	192.168.2.14	56964	31.172.83.147	4258	TCP
2024-12-22T16:16:30.663539+0100	2843713	1	A Network Trojan was detected	192.168.2.14	56966	31.172.83.147	4258	TCP
2024-12-22T16:16:31.852841+0100	2843713	1	A Network Trojan was detected	192.168.2.14	56968	31.172.83.147	4258	TCP
2024-12-22T16:16:33.040001+0100	2843713	1	A Network Trojan was detected	192.168.2.14	56970	31.172.83.147	4258	TCP
2024-12-22T16:16:34.236828+0100	2843713	1	A Network Trojan was detected	192.168.2.14	56972	31.172.83.147	4258	TCP
2024-12-22T16:16:35.427735+0100	2843713	1	A Network Trojan was detected	192.168.2.14	56974	31.172.83.147	4258	TCP
2024-12-22T16:16:36.617886+0100	2843713	1	A Network Trojan was detected	192.168.2.14	56976	31.172.83.147	4258	TCP
2024-12-22T16:16:37.844735+0100	2843713	1	A Network Trojan was detected	192.168.2.14	56978	31.172.83.147	4258	TCP
2024-12-22T16:16:39.090608+0100	2843713	1	A Network Trojan was detected	192.168.2.14	56980	31.172.83.147	4258	TCP
2024-12-22T16:16:40.278659+0100	2843713	1	A Network Trojan was detected	192.168.2.14	56982	31.172.83.147	4258	TCP
2024-12-22T16:16:41.473842+0100	2843713	1	A Network Trojan was detected	192.168.2.14	56984	31.172.83.147	4258	TCP
2024-12-22T16:16:42.836261+0100	2843713	1	A Network Trojan was detected	192.168.2.14	56986	31.172.83.147	4258	TCP
2024-12-22T16:16:44.033027+0100	2843713	1	A Network Trojan was detected	192.168.2.14	56988	31.172.83.147	4258	TCP
2024-12-22T16:16:45.222590+0100	2843713	1	A Network Trojan was detected	192.168.2.14	56990	31.172.83.147	4258	TCP
2024-12-22T16:16:46.411405+0100	2843713	1	A Network Trojan was detected	192.168.2.14	56992	31.172.83.147	4258	TCP
2024-12-22T16:16:47.612400+0100	2843713	1	A Network Trojan was detected	192.168.2.14	56994	31.172.83.147	4258	TCP
2024-12-22T16:16:48.802749+0100	2843713	1	A Network Trojan was detected	192.168.2.14	56996	31.172.83.147	4258	TCP
2024-12-22T16:16:49.990584+0100	2843713	1	A Network Trojan was detected	192.168.2.14	56998	31.172.83.147	4258	TCP
2024-12-22T16:16:51.179215+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57000	31.172.83.147	4258	TCP
2024-12-22T16:16:52.366301+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57002	31.172.83.147	4258	TCP
2024-12-22T16:16:53.578048+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57004	31.172.83.147	4258	TCP
2024-12-22T16:16:54.776513+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57006	31.172.83.147	4258	TCP
2024-12-22T16:16:55.977951+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57008	31.172.83.147	4258	TCP
2024-12-22T16:16:57.168004+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57010	31.172.83.147	4258	TCP
2024-12-22T16:16:58.357192+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57012	31.172.83.147	4258	TCP
2024-12-22T16:16:59.545672+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57014	31.172.83.147	4258	TCP
2024-12-22T16:17:00.735709+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57016	31.172.83.147	4258	TCP
2024-12-22T16:17:01.953647+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57018	31.172.83.147	4258	TCP
2024-12-22T16:17:03.165014+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57020	31.172.83.147	4258	TCP
2024-12-22T16:17:04.370917+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57022	31.172.83.147	4258	TCP
2024-12-22T16:17:05.567515+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57024	31.172.83.147	4258	TCP
2024-12-22T16:17:06.759674+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57026	31.172.83.147	4258	TCP
2024-12-22T16:17:07.971419+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57028	31.172.83.147	4258	TCP
2024-12-22T16:17:09.174932+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57030	31.172.83.147	4258	TCP
2024-12-22T16:17:10.373523+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57032	31.172.83.147	4258	TCP
2024-12-22T16:17:11.568852+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57034	31.172.83.147	4258	TCP
2024-12-22T16:17:12.837518+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57036	31.172.83.147	4258	TCP
2024-12-22T16:17:14.039743+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57038	31.172.83.147	4258	TCP
2024-12-22T16:17:15.240763+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57040	31.172.83.147	4258	TCP
2024-12-22T16:17:16.429964+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57042	31.172.83.147	4258	TCP
2024-12-22T16:17:17.618619+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57044	31.172.83.147	4258	TCP
2024-12-22T16:17:18.842850+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57046	31.172.83.147	4258	TCP
2024-12-22T16:17:20.063462+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57048	31.172.83.147	4258	TCP
2024-12-22T16:17:21.272252+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57050	31.172.83.147	4258	TCP
2024-12-22T16:17:22.477729+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57052	31.172.83.147	4258	TCP
2024-12-22T16:17:23.665548+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57054	31.172.83.147	4258	TCP
2024-12-22T16:17:24.892258+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57056	31.172.83.147	4258	TCP
2024-12-22T16:17:26.080414+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57058	31.172.83.147	4258	TCP
2024-12-22T16:17:27.289787+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57060	31.172.83.147	4258	TCP
2024-12-22T16:17:28.510783+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57062	31.172.83.147	4258	TCP
2024-12-22T16:17:29.709567+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57064	31.172.83.147	4258	TCP
2024-12-22T16:17:30.898673+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57066	31.172.83.147	4258	TCP
2024-12-22T16:17:32.101023+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57068	31.172.83.147	4258	TCP
2024-12-22T16:17:33.339575+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57070	31.172.83.147	4258	TCP
2024-12-22T16:17:34.528367+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57072	31.172.83.147	4258	TCP
2024-12-22T16:17:35.716371+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57074	31.172.83.147	4258	TCP
2024-12-22T16:17:36.907649+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57076	31.172.83.147	4258	TCP
2024-12-22T16:17:38.099027+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57078	31.172.83.147	4258	TCP
2024-12-22T16:17:39.289042+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57080	31.172.83.147	4258	TCP
2024-12-22T16:17:40.487176+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57082	31.172.83.147	4258	TCP
2024-12-22T16:17:41.710898+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57084	31.172.83.147	4258	TCP
2024-12-22T16:17:42.898519+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57086	31.172.83.147	4258	TCP
2024-12-22T16:17:44.269664+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57088	31.172.83.147	4258	TCP
2024-12-22T16:17:45.457269+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57090	31.172.83.147	4258	TCP
2024-12-22T16:17:46.727216+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57092	31.172.83.147	4258	TCP
2024-12-22T16:17:47.918787+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57094	31.172.83.147	4258	TCP
2024-12-22T16:17:49.109377+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57096	31.172.83.147	4258	TCP
2024-12-22T16:17:50.297108+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57098	31.172.83.147	4258	TCP
2024-12-22T16:17:51.494892+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57100	31.172.83.147	4258	TCP
2024-12-22T16:17:52.683959+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57102	31.172.83.147	4258	TCP
2024-12-22T16:17:54.066195+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57104	31.172.83.147	4258	TCP
2024-12-22T16:17:55.258736+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57106	31.172.83.147	4258	TCP
2024-12-22T16:17:56.449139+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57108	31.172.83.147	4258	TCP
2024-12-22T16:17:57.646824+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57110	31.172.83.147	4258	TCP
2024-12-22T16:17:58.843424+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57112	31.172.83.147	4258	TCP
2024-12-22T16:18:00.052964+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57114	31.172.83.147	4258	TCP
2024-12-22T16:18:01.240496+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57116	31.172.83.147	4258	TCP
2024-12-22T16:18:02.428902+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57118	31.172.83.147	4258	TCP
2024-12-22T16:18:03.619897+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57120	31.172.83.147	4258	TCP
2024-12-22T16:18:04.808816+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57122	31.172.83.147	4258	TCP
2024-12-22T16:18:06.000653+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57124	31.172.83.147	4258	TCP
2024-12-22T16:18:07.190010+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57126	31.172.83.147	4258	TCP
2024-12-22T16:18:08.378228+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57128	31.172.83.147	4258	TCP
2024-12-22T16:18:09.585086+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57130	31.172.83.147	4258	TCP
2024-12-22T16:18:10.773575+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57132	31.172.83.147	4258	TCP
2024-12-22T16:18:11.965878+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57134	31.172.83.147	4258	TCP
2024-12-22T16:18:13.162783+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57136	31.172.83.147	4258	TCP
2024-12-22T16:18:14.361495+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57138	31.172.83.147	4258	TCP
2024-12-22T16:18:15.552037+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57140	31.172.83.147	4258	TCP
2024-12-22T16:18:16.744512+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57142	31.172.83.147	4258	TCP
2024-12-22T16:18:17.933362+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57144	31.172.83.147	4258	TCP
2024-12-22T16:18:19.154002+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57146	31.172.83.147	4258	TCP
2024-12-22T16:18:20.342769+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57148	31.172.83.147	4258	TCP
2024-12-22T16:18:21.531889+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57150	31.172.83.147	4258	TCP
2024-12-22T16:18:22.735551+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57152	31.172.83.147	4258	TCP
2024-12-22T16:18:23.940372+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57154	31.172.83.147	4258	TCP
2024-12-22T16:18:25.137872+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57156	31.172.83.147	4258	TCP
2024-12-22T16:18:26.326684+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57158	31.172.83.147	4258	TCP
2024-12-22T16:18:27.521516+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57160	31.172.83.147	4258	TCP
2024-12-22T16:18:28.727507+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57164	31.172.83.147	4258	TCP
2024-12-22T16:18:30.006403+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57166	31.172.83.147	4258	TCP
2024-12-22T16:18:31.204643+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57168	31.172.83.147	4258	TCP
2024-12-22T16:18:32.393628+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57170	31.172.83.147	4258	TCP
2024-12-22T16:18:34.378719+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57172	31.172.83.147	4258	TCP
2024-12-22T16:18:35.577653+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57174	31.172.83.147	4258	TCP
2024-12-22T16:18:37.807475+0100	2843713	1	A Network Trojan was detected	192.168.2.14	57176	31.172.83.147	4258	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: hidakibest.x86.elf

Avira: detected

Found malware configuration

Source: hidakibest.x86.elf

Malware Configuration Extractor: Gafgyt {"C2 url": "31.172.83.147:4258"}

Multi AV Scanner detection for submitted file

Source: hidakibest.x86.elf	Virustotal: Detection: 62%			Perma Link
Source: hidakibest.x86.elf	ReversingLabs: Detection: 71%

Machine Learning detection for sample

Source: hidakibest.x86.elf

Joe Sandbox ML: detected

Spreading

Opens /proc/net/* files useful for finding connected devices and routers

Source: /tmp/hidakibest.x86.elf (PID: 5573)

Opens: /proc/net/route

Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56900 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56892 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56916 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56890 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56918 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57016 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56988 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56938 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57030 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56924 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56980 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57048 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57084 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56904 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56906 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56952 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56910 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56894 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57096 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57024 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57050 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57028 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57032 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56896 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56898 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56912 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57142 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57088 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56972 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56936 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56928 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56942 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57102 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56934 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56946 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57118 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56888 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57002 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56996 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57022 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56940 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57078 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56982 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56984 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57058 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57040 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56932 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56992 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56930 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56922 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57168 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56920 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57158 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57126 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56974 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56950 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57064 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57000 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56986 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57034 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56948 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56954 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57036 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57054 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57146 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57138 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56944 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56968 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56964 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56994 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57046 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56960 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57120 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57106 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56970 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56914 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56978 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57044 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57172 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57082 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57100 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57014 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56998 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56902 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57152 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57124 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57090 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57072 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57156 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57116 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57008 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57164 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57060 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57122 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57062 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57136 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57018 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56908 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57176 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57140 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56958 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56956 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57042 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56976 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57174 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57026 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56962 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57006 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57094 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57154 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57110 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57114 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57108 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57112 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56926 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57012 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57010 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57080 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57070 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57020 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56966 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57092 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57086 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57068 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57104 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57160 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57128 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56990 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57148 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57170 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57076 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57004 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57098 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57038 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57056 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57066 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57052 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57132 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57166 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57134 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57144 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57074 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57130 -> 31.172.83.147:4258
Source: Network traffic	Suricata IDS: 2843713 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:57150 -> 31.172.83.147:4258

Source: global traffic

TCP traffic: 192.168.2.14:56888 -> 31.172.83.147:4258

Source: unknown	TCP traffic detected without corresponding DNS query: 31.172.83.147
Source: unknown	TCP traffic detected without corresponding DNS query: 31.172.83.147
Source: unknown	TCP traffic detected without corresponding DNS query: 31.172.83.147
Source: unknown	TCP traffic detected without corresponding DNS query: 31.172.83.147
Source: unknown	TCP traffic detected without corresponding DNS query: 31.172.83.147
Source: unknown	TCP traffic detected without corresponding DNS query: 31.172.83.147
Source: unknown	TCP traffic detected without corresponding DNS query: 31.172.83.147
Source: unknown	TCP traffic detected without corresponding DNS query: 31.172.83.147
Source: unknown	TCP traffic detected without corresponding DNS query: 31.172.83.147
Source: unknown	TCP traffic detected without corresponding DNS query: 31.172.83.147
Source: unknown	TCP traffic detected without corresponding DNS query: 31.172.83.147
Source: unknown	TCP traffic detected without corresponding DNS query: 31.172.83.147
Source: unknown	TCP traffic detected without corresponding DNS query: 31.172.83.147
Source: unknown	TCP traffic detected without corresponding DNS query: 31.172.83.147
Source: unknown	TCP traffic detected without corresponding DNS query: 31.172.83.147
Source: unknown	TCP traffic detected without corresponding DNS query: 31.172.83.147
Source: unknown	TCP traffic detected without corresponding DNS query: 31.172.83.147
Source: unknown	TCP traffic detected without corresponding DNS query: 31.172.83.147
Source: unknown	TCP traffic detected without corresponding DNS query: 31.172.83.147
Source: unknown	TCP traffic detected without corresponding DNS query: 31.172.83.147
Source: unknown	TCP traffic detected without corresponding DNS query: 31.172.83.147
Source: unknown	TCP traffic detected without corresponding DNS query: 31.172.83.147
Source: unknown	TCP traffic detected without corresponding DNS query: 31.172.83.147
Source: unknown	TCP traffic detected without corresponding DNS query: 31.172.83.147
Source: unknown	TCP traffic detected without corresponding DNS query: 31.172.83.147
Source: unknown	TCP traffic detected without corresponding DNS query: 31.172.83.147
Source: unknown	TCP traffic detected without corresponding DNS query: 31.172.83.147
Source: unknown	TCP traffic detected without corresponding DNS query: 31.172.83.147
Source: unknown	TCP traffic detected without corresponding DNS query: 31.172.83.147
Source: unknown	TCP traffic detected without corresponding DNS query: 31.172.83.147
Source: unknown	TCP traffic detected without corresponding DNS query: 31.172.83.147
Source: unknown	TCP traffic detected without corresponding DNS query: 31.172.83.147
Source: unknown	TCP traffic detected without corresponding DNS query: 31.172.83.147
Source: unknown	TCP traffic detected without corresponding DNS query: 31.172.83.147
Source: unknown	TCP traffic detected without corresponding DNS query: 31.172.83.147
Source: unknown	TCP traffic detected without corresponding DNS query: 31.172.83.147
Source: unknown	TCP traffic detected without corresponding DNS query: 31.172.83.147
Source: unknown	TCP traffic detected without corresponding DNS query: 31.172.83.147
Source: unknown	TCP traffic detected without corresponding DNS query: 31.172.83.147
Source: unknown	TCP traffic detected without corresponding DNS query: 31.172.83.147
Source: unknown	TCP traffic detected without corresponding DNS query: 31.172.83.147
Source: unknown	TCP traffic detected without corresponding DNS query: 31.172.83.147
Source: unknown	TCP traffic detected without corresponding DNS query: 31.172.83.147
Source: unknown	TCP traffic detected without corresponding DNS query: 31.172.83.147
Source: unknown	TCP traffic detected without corresponding DNS query: 31.172.83.147
Source: unknown	TCP traffic detected without corresponding DNS query: 31.172.83.147
Source: unknown	TCP traffic detected without corresponding DNS query: 31.172.83.147
Source: unknown	TCP traffic detected without corresponding DNS query: 31.172.83.147
Source: unknown	TCP traffic detected without corresponding DNS query: 31.172.83.147
Source: unknown	TCP traffic detected without corresponding DNS query: 31.172.83.147

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

Source: hidakibest.x86.elf	String found in binary or memory: http://fast.no/support/crawler.asp)
Source: hidakibest.x86.elf	String found in binary or memory: http://feedback.redkolibri.com/
Source: hidakibest.x86.elf	String found in binary or memory: http://www.baidu.com/search/spider.htm)
Source: hidakibest.x86.elf	String found in binary or memory: http://www.baidu.com/search/spider.html)
Source: hidakibest.x86.elf	String found in binary or memory: http://www.billybobbot.com/crawler/)

System Summary

Malicious sample detected (through community Yara rule)

Source: hidakibest.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: hidakibest.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 Author: unknown
Source: hidakibest.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: hidakibest.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 Author: unknown
Source: hidakibest.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: hidakibest.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_31796a40 Author: unknown
Source: hidakibest.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: hidakibest.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: hidakibest.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_09c3070e Author: unknown
Source: hidakibest.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: hidakibest.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d0c57a2e Author: unknown
Source: hidakibest.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: hidakibest.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_779e142f Author: unknown
Source: hidakibest.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_cf84c9f2 Author: unknown
Source: hidakibest.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: hidakibest.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: hidakibest.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_e4a1982b Author: unknown
Source: hidakibest.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_32eb0c81 Author: unknown
Source: hidakibest.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: 5573.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5573.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 Author: unknown
Source: 5573.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 5573.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 Author: unknown
Source: 5573.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: 5573.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_31796a40 Author: unknown
Source: 5573.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5573.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 5573.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_09c3070e Author: unknown
Source: 5573.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 5573.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d0c57a2e Author: unknown
Source: 5573.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 5573.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_779e142f Author: unknown
Source: 5573.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_cf84c9f2 Author: unknown
Source: 5573.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: 5573.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 5573.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_e4a1982b Author: unknown
Source: 5573.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_32eb0c81 Author: unknown
Source: 5573.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: 5574.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5574.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 Author: unknown
Source: 5574.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 5574.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 Author: unknown
Source: 5574.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: 5574.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_31796a40 Author: unknown
Source: 5574.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5574.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 5574.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_09c3070e Author: unknown
Source: 5574.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 5574.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d0c57a2e Author: unknown
Source: 5574.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 5574.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_779e142f Author: unknown
Source: 5574.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_cf84c9f2 Author: unknown
Source: 5574.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: 5574.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 5574.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_e4a1982b Author: unknown
Source: 5574.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_32eb0c81 Author: unknown
Source: 5574.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: Process Memory Space: hidakibest.x86.elf PID: 5573, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: hidakibest.x86.elf PID: 5573, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: hidakibest.x86.elf PID: 5574, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: hidakibest.x86.elf PID: 5574, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown

Source: hidakibest.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: hidakibest.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = cdd0bb9ce40a000bb86b0c76616fe71fb7dbb87a044ddd778b7a07fdf804b877, id = a6a2adb9-9d54-42d4-abed-5b30d8062e97, last_modified = 2021-09-16
Source: hidakibest.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: hidakibest.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 1c5df68501b688905484ed47dc588306828aa7c114644428e22e5021bb39bd4a, id = f3d83a74-2888-435a-9a3c-b7de25084e9a, last_modified = 2021-09-16
Source: hidakibest.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: hidakibest.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_31796a40 reference_sample = 227c7f13f7bdadf6a14cc85e8d2106b9d69ab80abe6fc0056af5edef3621d4fb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 0a6c56eeed58a1a100c9b981157bb864904ffddb3a0c4cb61ec4cc0d770d68ae, id = 31796a40-1cbe-4d0c-a785-d16f40765f4a, last_modified = 2021-09-16
Source: hidakibest.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: hidakibest.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: hidakibest.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_09c3070e reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 84fad96b60b297736c149e14de12671ff778bff427ab7684df2c541a6f6d7e7d, id = 09c3070e-4b71-45a0-aa62-0cc6e496644a, last_modified = 2021-09-16
Source: hidakibest.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: hidakibest.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d0c57a2e os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ee7d3a33575ed3aa7431489a8fb18bf30cfd5d6c776066ab2a27f93303124b6, id = d0c57a2e-c10c-436c-be13-50a269326cf2, last_modified = 2021-09-16
Source: hidakibest.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: hidakibest.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_779e142f reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 83377b6fa77fda4544c409487d2d2c1ddcef8f7d4120f49a18888c7536f3969f, id = 779e142f-b867-46e6-b1fb-9105976f42fd, last_modified = 2021-09-16
Source: hidakibest.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_cf84c9f2 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = bb766b356c3e8706740e3bb9b4a7171d8eb5137e09fc7ab6952412fa55e2dcfc, id = cf84c9f2-7435-4faf-8c5f-d14945ffad7a, last_modified = 2021-09-16
Source: hidakibest.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: hidakibest.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: hidakibest.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_e4a1982b os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d9f852c28433128b0fd330bee35f7bd4aada5226e9ca865fe5cd8cca52b2a622, id = e4a1982b-928a-4da5-b497-cedc1d26e845, last_modified = 2021-09-16
Source: hidakibest.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_32eb0c81 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 7c50ed29e2dd75a6a85afc43f8452794cb787ecd2061f4bf415d7038c14c523f, id = 32eb0c81-25af-4670-ab77-07ea7ce1874a, last_modified = 2021-09-16
Source: hidakibest.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: 5573.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5573.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = cdd0bb9ce40a000bb86b0c76616fe71fb7dbb87a044ddd778b7a07fdf804b877, id = a6a2adb9-9d54-42d4-abed-5b30d8062e97, last_modified = 2021-09-16
Source: 5573.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 5573.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 1c5df68501b688905484ed47dc588306828aa7c114644428e22e5021bb39bd4a, id = f3d83a74-2888-435a-9a3c-b7de25084e9a, last_modified = 2021-09-16
Source: 5573.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: 5573.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_31796a40 reference_sample = 227c7f13f7bdadf6a14cc85e8d2106b9d69ab80abe6fc0056af5edef3621d4fb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 0a6c56eeed58a1a100c9b981157bb864904ffddb3a0c4cb61ec4cc0d770d68ae, id = 31796a40-1cbe-4d0c-a785-d16f40765f4a, last_modified = 2021-09-16
Source: 5573.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5573.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 5573.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_09c3070e reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 84fad96b60b297736c149e14de12671ff778bff427ab7684df2c541a6f6d7e7d, id = 09c3070e-4b71-45a0-aa62-0cc6e496644a, last_modified = 2021-09-16
Source: 5573.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 5573.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d0c57a2e os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ee7d3a33575ed3aa7431489a8fb18bf30cfd5d6c776066ab2a27f93303124b6, id = d0c57a2e-c10c-436c-be13-50a269326cf2, last_modified = 2021-09-16
Source: 5573.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 5573.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_779e142f reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 83377b6fa77fda4544c409487d2d2c1ddcef8f7d4120f49a18888c7536f3969f, id = 779e142f-b867-46e6-b1fb-9105976f42fd, last_modified = 2021-09-16
Source: 5573.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_cf84c9f2 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = bb766b356c3e8706740e3bb9b4a7171d8eb5137e09fc7ab6952412fa55e2dcfc, id = cf84c9f2-7435-4faf-8c5f-d14945ffad7a, last_modified = 2021-09-16
Source: 5573.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: 5573.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 5573.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_e4a1982b os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d9f852c28433128b0fd330bee35f7bd4aada5226e9ca865fe5cd8cca52b2a622, id = e4a1982b-928a-4da5-b497-cedc1d26e845, last_modified = 2021-09-16
Source: 5573.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_32eb0c81 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 7c50ed29e2dd75a6a85afc43f8452794cb787ecd2061f4bf415d7038c14c523f, id = 32eb0c81-25af-4670-ab77-07ea7ce1874a, last_modified = 2021-09-16
Source: 5573.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: 5574.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5574.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = cdd0bb9ce40a000bb86b0c76616fe71fb7dbb87a044ddd778b7a07fdf804b877, id = a6a2adb9-9d54-42d4-abed-5b30d8062e97, last_modified = 2021-09-16
Source: 5574.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 5574.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 1c5df68501b688905484ed47dc588306828aa7c114644428e22e5021bb39bd4a, id = f3d83a74-2888-435a-9a3c-b7de25084e9a, last_modified = 2021-09-16
Source: 5574.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: 5574.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_31796a40 reference_sample = 227c7f13f7bdadf6a14cc85e8d2106b9d69ab80abe6fc0056af5edef3621d4fb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 0a6c56eeed58a1a100c9b981157bb864904ffddb3a0c4cb61ec4cc0d770d68ae, id = 31796a40-1cbe-4d0c-a785-d16f40765f4a, last_modified = 2021-09-16
Source: 5574.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5574.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 5574.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_09c3070e reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 84fad96b60b297736c149e14de12671ff778bff427ab7684df2c541a6f6d7e7d, id = 09c3070e-4b71-45a0-aa62-0cc6e496644a, last_modified = 2021-09-16
Source: 5574.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 5574.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d0c57a2e os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ee7d3a33575ed3aa7431489a8fb18bf30cfd5d6c776066ab2a27f93303124b6, id = d0c57a2e-c10c-436c-be13-50a269326cf2, last_modified = 2021-09-16
Source: 5574.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 5574.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_779e142f reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 83377b6fa77fda4544c409487d2d2c1ddcef8f7d4120f49a18888c7536f3969f, id = 779e142f-b867-46e6-b1fb-9105976f42fd, last_modified = 2021-09-16
Source: 5574.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_cf84c9f2 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = bb766b356c3e8706740e3bb9b4a7171d8eb5137e09fc7ab6952412fa55e2dcfc, id = cf84c9f2-7435-4faf-8c5f-d14945ffad7a, last_modified = 2021-09-16
Source: 5574.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: 5574.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 5574.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_e4a1982b os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d9f852c28433128b0fd330bee35f7bd4aada5226e9ca865fe5cd8cca52b2a622, id = e4a1982b-928a-4da5-b497-cedc1d26e845, last_modified = 2021-09-16
Source: 5574.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_32eb0c81 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 7c50ed29e2dd75a6a85afc43f8452794cb787ecd2061f4bf415d7038c14c523f, id = 32eb0c81-25af-4670-ab77-07ea7ce1874a, last_modified = 2021-09-16
Source: 5574.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: Process Memory Space: hidakibest.x86.elf PID: 5573, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: hidakibest.x86.elf PID: 5573, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: hidakibest.x86.elf PID: 5574, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: hidakibest.x86.elf PID: 5574, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.spre.troj.linELF@0/0@2/0

Source: hidakibest.x86.elf	ELF static info symbol of initial sample: libc/string/x86_64/memcpy.S
Source: hidakibest.x86.elf	ELF static info symbol of initial sample: libc/string/x86_64/mempcpy.S
Source: hidakibest.x86.elf	ELF static info symbol of initial sample: libc/string/x86_64/memset.S
Source: hidakibest.x86.elf	ELF static info symbol of initial sample: libc/string/x86_64/strchr.S
Source: hidakibest.x86.elf	ELF static info symbol of initial sample: libc/string/x86_64/strcmp.S
Source: hidakibest.x86.elf	ELF static info symbol of initial sample: libc/string/x86_64/strcpy.S
Source: hidakibest.x86.elf	ELF static info symbol of initial sample: libc/string/x86_64/strlen.S
Source: hidakibest.x86.elf	ELF static info symbol of initial sample: libc/string/x86_64/strpbrk.S
Source: hidakibest.x86.elf	ELF static info symbol of initial sample: libc/string/x86_64/strspn.S
Source: hidakibest.x86.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/x86_64/crt1.S
Source: hidakibest.x86.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/x86_64/crti.S
Source: hidakibest.x86.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/x86_64/crtn.S

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match	File source: hidakibest.x86.elf, type: SAMPLE
Source: Yara match	File source: 5573.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5574.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY

Yara detected Mirai

Source: Yara match	File source: hidakibest.x86.elf, type: SAMPLE
Source: Yara match	File source: 5573.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5574.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: hidakibest.x86.elf PID: 5573, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: hidakibest.x86.elf PID: 5574, type: MEMORYSTR

Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36
Source: Initial sample	User agent string found: Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; rv:2.2) Gecko/20110201
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.2; U; ru) Presto/2.5.22 Version/10.51
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko
Source: Initial sample	User agent string found: Mozilla/5.0 (Android; Linux armv7l; rv:9.0) Gecko/20111216 Firefox/9.0 Fennec/9.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60
Source: Initial sample	User agent string found: Mozilla/5.0 (iPad; U; CPU OS 5_1 like Mac OS X) AppleWebKit/531.21.10 (KHTML, like Gecko) Version/4.0.4 Mobile/7B367 Safari/531.21.10 UCBrowser/3.4.3.532
Source: Initial sample	User agent string found: Mozilla/5.0 (Nintendo WiiU) AppleWebKit/536.30 (KHTML, like Gecko) NX/3.0.4.2.12 NintendoBrowser/4.3.1.11264.US
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:25.0) Gecko/20100101 Firefox/25.0
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; pl) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; en) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; ja) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; cn) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; fr) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20100101 Firefox/12.0
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; U; Linux x86_64; de; rv:1.9.2.8) Gecko/20100723 Ubuntu/10.04 (lucid) Firefox/3.6.8
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; rv:13.0) Gecko/20100101 Firefox/13.0.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:11.0) Gecko/20100101 Firefox/11.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:13.0) Gecko/20100101 Firefox/13.0.1
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.289 Version/12.01
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.02
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.0) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.112 Safari/535.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36

Remote Access Functionality

Detected Mirai

Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin

Yara detected Gafgyt

Source: Yara match	File source: hidakibest.x86.elf, type: SAMPLE
Source: Yara match	File source: 5573.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5574.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY

Yara detected Mirai

Source: Yara match	File source: hidakibest.x86.elf, type: SAMPLE
Source: Yara match	File source: 5573.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5574.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: hidakibest.x86.elf PID: 5573, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: hidakibest.x86.elf PID: 5574, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	OS Credential Dumping	1 Remote System Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

Threatname: Gafgyt

{"C2 url": "31.172.83.147:4258"}

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
hidakibest.x86.elf	62%	Virustotal		Browse
hidakibest.x86.elf	71%	ReversingLabs	Linux.Trojan.Mirai
hidakibest.x86.elf	100%	Avira	EXP/ELF.Mirai.Z.A
hidakibest.x86.elf	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
31.172.83.147:4258	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://www.baidu.com/search/spider.html)	hidakibest.x86.elf	false	high
http://www.billybobbot.com/crawler/)	hidakibest.x86.elf	false	high
http://fast.no/support/crawler.asp)	hidakibest.x86.elf	false	high
http://feedback.redkolibri.com/	hidakibest.x86.elf	false	high
http://www.baidu.com/search/spider.htm)	hidakibest.x86.elf	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
31.172.83.147	unknown	Germany		44066	DE-FIRSTCOLOwwwfirst-colonetDE	true

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
31.172.83.147	hidakibest.mpsl.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	hidakibest.sparc.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	hidakibest.arm7.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	hidakibest.ppc.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	hidakibest.arm5.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	hidakibest.mips.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	hidakibest.arm6.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	hidakibest.arm4.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	boatnet.m68k.elf	Get hash	malicious	Mirai	Browse
	boatnet.ppc.elf	Get hash	malicious	Mirai	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
DE-FIRSTCOLOwwwfirst-colonetDE	hidakibest.mpsl.elf	Get hash	malicious	Gafgyt, Mirai	Browse	31.172.83.147
	hidakibest.sparc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	31.172.83.147
	hidakibest.arm7.elf	Get hash	malicious	Gafgyt, Mirai	Browse	31.172.83.147
	hidakibest.ppc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	31.172.83.147
	hidakibest.arm5.elf	Get hash	malicious	Gafgyt, Mirai	Browse	31.172.83.147
	hidakibest.mips.elf	Get hash	malicious	Gafgyt, Mirai	Browse	31.172.83.147
	hidakibest.arm6.elf	Get hash	malicious	Gafgyt, Mirai	Browse	31.172.83.147
	hidakibest.arm4.elf	Get hash	malicious	Gafgyt, Mirai	Browse	31.172.83.147
	https://www.tblgroup.com/tbl2/certificados-digitales/	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	185.26.98.68
	boatnet.m68k.elf	Get hash	malicious	Mirai	Browse	31.172.83.147

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, not stripped
Entropy (8bit):	5.956550222035642
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	hidakibest.x86.elf
File size:	92'628 bytes
MD5:	f61f0d03b7c554e0d1917610b48d325f
SHA1:	98e61b10061ecc747c3665e49e33a69253c144cf
SHA256:	2d5f99b8427db46e273f78b14013d53431319649884a0d346a8f71f7e3aad28f
SHA512:	3875ab09e751d527fe6cdd42e23f383c5c7ec2ebe9cc05f7fb387f0df081e73cc586b6712fbc43cae1a119c5ce42e7e86a4d227ecac7ef8a051d95b1c135d910
SSDEEP:	1536:N7R3dgFgpm+U3owTmlfX8xbUHPN+83Xbpha3N5iAoxg6I5um2Xj5YZA0e:t0FghURKlfs+vN+IXbpha3zoxg95um2h
TLSH:	BE934C336613C6BAC08766F527CB9B159C33B8BD0B632106B3D47DE82F555C62DA9E40
File Content Preview:	.ELF..............>.......@.....@.......P...........@.8...@.......................@.......@...............................................P.......P.............8r..............Q.td....................................................H...._........H........

Static ELF Info

ELF header
Class:	ELF64
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Advanced Micro Devices X86-64
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x400194
Flags:	0x0
ELF Header Size:	64
Program Header Offset:	64
Program Header Size:	56
Number of Program Headers:	3
Section Header Offset:	67408
Section Header Size:	64
Number of Section Headers:	15
Header String Table Index:	12

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x4000e8	0xe8	0x13	0x0	0x6	AX	0	0	1
.text	PROGBITS	0x400100	0x100	0xacc8	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x40adc8	0xadc8	0xe	0x0	0x6	AX	0	0	1
.rodata	PROGBITS	0x40ade0	0xade0	0x4811	0x0	0x2	A	0	0	32
.eh_frame	PROGBITS	0x40f5f4	0xf5f4	0x4	0x0	0x2	A	0	0	4
.ctors	PROGBITS	0x50f5f8	0xf5f8	0x10	0x0	0x3	WA	0	0	8
.dtors	PROGBITS	0x50f608	0xf608	0x10	0x0	0x3	WA	0	0	8
.jcr	PROGBITS	0x50f618	0xf618	0x8	0x0	0x3	WA	0	0	8
.data	PROGBITS	0x50f620	0xf620	0x6a8	0x0	0x3	WA	0	0	32
.bss	NOBITS	0x50fce0	0xfcc8	0x6b50	0x0	0x3	WA	0	0	32
.comment	PROGBITS	0x0	0xfcc8	0xa20	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x106e8	0x66	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x10b10	0x3ea0	0x18	0x0		14	243	8
.strtab	STRTAB	0x0	0x149b0	0x2024	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0xf5f8	0xf5f8	6.3879	0x5	R E	0x100000	.init .text .fini .rodata .eh_frame
LOAD	0xf5f8	0x50f5f8	0x50f5f8	0x6d0	0x7238	2.3919	0x6	RW	0x100000	.ctors .dtors .jcr .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x8

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x4000e8	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x400100	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x40adc8	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x40ade0	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x40f5f4	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x50f5f8	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x50f608	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x50f618	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x50f620	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x50fce0	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	14
C.55.5195	.symtab	0x40c500	208	OBJECT	<unknown>	DEFAULT	4
C.65.5303	.symtab	0x40d020	2256	OBJECT	<unknown>	DEFAULT	4
Q	.symtab	0x50fd60	16384	OBJECT	<unknown>	DEFAULT	10
Randhex	.symtab	0x401883	389	FUNC	<unknown>	DEFAULT	2
SendSTD	.symtab	0x401501	386	FUNC	<unknown>	DEFAULT	2
UDPRAW	.symtab	0x401783	256	FUNC	<unknown>	DEFAULT	2
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x50f600	0	OBJECT	<unknown>	DEFAULT	6
__CTOR_LIST__	.symtab	0x50f5f8	0	OBJECT	<unknown>	DEFAULT	6
__C_ctype_b	.symtab	0x50f848	8	OBJECT	<unknown>	DEFAULT	9
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x40d9a0	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x50fc70	8	OBJECT	<unknown>	DEFAULT	9
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x40f100	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x50f858	8	OBJECT	<unknown>	DEFAULT	9
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x40dca0	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x50f610	0	OBJECT	<unknown>	DEFAULT	7
__DTOR_LIST__	.symtab	0x50f608	0	OBJECT	<unknown>	DEFAULT	7
__EH_FRAME_BEGIN__	.symtab	0x40f5f4	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x40f5f4	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x50f848	8	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_b_data	.symtab	0x40d9a0	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_tolower	.symtab	0x50fc70	8	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_tolower_data	.symtab	0x40f100	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_toupper	.symtab	0x50f858	8	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_toupper_data	.symtab	0x40dca0	768	OBJECT	<unknown>	HIDDEN	4
__GI___ctype_b	.symtab	0x50f850	8	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_tolower	.symtab	0x50fc78	8	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_toupper	.symtab	0x50f860	8	OBJECT	<unknown>	HIDDEN	9
__GI___errno_location	.symtab	0x403b88	6	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x40aa14	222	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x4052e0	14	FUNC	<unknown>	HIDDEN	2
__GI___h_errno_location	.symtab	0x40781c	6	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x40383c	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_lseek	.symtab	0x40a9c4	45	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x403a04	106	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x4071f0	70	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x40726f	67	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x4052f0	194	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x4038a0	42	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x406824	276	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x406d08	18	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x409348	43	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0x4038cc	38	FUNC	<unknown>	HIDDEN	2
__GI_clock_getres	.symtab	0x4075cc	41	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x4038f4	41	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x4058d8	43	FUNC	<unknown>	HIDDEN	2
__GI_errno	.symtab	0x515ffc	4	OBJECT	<unknown>	HIDDEN	10
__GI_exit	.symtab	0x406e94	92	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x4093a0	259	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x40383c	100	FUNC	<unknown>	HIDDEN	2
__GI_fcntl64	.symtab	0x40383c	100	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x4099ac	329	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x40aa14	222	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x409864	109	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x409af8	116	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x4094a4	10	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x403920	38	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x404bc4	56	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x4094b0	5	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x4094b8	218	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x404bfc	134	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x40aa14	222	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x4075f8	35	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x40761c	38	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x407644	38	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x40766c	38	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname	.symtab	0x40551c	53	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x405554	897	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x407694	19	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x403948	38	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x4076a8	40	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x405904	41	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x4076d0	38	FUNC	<unknown>	HIDDEN	2
__GI_h_errno	.symtab	0x516000	4	OBJECT	<unknown>	HIDDEN	10
__GI_inet_addr	.symtab	0x405500	28	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x4088c0	137	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa	.symtab	0x4054f5	10	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa_r	.symtab	0x4054a8	77	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x40a1a4	527	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x409e9f	493	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x406c4f	185	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x403970	104	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x405400	25	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x4039d8	44	FUNC	<unknown>	HIDDEN	2
__GI_lseek	.symtab	0x40a9c4	45	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x40a9bc	5	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x40831c	240	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x404c90	102	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x40840c	734	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x4082c0	90	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x4086ec	237	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x404d00	210	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x40759c	48	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x4076f8	38	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x407720	38	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x403a04	106	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x409374	41	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x40931c	18	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x406944	72	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x406b4c	90	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x409ca8	190	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x403a7c	39	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x405964	11	FUNC	<unknown>	HIDDEN	2
__GI_recvfrom	.symtab	0x405970	45	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x407748	74	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x403aa4	44	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x4059a0	11	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x4059ac	48	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x403ad0	38	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x4059dc	53	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x406aa4	168	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x4074a5	247	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x405a44	168	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x407794	85	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x406ef0	415	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x405a14	47	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x403b90	149	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x406ba6	169	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x4053c4	48	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x404de0	417	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x409b6c	33	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x409b6c	33	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x404f90	213	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x409de0	54	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x405070	225	FUNC	<unknown>	HIDDEN	2
__GI_strncat	.symtab	0x409d68	119	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x4087dc	131	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x405154	206	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x409b90	140	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x409c20	135	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x405224	187	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x4053f4	10	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x408860	94	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x406d1c	10	FUNC	<unknown>	HIDDEN	2
__GI_strtoll	.symtab	0x406d1c	10	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x407090	351	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x40541c	110	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x403af8	39	FUNC	<unknown>	HIDDEN	2
__GI_tolower	.symtab	0x40a9f4	30	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x403b68	30	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x403c28	199	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x4077ec	47	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x403b20	7	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x407824	68	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x407878	140	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x407868	15	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x403b28	42	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x50f618	0	OBJECT	<unknown>	DEFAULT	8
__JCR_LIST__	.symtab	0x50f618	0	OBJECT	<unknown>	DEFAULT	8
__app_fini	.symtab	0x515fe8	8	OBJECT	<unknown>	HIDDEN	10
__atexit_lock	.symtab	0x50fc40	40	OBJECT	<unknown>	DEFAULT	9
__bsd_signal	.symtab	0x405a44	168	FUNC	<unknown>	HIDDEN	2
__bss_start	.symtab	0x50fcc8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x40723a	53	FUNC	<unknown>	DEFAULT	2
__ctype_b	.symtab	0x50f850	8	OBJECT	<unknown>	DEFAULT	9
__ctype_tolower	.symtab	0x50fc78	8	OBJECT	<unknown>	DEFAULT	9
__ctype_toupper	.symtab	0x50f860	8	OBJECT	<unknown>	DEFAULT	9
__curbrk	.symtab	0x516050	8	OBJECT	<unknown>	HIDDEN	10
__data_start	.symtab	0x50f630	0	NOTYPE	<unknown>	DEFAULT	9
__decode_answer	.symtab	0x40a560	242	FUNC	<unknown>	HIDDEN	2
__decode_dotted	.symtab	0x40ab94	246	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x40a458	161	FUNC	<unknown>	HIDDEN	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__dns_lookup	.symtab	0x40894c	1862	FUNC	<unknown>	HIDDEN	2
__do_global_ctors_aux	.symtab	0x40ad90	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x400100	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x50f620	0	OBJECT	<unknown>	HIDDEN	9
__encode_dotted	.symtab	0x40aaf4	160	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x40a3b4	163	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x40a4fc	80	FUNC	<unknown>	HIDDEN	2
__environ	.symtab	0x515fd8	8	OBJECT	<unknown>	DEFAULT	10
__errno_location	.symtab	0x403b88	6	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x515fc8	8	OBJECT	<unknown>	HIDDEN	10
__fgetc_unlocked	.symtab	0x40aa14	222	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x50f5f8	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fini_array_start	.symtab	0x50f5f8	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__get_hosts_byname_r	.symtab	0x4092ec	48	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x407694	19	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x4052e0	14	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__h_errno_location	.symtab	0x40781c	6	FUNC	<unknown>	DEFAULT	2
__h_errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__init_array_end	.symtab	0x50f5f8	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__init_array_start	.symtab	0x50f5f8	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__length_dotted	.symtab	0x40ac8c	59	FUNC	<unknown>	HIDDEN	2
__length_question	.symtab	0x40a54c	19	FUNC	<unknown>	HIDDEN	2
__libc_close	.symtab	0x4038f4	41	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x4058d8	43	FUNC	<unknown>	DEFAULT	2
__libc_creat	.symtab	0x403a6e	14	FUNC	<unknown>	DEFAULT	2
__libc_fcntl	.symtab	0x40383c	100	FUNC	<unknown>	DEFAULT	2
__libc_fcntl64	.symtab	0x40383c	100	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x403920	38	FUNC	<unknown>	DEFAULT	2
__libc_getpid	.symtab	0x403948	38	FUNC	<unknown>	DEFAULT	2
__libc_lseek	.symtab	0x40a9c4	45	FUNC	<unknown>	DEFAULT	2
__libc_lseek64	.symtab	0x40a9bc	5	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0x407720	38	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x403a04	106	FUNC	<unknown>	DEFAULT	2
__libc_poll	.symtab	0x409374	41	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x403a7c	39	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x405964	11	FUNC	<unknown>	DEFAULT	2
__libc_recvfrom	.symtab	0x405970	45	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x403aa4	44	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x4059a0	11	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x4059ac	48	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x4074a5	247	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x515fd0	8	OBJECT	<unknown>	DEFAULT	10
__libc_waitpid	.symtab	0x403b20	7	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x403b28	42	FUNC	<unknown>	DEFAULT	2
__malloc_consolidate	.symtab	0x4064a9	410	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x405b48	96	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x50fac0	40	OBJECT	<unknown>	DEFAULT	9
__malloc_state	.symtab	0x516100	1752	OBJECT	<unknown>	DEFAULT	10
__malloc_trim	.symtab	0x406410	153	FUNC	<unknown>	DEFAULT	2
__nameserver	.symtab	0x516800	24	OBJECT	<unknown>	HIDDEN	10
__nameservers	.symtab	0x516818	4	OBJECT	<unknown>	HIDDEN	10
__open_etc_hosts	.symtab	0x40a654	42	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x409094	597	FUNC	<unknown>	HIDDEN	2
__pagesize	.symtab	0x515fe0	8	OBJECT	<unknown>	DEFAULT	10
__preinit_array_end	.symtab	0x50f5f8	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__preinit_array_start	.symtab	0x50f5f8	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__pthread_initialize_minimal	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0x407236	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x407236	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x407236	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x407236	3	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x407236	3	FUNC	<unknown>	DEFAULT	2
__pthread_return_void	.symtab	0x407239	1	FUNC	<unknown>	DEFAULT	2
__raise	.symtab	0x40931c	18	FUNC	<unknown>	HIDDEN	2
__read_etc_hosts_r	.symtab	0x40a67e	830	FUNC	<unknown>	HIDDEN	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__resolv_lock	.symtab	0x50fca0	40	OBJECT	<unknown>	DEFAULT	9
__restore_rt	.symtab	0x40749c	0	NOTYPE	<unknown>	DEFAULT	2
__rtld_fini	.symtab	0x515ff0	8	OBJECT	<unknown>	HIDDEN	10
__searchdomain	.symtab	0x5167e0	32	OBJECT	<unknown>	HIDDEN	10
__searchdomains	.symtab	0x51681c	4	OBJECT	<unknown>	HIDDEN	10
__sigaddset	.symtab	0x405b0c	28	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x405b28	30	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x405aec	32	FUNC	<unknown>	DEFAULT	2
__stdin	.symtab	0x50f898	8	OBJECT	<unknown>	DEFAULT	9
__stdio_READ	.symtab	0x40acc8	58	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x407904	147	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x409594	133	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x407998	259	FUNC	<unknown>	HIDDEN	2
__stdio_init_mutex	.symtab	0x403d5b	15	FUNC	<unknown>	HIDDEN	2
__stdio_mutex_initializer.4280	.symtab	0x40dfa0	40	OBJECT	<unknown>	DEFAULT	4
__stdio_rfill	.symtab	0x40ad04	37	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x409844	31	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x40ad2c	90	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x407a9c	148	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x403df4	39	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x50f8a0	8	OBJECT	<unknown>	DEFAULT	9
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uClibc_fini	.symtab	0x4071f0	70	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x40726f	67	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x4072b2	489	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x50fc68	8	OBJECT	<unknown>	HIDDEN	9
__xpg_strerror_r	.symtab	0x4052f0	194	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_charpad	.symtab	0x403e1c	68	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_dl_aux_init	.symtab	0x409330	23	FUNC	<unknown>	DEFAULT	2
_dl_phdr	.symtab	0x516820	8	OBJECT	<unknown>	DEFAULT	10
_dl_phnum	.symtab	0x516828	8	OBJECT	<unknown>	DEFAULT	10
_edata	.symtab	0x50fcc8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x516830	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_errno	.symtab	0x515ffc	4	OBJECT	<unknown>	DEFAULT	10
_exit	.symtab	0x4038a0	42	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x40adc8	5	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x513d80	8192	OBJECT	<unknown>	DEFAULT	10
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x403e60	120	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x407c74	1608	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_h_errno	.symtab	0x516000	4	OBJECT	<unknown>	DEFAULT	10
_init	.symtab	0x4000e8	5	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x407b30	85	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_init	.symtab	0x404514	114	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x4047c6	1022	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x404588	67	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x4045cc	457	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x404798	46	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x407239	1	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x407239	1	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_sigintr	.symtab	0x516080	128	OBJECT	<unknown>	HIDDEN	10
_start	.symtab	0x400194	42	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x40961c	551	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x403cf0	107	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x50f8a8	8	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_add_lock	.symtab	0x50f8c0	40	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_dec_use	.symtab	0x4098d4	216	FUNC	<unknown>	DEFAULT	2
_stdio_openlist_del_count	.symtab	0x513d64	4	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_del_lock	.symtab	0x50f900	40	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_use_count	.symtab	0x513d60	4	OBJECT	<unknown>	DEFAULT	10
_stdio_streams	.symtab	0x50f940	384	OBJECT	<unknown>	DEFAULT	9
_stdio_term	.symtab	0x403d6a	135	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x50f928	4	OBJECT	<unknown>	DEFAULT	9
_stdlib_strto_l	.symtab	0x406d28	362	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x407b88	46	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x40e0a0	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x407bb8	187	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x403ed8	1595	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x406824	276	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
atoi	.symtab	0x406d08	18	FUNC	<unknown>	DEFAULT	2
atoi.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bcopy	.symtab	0x4053b4	14	FUNC	<unknown>	DEFAULT	2
bcopy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
been_there_done_that	.symtab	0x515fc0	4	OBJECT	<unknown>	DEFAULT	10
been_there_done_that.3160	.symtab	0x515ff8	4	OBJECT	<unknown>	DEFAULT	10
bot.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
brk	.symtab	0x409348	43	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x405a44	168	FUNC	<unknown>	DEFAULT	2
buf.2989	.symtab	0x515d90	16	OBJECT	<unknown>	DEFAULT	10
buf.5285	.symtab	0x515da0	500	OBJECT	<unknown>	DEFAULT	10
c	.symtab	0x50f83c	4	OBJECT	<unknown>	DEFAULT	9
chdir	.symtab	0x4038cc	38	FUNC	<unknown>	DEFAULT	2
chdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
clock_getres	.symtab	0x4075cc	41	FUNC	<unknown>	DEFAULT	2
clock_getres.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x4038f4	41	FUNC	<unknown>	DEFAULT	2
close.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
commServer	.symtab	0x50f640	8	OBJECT	<unknown>	DEFAULT	9
completed.2761	.symtab	0x50fce0	1	OBJECT	<unknown>	DEFAULT	10
connect	.symtab	0x4058d8	43	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connectTimeout	.symtab	0x401124	572	FUNC	<unknown>	DEFAULT	2
creat	.symtab	0x403a6e	14	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
currentServer	.symtab	0x50f838	4	OBJECT	<unknown>	DEFAULT	9
data_start	.symtab	0x50f630	0	NOTYPE	<unknown>	DEFAULT	9
decodea.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dns	.symtab	0x50f648	8	OBJECT	<unknown>	DEFAULT	9
dnslookup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ	.symtab	0x515fd8	8	OBJECT	<unknown>	DEFAULT	10
errno	.symtab	0x515ffc	4	OBJECT	<unknown>	DEFAULT	10
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x406e94	92	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x40f440	208	OBJECT	<unknown>	DEFAULT	4
fclose	.symtab	0x4093a0	259	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x40383c	100	FUNC	<unknown>	DEFAULT	2
fcntl64	.symtab	0x40383c	100	FUNC	<unknown>	DEFAULT	2
fdgets	.symtab	0x40031f	128	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x4099ac	329	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x40aa14	222	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x409864	109	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x409af8	116	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fmt	.symtab	0x40f420	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x4094a4	10	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0x403920	38	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs_unlocked	.symtab	0x404bc4	56	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x400150	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x406643	452	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x4094b0	5	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x4094b0	5	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x4094b8	218	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fwrite_unlocked	.symtab	0x404bfc	134	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getArch	.symtab	0x402725	11	FUNC	<unknown>	DEFAULT	2
getHost	.symtab	0x400ea9	65	FUNC	<unknown>	DEFAULT	2
getOurIP	.symtab	0x40039f	486	FUNC	<unknown>	DEFAULT	2
getRandomIP	.symtab	0x4002f0	47	FUNC	<unknown>	DEFAULT	2
get_hosts_byname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getc_unlocked	.symtab	0x40aa14	222	FUNC	<unknown>	DEFAULT	2
getdtablesize	.symtab	0x4075f8	35	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x40761c	38	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x407644	38	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x40766c	38	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname	.symtab	0x40551c	53	FUNC	<unknown>	DEFAULT	2
gethostbyname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r	.symtab	0x405554	897	FUNC	<unknown>	DEFAULT	2
gethostbyname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpagesize	.symtab	0x407694	19	FUNC	<unknown>	DEFAULT	2
getpagesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x403948	38	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x4076a8	40	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit64	.symtab	0x4076a8	40	FUNC	<unknown>	DEFAULT	2
getsockname	.symtab	0x405904	41	FUNC	<unknown>	DEFAULT	2
getsockname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x405930	50	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x4076d0	38	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
h.5284	.symtab	0x515fa0	32	OBJECT	<unknown>	DEFAULT	10
h_errno	.symtab	0x516000	4	OBJECT	<unknown>	DEFAULT	10
htonl	.symtab	0x405494	5	FUNC	<unknown>	DEFAULT	2
htons	.symtab	0x40548c	8	FUNC	<unknown>	DEFAULT	2
i.4525	.symtab	0x50f840	4	OBJECT	<unknown>	DEFAULT	9
index	.symtab	0x404de0	417	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x405500	28	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x4088c0	137	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa	.symtab	0x4054f5	10	FUNC	<unknown>	DEFAULT	2
inet_ntoa.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa_r	.symtab	0x4054a8	77	FUNC	<unknown>	DEFAULT	2
inet_ntop	.symtab	0x40a1a4	527	FUNC	<unknown>	DEFAULT	2
inet_ntop4	.symtab	0x40a08c	280	FUNC	<unknown>	DEFAULT	2
inet_pton	.symtab	0x409e9f	493	FUNC	<unknown>	DEFAULT	2
inet_pton4	.symtab	0x409e18	135	FUNC	<unknown>	DEFAULT	2
initConnection	.symtab	0x40315a	298	FUNC	<unknown>	DEFAULT	2
init_rand	.symtab	0x4001c0	125	FUNC	<unknown>	DEFAULT	2
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initstate	.symtab	0x4069ee	110	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x406c4f	185	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x403970	104	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isatty	.symtab	0x405400	25	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isspace	.symtab	0x403b54	18	FUNC	<unknown>	DEFAULT	2
isspace.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0x4039d8	44	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lengthd.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lengthq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/memcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/mempcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/memset.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/strchr.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/strcmp.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/strcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/strlen.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/strpbrk.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/strspn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/x86_64/crt1.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/x86_64/crti.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/x86_64/crtn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
listFork	.symtab	0x401360	201	FUNC	<unknown>	DEFAULT	2
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek	.symtab	0x40a9c4	45	FUNC	<unknown>	DEFAULT	2
lseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x40a9bc	5	FUNC	<unknown>	DEFAULT	2
macAddress	.symtab	0x50fd50	6	OBJECT	<unknown>	DEFAULT	10
main	.symtab	0x403284	1463	FUNC	<unknown>	DEFAULT	2
mainCommSock	.symtab	0x50fd40	4	OBJECT	<unknown>	DEFAULT	10
malloc	.symtab	0x405ba8	2149	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
malloc_trim	.symtab	0x406807	28	FUNC	<unknown>	DEFAULT	2
memchr	.symtab	0x40831c	240	FUNC	<unknown>	DEFAULT	2
memchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memcpy	.symtab	0x404c90	102	FUNC	<unknown>	DEFAULT	2
memmove	.symtab	0x40840c	734	FUNC	<unknown>	DEFAULT	2
memmove.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mempcpy	.symtab	0x4082c0	90	FUNC	<unknown>	DEFAULT	2
memrchr	.symtab	0x4086ec	237	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x404d00	210	FUNC	<unknown>	DEFAULT	2
mmap	.symtab	0x40759c	48	FUNC	<unknown>	DEFAULT	2
mmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
munmap	.symtab	0x4076f8	38	FUNC	<unknown>	DEFAULT	2
munmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mylock	.symtab	0x50fb00	40	OBJECT	<unknown>	DEFAULT	9
mylock	.symtab	0x50fb40	40	OBJECT	<unknown>	DEFAULT	9
mylock	.symtab	0x516020	40	OBJECT	<unknown>	DEFAULT	10
nanosleep	.symtab	0x407720	38	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
next_start.1440	.symtab	0x515d80	8	OBJECT	<unknown>	DEFAULT	10
ntohl	.symtab	0x4054a1	5	FUNC	<unknown>	DEFAULT	2
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0x405499	8	FUNC	<unknown>	DEFAULT	2
ntop.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
numpids	.symtab	0x50fd48	8	OBJECT	<unknown>	DEFAULT	10
object.2814	.symtab	0x50fd00	48	OBJECT	<unknown>	DEFAULT	10
open	.symtab	0x403a04	106	FUNC	<unknown>	DEFAULT	2
open.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opennameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ourIP	.symtab	0x516058	4	OBJECT	<unknown>	DEFAULT	10
ovhl7	.symtab	0x401a08	3357	FUNC	<unknown>	DEFAULT	2
p.2759	.symtab	0x50f628	0	OBJECT	<unknown>	DEFAULT	9
pids	.symtab	0x516060	8	OBJECT	<unknown>	DEFAULT	10
poll	.symtab	0x409374	41	FUNC	<unknown>	DEFAULT	2
poll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prefix.4494	.symtab	0x40dfd5	12	OBJECT	<unknown>	DEFAULT	4
print	.symtab	0x4008bc	1085	FUNC	<unknown>	DEFAULT	2
printchar	.symtab	0x400652	75	FUNC	<unknown>	DEFAULT	2
printi	.symtab	0x40077c	320	FUNC	<unknown>	DEFAULT	2
prints	.symtab	0x40069d	223	FUNC	<unknown>	DEFAULT	2
processCmd	.symtab	0x402730	2602	FUNC	<unknown>	DEFAULT	2
qual_chars.4498	.symtab	0x40dff0	20	OBJECT	<unknown>	DEFAULT	4
raise	.symtab	0x40931c	18	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x406938	11	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand_cmwc	.symtab	0x40023d	179	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x406944	72	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x40ec00	40	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x406b4c	90	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randtbl	.symtab	0x50fbc0	128	OBJECT	<unknown>	DEFAULT	9
rawmemchr	.symtab	0x409ca8	190	FUNC	<unknown>	DEFAULT	2
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read	.symtab	0x403a7c	39	FUNC	<unknown>	DEFAULT	2
read.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read_etc_hosts_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recv	.symtab	0x405964	11	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recvLine	.symtab	0x400eea	570	FUNC	<unknown>	DEFAULT	2
recvfrom	.symtab	0x405970	45	FUNC	<unknown>	DEFAULT	2
recvfrom.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sbrk	.symtab	0x407748	74	FUNC	<unknown>	DEFAULT	2
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
select	.symtab	0x403aa4	44	FUNC	<unknown>	DEFAULT	2
select.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send	.symtab	0x4059a0	11	FUNC	<unknown>	DEFAULT	2
send.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sendto	.symtab	0x4059ac	48	FUNC	<unknown>	DEFAULT	2
sendto.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsid	.symtab	0x403ad0	38	FUNC	<unknown>	DEFAULT	2
setsid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsockopt	.symtab	0x4059dc	53	FUNC	<unknown>	DEFAULT	2
setsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate	.symtab	0x40698c	98	FUNC	<unknown>	DEFAULT	2
setstate_r	.symtab	0x406aa4	168	FUNC	<unknown>	DEFAULT	2
sigaction	.symtab	0x4074a5	247	FUNC	<unknown>	DEFAULT	2
sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
signal	.symtab	0x405a44	168	FUNC	<unknown>	DEFAULT	2
signal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigprocmask	.symtab	0x407794	85	FUNC	<unknown>	DEFAULT	2
sigprocmask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigsetops.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sleep	.symtab	0x406ef0	415	FUNC	<unknown>	DEFAULT	2
sleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket	.symtab	0x405a14	47	FUNC	<unknown>	DEFAULT	2
socket.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket_connect	.symtab	0x401429	216	FUNC	<unknown>	DEFAULT	2
sockprintf	.symtab	0x400cf9	432	FUNC	<unknown>	DEFAULT	2
spec_and_mask.4497	.symtab	0x40e010	16	OBJECT	<unknown>	DEFAULT	4
spec_base.4493	.symtab	0x40dfe1	7	OBJECT	<unknown>	DEFAULT	4
spec_chars.4494	.symtab	0x40e040	21	OBJECT	<unknown>	DEFAULT	4
spec_flags.4493	.symtab	0x40e055	8	OBJECT	<unknown>	DEFAULT	4
spec_or_mask.4496	.symtab	0x40e020	16	OBJECT	<unknown>	DEFAULT	4
spec_ranges.4495	.symtab	0x40e030	9	OBJECT	<unknown>	DEFAULT	4
sprintf	.symtab	0x403b90	149	FUNC	<unknown>	DEFAULT	2
sprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
srand	.symtab	0x406a5c	72	FUNC	<unknown>	DEFAULT	2
srandom	.symtab	0x406a5c	72	FUNC	<unknown>	DEFAULT	2
srandom_r	.symtab	0x406ba6	169	FUNC	<unknown>	DEFAULT	2
static_id	.symtab	0x50fc80	2	OBJECT	<unknown>	DEFAULT	9
static_ns	.symtab	0x516048	4	OBJECT	<unknown>	DEFAULT	10
stderr	.symtab	0x50f890	8	OBJECT	<unknown>	DEFAULT	9
stdin	.symtab	0x50f880	8	OBJECT	<unknown>	DEFAULT	9
stdout	.symtab	0x50f888	8	OBJECT	<unknown>	DEFAULT	9
strcasecmp	.symtab	0x4053c4	48	FUNC	<unknown>	DEFAULT	2
strcasecmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchr	.symtab	0x404de0	417	FUNC	<unknown>	DEFAULT	2
strcmp	.symtab	0x409b6c	33	FUNC	<unknown>	DEFAULT	2
strcoll	.symtab	0x409b6c	33	FUNC	<unknown>	DEFAULT	2
strcpy	.symtab	0x404f90	213	FUNC	<unknown>	DEFAULT	2
strdup	.symtab	0x409de0	54	FUNC	<unknown>	DEFAULT	2
strdup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strerror_r	.symtab	0x4052f0	194	FUNC	<unknown>	DEFAULT	2
strlen	.symtab	0x405070	225	FUNC	<unknown>	DEFAULT	2
strncat	.symtab	0x409d68	119	FUNC	<unknown>	DEFAULT	2
strncat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncpy	.symtab	0x4087dc	131	FUNC	<unknown>	DEFAULT	2
strncpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strnlen	.symtab	0x405154	206	FUNC	<unknown>	DEFAULT	2
strnlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strpbrk	.symtab	0x409b90	140	FUNC	<unknown>	DEFAULT	2
strspn	.symtab	0x409c20	135	FUNC	<unknown>	DEFAULT	2
strstr	.symtab	0x405224	187	FUNC	<unknown>	DEFAULT	2
strstr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtoimax	.symtab	0x406d1c	10	FUNC	<unknown>	DEFAULT	2
strtok	.symtab	0x4053f4	10	FUNC	<unknown>	DEFAULT	2
strtok.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok_r	.symtab	0x408860	94	FUNC	<unknown>	DEFAULT	2
strtok_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtol	.symtab	0x406d1c	10	FUNC	<unknown>	DEFAULT	2
strtol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtoll	.symtab	0x406d1c	10	FUNC	<unknown>	DEFAULT	2
sysconf	.symtab	0x407090	351	FUNC	<unknown>	DEFAULT	2
sysconf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcgetattr	.symtab	0x40541c	110	FUNC	<unknown>	DEFAULT	2
tcgetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
time	.symtab	0x403af8	39	FUNC	<unknown>	DEFAULT	2
time.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tolower	.symtab	0x40a9f4	30	FUNC	<unknown>	DEFAULT	2
tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
toupper	.symtab	0x403b68	30	FUNC	<unknown>	DEFAULT	2
toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
trim	.symtab	0x400585	205	FUNC	<unknown>	DEFAULT	2
type_codes	.symtab	0x40e060	24	OBJECT	<unknown>	DEFAULT	4
type_sizes	.symtab	0x40e078	12	OBJECT	<unknown>	DEFAULT	4
unknown.2050	.symtab	0x40e084	14	OBJECT	<unknown>	DEFAULT	4
unsafe_state	.symtab	0x50fb80	48	OBJECT	<unknown>	DEFAULT	9
useragents	.symtab	0x50f660	472	OBJECT	<unknown>	DEFAULT	9
vsnprintf	.symtab	0x403c28	199	FUNC	<unknown>	DEFAULT	2
vsnprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wait4	.symtab	0x4077ec	47	FUNC	<unknown>	DEFAULT	2
wait4.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
waitpid	.symtab	0x403b20	7	FUNC	<unknown>	DEFAULT	2
waitpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcrtomb	.symtab	0x407824	68	FUNC	<unknown>	DEFAULT	2
wcrtomb.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsnrtombs	.symtab	0x407878	140	FUNC	<unknown>	DEFAULT	2
wcsnrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsrtombs	.symtab	0x407868	15	FUNC	<unknown>	DEFAULT	2
wcsrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
write	.symtab	0x403b28	42	FUNC	<unknown>	DEFAULT	2
write.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
xdigits.3747	.symtab	0x40f5c0	17	OBJECT	<unknown>	DEFAULT	4
xtdcustom	.symtab	0x401683	256	FUNC	<unknown>	DEFAULT	2

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-22T16:15:42.885616+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56888	31.172.83.147	4258	TCP
2024-12-22T16:15:44.141654+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56890	31.172.83.147	4258	TCP
2024-12-22T16:15:45.330479+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56892	31.172.83.147	4258	TCP
2024-12-22T16:15:46.524108+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56894	31.172.83.147	4258	TCP
2024-12-22T16:15:47.756588+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56896	31.172.83.147	4258	TCP
2024-12-22T16:15:48.970420+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56898	31.172.83.147	4258	TCP
2024-12-22T16:15:50.158997+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56900	31.172.83.147	4258	TCP
2024-12-22T16:15:51.347352+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56902	31.172.83.147	4258	TCP
2024-12-22T16:15:52.966497+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56904	31.172.83.147	4258	TCP
2024-12-22T16:15:54.166100+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56906	31.172.83.147	4258	TCP
2024-12-22T16:15:55.359589+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56908	31.172.83.147	4258	TCP
2024-12-22T16:15:56.547552+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56910	31.172.83.147	4258	TCP
2024-12-22T16:15:57.735387+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56912	31.172.83.147	4258	TCP
2024-12-22T16:15:58.930285+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56914	31.172.83.147	4258	TCP
2024-12-22T16:16:00.131501+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56916	31.172.83.147	4258	TCP
2024-12-22T16:16:01.320168+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56918	31.172.83.147	4258	TCP
2024-12-22T16:16:02.512246+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56920	31.172.83.147	4258	TCP
2024-12-22T16:16:03.700101+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56922	31.172.83.147	4258	TCP
2024-12-22T16:16:04.898086+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56924	31.172.83.147	4258	TCP
2024-12-22T16:16:06.096476+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56926	31.172.83.147	4258	TCP
2024-12-22T16:16:07.293872+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56928	31.172.83.147	4258	TCP
2024-12-22T16:16:08.500738+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56930	31.172.83.147	4258	TCP
2024-12-22T16:16:09.698343+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56932	31.172.83.147	4258	TCP
2024-12-22T16:16:10.886941+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56934	31.172.83.147	4258	TCP
2024-12-22T16:16:12.077965+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56936	31.172.83.147	4258	TCP
2024-12-22T16:16:13.267675+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56938	31.172.83.147	4258	TCP
2024-12-22T16:16:14.458533+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56940	31.172.83.147	4258	TCP
2024-12-22T16:16:15.708122+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56942	31.172.83.147	4258	TCP
2024-12-22T16:16:16.897939+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56944	31.172.83.147	4258	TCP
2024-12-22T16:16:18.183468+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56946	31.172.83.147	4258	TCP
2024-12-22T16:16:19.376805+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56948	31.172.83.147	4258	TCP
2024-12-22T16:16:20.762045+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56950	31.172.83.147	4258	TCP
2024-12-22T16:16:22.115485+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56952	31.172.83.147	4258	TCP
2024-12-22T16:16:23.320940+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56954	31.172.83.147	4258	TCP
2024-12-22T16:16:24.520145+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56956	31.172.83.147	4258	TCP
2024-12-22T16:16:25.867225+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56958	31.172.83.147	4258	TCP
2024-12-22T16:16:27.098865+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56960	31.172.83.147	4258	TCP
2024-12-22T16:16:28.287746+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56962	31.172.83.147	4258	TCP
2024-12-22T16:16:29.475774+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56964	31.172.83.147	4258	TCP
2024-12-22T16:16:30.663539+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56966	31.172.83.147	4258	TCP
2024-12-22T16:16:31.852841+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56968	31.172.83.147	4258	TCP
2024-12-22T16:16:33.040001+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56970	31.172.83.147	4258	TCP
2024-12-22T16:16:34.236828+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56972	31.172.83.147	4258	TCP
2024-12-22T16:16:35.427735+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56974	31.172.83.147	4258	TCP
2024-12-22T16:16:36.617886+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56976	31.172.83.147	4258	TCP
2024-12-22T16:16:37.844735+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56978	31.172.83.147	4258	TCP
2024-12-22T16:16:39.090608+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56980	31.172.83.147	4258	TCP
2024-12-22T16:16:40.278659+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56982	31.172.83.147	4258	TCP
2024-12-22T16:16:41.473842+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56984	31.172.83.147	4258	TCP
2024-12-22T16:16:42.836261+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56986	31.172.83.147	4258	TCP
2024-12-22T16:16:44.033027+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56988	31.172.83.147	4258	TCP
2024-12-22T16:16:45.222590+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56990	31.172.83.147	4258	TCP
2024-12-22T16:16:46.411405+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56992	31.172.83.147	4258	TCP
2024-12-22T16:16:47.612400+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56994	31.172.83.147	4258	TCP
2024-12-22T16:16:48.802749+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56996	31.172.83.147	4258	TCP
2024-12-22T16:16:49.990584+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56998	31.172.83.147	4258	TCP
2024-12-22T16:16:51.179215+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57000	31.172.83.147	4258	TCP
2024-12-22T16:16:52.366301+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57002	31.172.83.147	4258	TCP
2024-12-22T16:16:53.578048+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57004	31.172.83.147	4258	TCP
2024-12-22T16:16:54.776513+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57006	31.172.83.147	4258	TCP
2024-12-22T16:16:55.977951+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57008	31.172.83.147	4258	TCP
2024-12-22T16:16:57.168004+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57010	31.172.83.147	4258	TCP
2024-12-22T16:16:58.357192+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57012	31.172.83.147	4258	TCP
2024-12-22T16:16:59.545672+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57014	31.172.83.147	4258	TCP
2024-12-22T16:17:00.735709+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57016	31.172.83.147	4258	TCP
2024-12-22T16:17:01.953647+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57018	31.172.83.147	4258	TCP
2024-12-22T16:17:03.165014+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57020	31.172.83.147	4258	TCP
2024-12-22T16:17:04.370917+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57022	31.172.83.147	4258	TCP
2024-12-22T16:17:05.567515+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57024	31.172.83.147	4258	TCP
2024-12-22T16:17:06.759674+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57026	31.172.83.147	4258	TCP
2024-12-22T16:17:07.971419+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57028	31.172.83.147	4258	TCP
2024-12-22T16:17:09.174932+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57030	31.172.83.147	4258	TCP
2024-12-22T16:17:10.373523+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57032	31.172.83.147	4258	TCP
2024-12-22T16:17:11.568852+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57034	31.172.83.147	4258	TCP
2024-12-22T16:17:12.837518+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57036	31.172.83.147	4258	TCP
2024-12-22T16:17:14.039743+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57038	31.172.83.147	4258	TCP
2024-12-22T16:17:15.240763+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57040	31.172.83.147	4258	TCP
2024-12-22T16:17:16.429964+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57042	31.172.83.147	4258	TCP
2024-12-22T16:17:17.618619+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57044	31.172.83.147	4258	TCP
2024-12-22T16:17:18.842850+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57046	31.172.83.147	4258	TCP
2024-12-22T16:17:20.063462+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57048	31.172.83.147	4258	TCP
2024-12-22T16:17:21.272252+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57050	31.172.83.147	4258	TCP
2024-12-22T16:17:22.477729+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57052	31.172.83.147	4258	TCP
2024-12-22T16:17:23.665548+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57054	31.172.83.147	4258	TCP
2024-12-22T16:17:24.892258+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57056	31.172.83.147	4258	TCP
2024-12-22T16:17:26.080414+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57058	31.172.83.147	4258	TCP
2024-12-22T16:17:27.289787+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57060	31.172.83.147	4258	TCP
2024-12-22T16:17:28.510783+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57062	31.172.83.147	4258	TCP
2024-12-22T16:17:29.709567+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57064	31.172.83.147	4258	TCP
2024-12-22T16:17:30.898673+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57066	31.172.83.147	4258	TCP
2024-12-22T16:17:32.101023+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57068	31.172.83.147	4258	TCP
2024-12-22T16:17:33.339575+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57070	31.172.83.147	4258	TCP
2024-12-22T16:17:34.528367+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57072	31.172.83.147	4258	TCP
2024-12-22T16:17:35.716371+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57074	31.172.83.147	4258	TCP
2024-12-22T16:17:36.907649+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57076	31.172.83.147	4258	TCP
2024-12-22T16:17:38.099027+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57078	31.172.83.147	4258	TCP
2024-12-22T16:17:39.289042+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57080	31.172.83.147	4258	TCP
2024-12-22T16:17:40.487176+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57082	31.172.83.147	4258	TCP
2024-12-22T16:17:41.710898+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57084	31.172.83.147	4258	TCP
2024-12-22T16:17:42.898519+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57086	31.172.83.147	4258	TCP
2024-12-22T16:17:44.269664+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57088	31.172.83.147	4258	TCP
2024-12-22T16:17:45.457269+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57090	31.172.83.147	4258	TCP
2024-12-22T16:17:46.727216+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57092	31.172.83.147	4258	TCP
2024-12-22T16:17:47.918787+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57094	31.172.83.147	4258	TCP
2024-12-22T16:17:49.109377+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57096	31.172.83.147	4258	TCP
2024-12-22T16:17:50.297108+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57098	31.172.83.147	4258	TCP
2024-12-22T16:17:51.494892+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57100	31.172.83.147	4258	TCP
2024-12-22T16:17:52.683959+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57102	31.172.83.147	4258	TCP
2024-12-22T16:17:54.066195+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57104	31.172.83.147	4258	TCP
2024-12-22T16:17:55.258736+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57106	31.172.83.147	4258	TCP
2024-12-22T16:17:56.449139+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57108	31.172.83.147	4258	TCP
2024-12-22T16:17:57.646824+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57110	31.172.83.147	4258	TCP
2024-12-22T16:17:58.843424+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57112	31.172.83.147	4258	TCP
2024-12-22T16:18:00.052964+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57114	31.172.83.147	4258	TCP
2024-12-22T16:18:01.240496+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57116	31.172.83.147	4258	TCP
2024-12-22T16:18:02.428902+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57118	31.172.83.147	4258	TCP
2024-12-22T16:18:03.619897+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57120	31.172.83.147	4258	TCP
2024-12-22T16:18:04.808816+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57122	31.172.83.147	4258	TCP
2024-12-22T16:18:06.000653+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57124	31.172.83.147	4258	TCP
2024-12-22T16:18:07.190010+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57126	31.172.83.147	4258	TCP
2024-12-22T16:18:08.378228+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57128	31.172.83.147	4258	TCP
2024-12-22T16:18:09.585086+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57130	31.172.83.147	4258	TCP
2024-12-22T16:18:10.773575+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57132	31.172.83.147	4258	TCP
2024-12-22T16:18:11.965878+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57134	31.172.83.147	4258	TCP
2024-12-22T16:18:13.162783+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57136	31.172.83.147	4258	TCP
2024-12-22T16:18:14.361495+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57138	31.172.83.147	4258	TCP
2024-12-22T16:18:15.552037+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57140	31.172.83.147	4258	TCP
2024-12-22T16:18:16.744512+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57142	31.172.83.147	4258	TCP
2024-12-22T16:18:17.933362+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57144	31.172.83.147	4258	TCP
2024-12-22T16:18:19.154002+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57146	31.172.83.147	4258	TCP
2024-12-22T16:18:20.342769+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57148	31.172.83.147	4258	TCP
2024-12-22T16:18:21.531889+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57150	31.172.83.147	4258	TCP
2024-12-22T16:18:22.735551+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57152	31.172.83.147	4258	TCP
2024-12-22T16:18:23.940372+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57154	31.172.83.147	4258	TCP
2024-12-22T16:18:25.137872+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57156	31.172.83.147	4258	TCP
2024-12-22T16:18:26.326684+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57158	31.172.83.147	4258	TCP
2024-12-22T16:18:27.521516+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57160	31.172.83.147	4258	TCP
2024-12-22T16:18:28.727507+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57164	31.172.83.147	4258	TCP
2024-12-22T16:18:30.006403+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57166	31.172.83.147	4258	TCP
2024-12-22T16:18:31.204643+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57168	31.172.83.147	4258	TCP
2024-12-22T16:18:32.393628+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57170	31.172.83.147	4258	TCP
2024-12-22T16:18:34.378719+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57172	31.172.83.147	4258	TCP
2024-12-22T16:18:35.577653+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57174	31.172.83.147	4258	TCP
2024-12-22T16:18:37.807475+0100	2843713	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	57176	31.172.83.147	4258	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 22, 2024 16:15:42.765682936 CET	56888	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:15:42.885329008 CET	4258	56888	31.172.83.147	192.168.2.14
Dec 22, 2024 16:15:42.885615110 CET	56888	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:15:42.885616064 CET	56888	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:15:43.005218983 CET	4258	56888	31.172.83.147	192.168.2.14
Dec 22, 2024 16:15:44.020806074 CET	4258	56888	31.172.83.147	192.168.2.14
Dec 22, 2024 16:15:44.020869017 CET	4258	56888	31.172.83.147	192.168.2.14
Dec 22, 2024 16:15:44.021228075 CET	56888	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:15:44.021228075 CET	56888	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:15:44.021857977 CET	56890	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:15:44.140842915 CET	4258	56888	31.172.83.147	192.168.2.14
Dec 22, 2024 16:15:44.141321898 CET	4258	56890	31.172.83.147	192.168.2.14
Dec 22, 2024 16:15:44.141464949 CET	56890	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:15:44.141654015 CET	56890	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:15:44.262064934 CET	4258	56890	31.172.83.147	192.168.2.14
Dec 22, 2024 16:15:45.209655046 CET	4258	56890	31.172.83.147	192.168.2.14
Dec 22, 2024 16:15:45.209842920 CET	56890	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:15:45.209886074 CET	4258	56890	31.172.83.147	192.168.2.14
Dec 22, 2024 16:15:45.209968090 CET	56890	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:15:45.210604906 CET	56892	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:15:45.329483986 CET	4258	56890	31.172.83.147	192.168.2.14
Dec 22, 2024 16:15:45.330166101 CET	4258	56892	31.172.83.147	192.168.2.14
Dec 22, 2024 16:15:45.330395937 CET	56892	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:15:45.330478907 CET	56892	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:15:45.450030088 CET	4258	56892	31.172.83.147	192.168.2.14
Dec 22, 2024 16:15:46.397128105 CET	4258	56892	31.172.83.147	192.168.2.14
Dec 22, 2024 16:15:46.397180080 CET	4258	56892	31.172.83.147	192.168.2.14
Dec 22, 2024 16:15:46.397473097 CET	56892	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:15:46.397473097 CET	56892	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:15:46.398130894 CET	56894	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:15:46.523456097 CET	4258	56892	31.172.83.147	192.168.2.14
Dec 22, 2024 16:15:46.523849964 CET	4258	56894	31.172.83.147	192.168.2.14
Dec 22, 2024 16:15:46.524017096 CET	56894	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:15:46.524107933 CET	56894	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:15:46.643835068 CET	4258	56894	31.172.83.147	192.168.2.14
Dec 22, 2024 16:15:47.634274960 CET	4258	56894	31.172.83.147	192.168.2.14
Dec 22, 2024 16:15:47.634393930 CET	4258	56894	31.172.83.147	192.168.2.14
Dec 22, 2024 16:15:47.634561062 CET	56894	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:15:47.634602070 CET	56894	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:15:47.635137081 CET	56896	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:15:47.755737066 CET	4258	56894	31.172.83.147	192.168.2.14
Dec 22, 2024 16:15:47.756232977 CET	4258	56896	31.172.83.147	192.168.2.14
Dec 22, 2024 16:15:47.756375074 CET	56896	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:15:47.756587982 CET	56896	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:15:47.876080036 CET	4258	56896	31.172.83.147	192.168.2.14
Dec 22, 2024 16:15:48.849986076 CET	4258	56896	31.172.83.147	192.168.2.14
Dec 22, 2024 16:15:48.850029945 CET	4258	56896	31.172.83.147	192.168.2.14
Dec 22, 2024 16:15:48.850198030 CET	56896	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:15:48.850280046 CET	56896	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:15:48.850891113 CET	56898	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:15:48.969793081 CET	4258	56896	31.172.83.147	192.168.2.14
Dec 22, 2024 16:15:48.970334053 CET	4258	56898	31.172.83.147	192.168.2.14
Dec 22, 2024 16:15:48.970419884 CET	56898	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:15:48.970419884 CET	56898	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:15:49.090476036 CET	4258	56898	31.172.83.147	192.168.2.14
Dec 22, 2024 16:15:50.037857056 CET	4258	56898	31.172.83.147	192.168.2.14
Dec 22, 2024 16:15:50.037899971 CET	4258	56898	31.172.83.147	192.168.2.14
Dec 22, 2024 16:15:50.038469076 CET	56898	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:15:50.038469076 CET	56898	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:15:50.039002895 CET	56900	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:15:50.158309937 CET	4258	56898	31.172.83.147	192.168.2.14
Dec 22, 2024 16:15:50.158703089 CET	4258	56900	31.172.83.147	192.168.2.14
Dec 22, 2024 16:15:50.158997059 CET	56900	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:15:50.158997059 CET	56900	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:15:50.278536081 CET	4258	56900	31.172.83.147	192.168.2.14
Dec 22, 2024 16:15:51.226315975 CET	4258	56900	31.172.83.147	192.168.2.14
Dec 22, 2024 16:15:51.226330996 CET	4258	56900	31.172.83.147	192.168.2.14
Dec 22, 2024 16:15:51.226521969 CET	56900	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:15:51.226587057 CET	56900	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:15:51.227257967 CET	56902	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:15:51.346462011 CET	4258	56900	31.172.83.147	192.168.2.14
Dec 22, 2024 16:15:51.347104073 CET	4258	56902	31.172.83.147	192.168.2.14
Dec 22, 2024 16:15:51.347352028 CET	56902	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:15:51.347352028 CET	56902	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:15:51.466927052 CET	4258	56902	31.172.83.147	192.168.2.14
Dec 22, 2024 16:15:52.845264912 CET	4258	56902	31.172.83.147	192.168.2.14
Dec 22, 2024 16:15:52.845280886 CET	4258	56902	31.172.83.147	192.168.2.14
Dec 22, 2024 16:15:52.845325947 CET	4258	56902	31.172.83.147	192.168.2.14
Dec 22, 2024 16:15:52.845810890 CET	56902	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:15:52.845810890 CET	56902	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:15:52.845810890 CET	56902	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:15:52.846563101 CET	56904	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:15:52.965420008 CET	4258	56902	31.172.83.147	192.168.2.14
Dec 22, 2024 16:15:52.966146946 CET	4258	56904	31.172.83.147	192.168.2.14
Dec 22, 2024 16:15:52.966418028 CET	56904	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:15:52.966496944 CET	56904	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:15:53.086354017 CET	4258	56904	31.172.83.147	192.168.2.14
Dec 22, 2024 16:15:54.045046091 CET	4258	56904	31.172.83.147	192.168.2.14
Dec 22, 2024 16:15:54.045104027 CET	4258	56904	31.172.83.147	192.168.2.14
Dec 22, 2024 16:15:54.045345068 CET	56904	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:15:54.045398951 CET	56904	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:15:54.046327114 CET	56906	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:15:54.165119886 CET	4258	56904	31.172.83.147	192.168.2.14
Dec 22, 2024 16:15:54.165851116 CET	4258	56906	31.172.83.147	192.168.2.14
Dec 22, 2024 16:15:54.165981054 CET	56906	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:15:54.166100025 CET	56906	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:15:54.285628080 CET	4258	56906	31.172.83.147	192.168.2.14
Dec 22, 2024 16:15:55.238215923 CET	4258	56906	31.172.83.147	192.168.2.14
Dec 22, 2024 16:15:55.238234997 CET	4258	56906	31.172.83.147	192.168.2.14
Dec 22, 2024 16:15:55.238666058 CET	56906	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:15:55.238667011 CET	56906	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:15:55.239429951 CET	56908	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:15:55.358526945 CET	4258	56906	31.172.83.147	192.168.2.14
Dec 22, 2024 16:15:55.359237909 CET	4258	56908	31.172.83.147	192.168.2.14
Dec 22, 2024 16:15:55.359507084 CET	56908	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:15:55.359589100 CET	56908	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:15:55.479351997 CET	4258	56908	31.172.83.147	192.168.2.14
Dec 22, 2024 16:15:56.426719904 CET	4258	56908	31.172.83.147	192.168.2.14
Dec 22, 2024 16:15:56.426745892 CET	4258	56908	31.172.83.147	192.168.2.14
Dec 22, 2024 16:15:56.426909924 CET	56908	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:15:56.427001953 CET	56908	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:15:56.427723885 CET	56910	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:15:56.546811104 CET	4258	56908	31.172.83.147	192.168.2.14
Dec 22, 2024 16:15:56.547436953 CET	4258	56910	31.172.83.147	192.168.2.14
Dec 22, 2024 16:15:56.547530890 CET	56910	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:15:56.547552109 CET	56910	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:15:56.667279005 CET	4258	56910	31.172.83.147	192.168.2.14
Dec 22, 2024 16:15:57.614424944 CET	4258	56910	31.172.83.147	192.168.2.14
Dec 22, 2024 16:15:57.614443064 CET	4258	56910	31.172.83.147	192.168.2.14
Dec 22, 2024 16:15:57.614681005 CET	56910	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:15:57.614681005 CET	56910	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:15:57.615191936 CET	56912	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:15:57.734714031 CET	4258	56910	31.172.83.147	192.168.2.14
Dec 22, 2024 16:15:57.735156059 CET	4258	56912	31.172.83.147	192.168.2.14
Dec 22, 2024 16:15:57.735225916 CET	56912	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:15:57.735387087 CET	56912	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:15:57.854835987 CET	4258	56912	31.172.83.147	192.168.2.14
Dec 22, 2024 16:15:58.803806067 CET	4258	56912	31.172.83.147	192.168.2.14
Dec 22, 2024 16:15:58.803922892 CET	4258	56912	31.172.83.147	192.168.2.14
Dec 22, 2024 16:15:58.803960085 CET	56912	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:15:58.804018974 CET	56912	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:15:58.804522038 CET	56914	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:15:58.929713011 CET	4258	56912	31.172.83.147	192.168.2.14
Dec 22, 2024 16:15:58.930157900 CET	4258	56914	31.172.83.147	192.168.2.14
Dec 22, 2024 16:15:58.930262089 CET	56914	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:15:58.930284977 CET	56914	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:15:59.050470114 CET	4258	56914	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:00.011156082 CET	4258	56914	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:00.011228085 CET	4258	56914	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:00.011305094 CET	56914	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:00.011353016 CET	56914	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:00.011830091 CET	56916	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:00.131082058 CET	4258	56914	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:00.131372929 CET	4258	56916	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:00.131465912 CET	56916	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:00.131500959 CET	56916	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:00.251588106 CET	4258	56916	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:01.199543953 CET	4258	56916	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:01.199588060 CET	4258	56916	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:01.199776888 CET	56916	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:01.199776888 CET	56916	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:01.200364113 CET	56918	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:01.319425106 CET	4258	56916	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:01.319905043 CET	4258	56918	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:01.320168018 CET	56918	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:01.320168018 CET	56918	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:01.439795971 CET	4258	56918	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:02.387476921 CET	4258	56918	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:02.387489080 CET	4258	56918	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:02.387584925 CET	56918	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:02.391786098 CET	56918	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:02.392642975 CET	56920	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:02.511291027 CET	4258	56918	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:02.512142897 CET	4258	56920	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:02.512245893 CET	56920	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:02.512245893 CET	56920	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:02.631844044 CET	4258	56920	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:03.579762936 CET	4258	56920	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:03.579862118 CET	4258	56920	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:03.579900026 CET	56920	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:03.579957962 CET	56920	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:03.580439091 CET	56922	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:03.699475050 CET	4258	56920	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:03.699901104 CET	4258	56922	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:03.700059891 CET	56922	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:03.700100899 CET	56922	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:03.819796085 CET	4258	56922	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:04.777059078 CET	4258	56922	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:04.777173996 CET	4258	56922	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:04.777406931 CET	56922	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:04.777406931 CET	56922	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:04.778498888 CET	56924	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:04.897037029 CET	4258	56922	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:04.897968054 CET	4258	56924	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:04.898086071 CET	56924	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:04.898086071 CET	56924	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:05.017671108 CET	4258	56924	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:05.976336956 CET	4258	56924	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:05.976371050 CET	4258	56924	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:05.976438999 CET	56924	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:05.976480961 CET	56924	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:05.976906061 CET	56926	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:06.096204042 CET	4258	56924	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:06.096402884 CET	4258	56926	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:06.096456051 CET	56926	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:06.096476078 CET	56926	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:06.216914892 CET	4258	56926	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:07.168551922 CET	4258	56926	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:07.168669939 CET	56926	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:07.168690920 CET	4258	56926	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:07.168745995 CET	56926	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:07.169300079 CET	56928	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:07.293080091 CET	4258	56926	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:07.293581963 CET	4258	56928	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:07.293811083 CET	56928	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:07.293872118 CET	56928	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:07.419033051 CET	4258	56928	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:08.374428034 CET	4258	56928	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:08.374455929 CET	4258	56928	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:08.374608040 CET	56928	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:08.374685049 CET	56928	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:08.375590086 CET	56930	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:08.498133898 CET	4258	56928	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:08.500562906 CET	4258	56930	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:08.500695944 CET	56930	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:08.500737906 CET	56930	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:08.620904922 CET	4258	56930	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:09.577438116 CET	4258	56930	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:09.577538013 CET	4258	56930	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:09.577699900 CET	56930	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:09.577701092 CET	56930	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:09.578609943 CET	56932	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:09.697304964 CET	4258	56930	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:09.698168039 CET	4258	56932	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:09.698343039 CET	56932	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:09.698343039 CET	56932	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:09.818227053 CET	4258	56932	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:10.765909910 CET	4258	56932	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:10.765974998 CET	4258	56932	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:10.766180038 CET	56932	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:10.766180038 CET	56932	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:10.767045021 CET	56934	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:10.886003017 CET	4258	56932	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:10.886714935 CET	4258	56934	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:10.886940956 CET	56934	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:10.886940956 CET	56934	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:11.006623030 CET	4258	56934	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:11.954372883 CET	4258	56934	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:11.954505920 CET	56934	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:11.954577923 CET	4258	56934	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:11.954699039 CET	56934	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:11.955538034 CET	56936	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:12.076723099 CET	4258	56934	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:12.077768087 CET	4258	56936	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:12.077965021 CET	56936	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:12.077965021 CET	56936	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:12.199354887 CET	4258	56936	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:13.146694899 CET	4258	56936	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:13.146908998 CET	56936	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:13.146996975 CET	4258	56936	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:13.147058010 CET	56936	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:13.147877932 CET	56938	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:13.266781092 CET	4258	56936	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:13.267507076 CET	4258	56938	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:13.267644882 CET	56938	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:13.267674923 CET	56938	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:13.387701035 CET	4258	56938	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:14.336554050 CET	4258	56938	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:14.336599112 CET	4258	56938	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:14.336707115 CET	56938	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:14.336889029 CET	56938	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:14.337879896 CET	56940	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:14.457161903 CET	4258	56938	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:14.458210945 CET	4258	56940	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:14.458463907 CET	56940	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:14.458533049 CET	56940	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:14.578212976 CET	4258	56940	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:15.584717989 CET	4258	56940	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:15.584775925 CET	4258	56940	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:15.584877968 CET	56940	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:15.584971905 CET	56940	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:15.585879087 CET	56942	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:15.706876993 CET	4258	56940	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:15.707911015 CET	4258	56942	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:15.708070993 CET	56942	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:15.708122015 CET	56942	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:15.829035044 CET	4258	56942	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:16.775558949 CET	4258	56942	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:16.775691032 CET	56942	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:16.776098967 CET	4258	56942	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:16.776177883 CET	56942	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:16.776932955 CET	56944	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:16.897301912 CET	4258	56942	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:16.897828102 CET	4258	56944	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:16.897903919 CET	56944	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:16.897938967 CET	56944	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:17.018181086 CET	4258	56944	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:18.060349941 CET	4258	56944	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:18.060461998 CET	56944	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:18.060548067 CET	4258	56944	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:18.060642958 CET	56944	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:18.061392069 CET	56946	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:18.182751894 CET	4258	56944	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:18.183233023 CET	4258	56946	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:18.183468103 CET	56946	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:18.183468103 CET	56946	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:18.305438042 CET	4258	56946	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:19.254625082 CET	4258	56946	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:19.254700899 CET	4258	56946	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:19.254802942 CET	56946	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:19.254910946 CET	56946	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:19.255888939 CET	56948	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:19.375535011 CET	4258	56946	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:19.376456022 CET	4258	56948	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:19.376722097 CET	56948	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:19.376805067 CET	56948	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:19.496479988 CET	4258	56948	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:20.640603065 CET	4258	56948	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:20.640641928 CET	4258	56948	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:20.640907049 CET	56948	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:20.641010046 CET	56948	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:20.642111063 CET	56950	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:20.699806929 CET	4258	56948	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:20.699924946 CET	56948	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:20.760512114 CET	4258	56948	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:20.761918068 CET	4258	56950	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:20.762017012 CET	56950	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:20.762044907 CET	56950	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:20.885512114 CET	4258	56950	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:21.838627100 CET	4258	56950	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:21.838790894 CET	4258	56950	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:21.838785887 CET	56950	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:21.838880062 CET	56950	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:21.839833975 CET	56952	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:22.115091085 CET	4258	56950	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:22.115153074 CET	4258	56952	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:22.115422964 CET	56952	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:22.115484953 CET	56952	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:22.235193014 CET	4258	56952	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:23.198203087 CET	4258	56952	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:23.198354006 CET	4258	56952	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:23.198493958 CET	56952	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:23.198561907 CET	56952	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:23.199295044 CET	56954	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:23.320050955 CET	4258	56952	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:23.320852995 CET	4258	56954	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:23.320940018 CET	56954	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:23.320940018 CET	56954	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:23.441129923 CET	4258	56954	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:24.398345947 CET	4258	56954	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:24.398403883 CET	4258	56954	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:24.398518085 CET	56954	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:24.398608923 CET	56954	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:24.399573088 CET	56956	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:24.518970966 CET	4258	56954	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:24.519937038 CET	4258	56956	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:24.520095110 CET	56956	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:24.520144939 CET	56956	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:24.639862061 CET	4258	56956	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:25.746192932 CET	4258	56956	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:25.746340990 CET	4258	56956	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:25.746504068 CET	56956	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:25.746603012 CET	56956	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:25.747358084 CET	56958	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:25.866362095 CET	4258	56956	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:25.866956949 CET	4258	56958	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:25.867136002 CET	56958	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:25.867224932 CET	56958	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:25.987684965 CET	4258	56958	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:26.977598906 CET	4258	56958	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:26.977711916 CET	4258	56958	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:26.977772951 CET	56958	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:26.977859020 CET	56958	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:26.978818893 CET	56960	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:27.097657919 CET	4258	56958	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:27.098546982 CET	4258	56960	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:27.098798990 CET	56960	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:27.098865032 CET	56960	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:27.219167948 CET	4258	56960	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:28.166745901 CET	4258	56960	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:28.166871071 CET	56960	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:28.166913033 CET	4258	56960	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:28.167083979 CET	56960	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:28.168013096 CET	56962	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:28.286763906 CET	4258	56960	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:28.287548065 CET	4258	56962	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:28.287669897 CET	56962	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:28.287745953 CET	56962	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:28.407684088 CET	4258	56962	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:29.354726076 CET	4258	56962	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:29.354796886 CET	4258	56962	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:29.354871988 CET	56962	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:29.354971886 CET	56962	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:29.355838060 CET	56964	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:29.474530935 CET	4258	56962	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:29.475439072 CET	4258	56964	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:29.475725889 CET	56964	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:29.475774050 CET	56964	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:29.595509052 CET	4258	56964	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:30.542412043 CET	4258	56964	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:30.542470932 CET	4258	56964	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:30.542692900 CET	56964	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:30.542870045 CET	56964	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:30.543787003 CET	56966	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:30.662561893 CET	4258	56964	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:30.663341999 CET	4258	56966	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:30.663469076 CET	56966	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:30.663538933 CET	56966	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:30.783128023 CET	4258	56966	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:31.730374098 CET	4258	56966	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:31.730407000 CET	4258	56966	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:31.730453014 CET	56966	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:31.730525970 CET	56966	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:31.731262922 CET	56968	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:31.851495028 CET	4258	56966	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:31.852525949 CET	4258	56968	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:31.852772951 CET	56968	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:31.852840900 CET	56968	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:31.972404003 CET	4258	56968	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:32.919250965 CET	4258	56968	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:32.919282913 CET	4258	56968	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:32.919370890 CET	56968	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:32.919504881 CET	56968	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:32.920258999 CET	56970	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:33.039088964 CET	4258	56968	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:33.039891958 CET	4258	56970	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:33.039973974 CET	56970	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:33.040000916 CET	56970	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:33.159903049 CET	4258	56970	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:34.116072893 CET	4258	56970	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:34.116180897 CET	56970	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:34.116317034 CET	4258	56970	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:34.116377115 CET	56970	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:34.117074966 CET	56972	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:34.235898972 CET	4258	56970	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:34.236588001 CET	4258	56972	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:34.236774921 CET	56972	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:34.236828089 CET	56972	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:34.360713005 CET	4258	56972	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:35.307080984 CET	4258	56972	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:35.307117939 CET	4258	56972	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:35.307296991 CET	56972	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:35.307380915 CET	56972	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:35.308034897 CET	56974	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:35.427083015 CET	4258	56972	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:35.427560091 CET	4258	56974	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:35.427678108 CET	56974	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:35.427735090 CET	56974	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:35.548463106 CET	4258	56974	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:36.495496988 CET	4258	56974	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:36.495609045 CET	4258	56974	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:36.495716095 CET	56974	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:36.495811939 CET	56974	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:36.496527910 CET	56976	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:36.616991043 CET	4258	56974	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:36.617706060 CET	4258	56976	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:36.617837906 CET	56976	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:36.617886066 CET	56976	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:36.738280058 CET	4258	56976	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:37.718943119 CET	4258	56976	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:37.719064951 CET	4258	56976	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:37.719218969 CET	56976	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:37.719337940 CET	56976	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:37.720135927 CET	56978	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:37.843719959 CET	4258	56976	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:37.844624043 CET	4258	56978	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:37.844733953 CET	56978	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:37.844734907 CET	56978	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:37.968626976 CET	4258	56978	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:38.970046043 CET	4258	56978	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:38.970114946 CET	4258	56978	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:38.970313072 CET	56978	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:38.970376015 CET	56978	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:38.970777035 CET	56980	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:39.089917898 CET	4258	56978	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:39.090415955 CET	4258	56980	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:39.090553999 CET	56980	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:39.090607882 CET	56980	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:39.210304022 CET	4258	56980	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:40.157354116 CET	4258	56980	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:40.157541990 CET	4258	56980	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:40.157562971 CET	56980	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:40.157628059 CET	56980	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:40.158096075 CET	56982	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:40.277801991 CET	4258	56980	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:40.278219938 CET	4258	56982	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:40.278659105 CET	56982	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:40.278659105 CET	56982	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:40.404572010 CET	4258	56982	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:41.351428986 CET	4258	56982	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:41.351558924 CET	4258	56982	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:41.351578951 CET	56982	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:41.351645947 CET	56982	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:41.352308035 CET	56984	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:41.472918987 CET	4258	56982	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:41.473613024 CET	4258	56984	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:41.473786116 CET	56984	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:41.473841906 CET	56984	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:41.594211102 CET	4258	56984	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:42.541114092 CET	4258	56984	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:42.541317940 CET	56984	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:42.541513920 CET	4258	56984	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:42.541616917 CET	56984	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:42.542368889 CET	56986	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:42.823769093 CET	4258	56984	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:42.823909998 CET	56984	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:42.836020947 CET	4258	56984	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:42.836033106 CET	4258	56986	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:42.836163044 CET	56986	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:42.836261034 CET	56986	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:42.956134081 CET	4258	56986	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:43.912466049 CET	4258	56986	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:43.912602901 CET	4258	56986	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:43.912636995 CET	56986	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:43.912688971 CET	56986	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:43.913202047 CET	56988	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:44.032474995 CET	4258	56986	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:44.032949924 CET	4258	56988	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:44.033006907 CET	56988	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:44.033026934 CET	56988	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:44.154067039 CET	4258	56988	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:45.101386070 CET	4258	56988	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:45.101527929 CET	56988	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:45.101619959 CET	4258	56988	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:45.101708889 CET	56988	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:45.102503061 CET	56990	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:45.221458912 CET	4258	56988	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:45.222275972 CET	4258	56990	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:45.222503901 CET	56990	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:45.222589970 CET	56990	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:45.342206955 CET	4258	56990	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:46.290323973 CET	4258	56990	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:46.290374994 CET	4258	56990	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:46.290683985 CET	56990	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:46.290805101 CET	56990	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:46.291506052 CET	56992	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:46.410527945 CET	4258	56990	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:46.411175966 CET	4258	56992	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:46.411405087 CET	56992	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:46.411405087 CET	56992	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:46.531167030 CET	4258	56992	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:47.489089012 CET	4258	56992	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:47.489311934 CET	4258	56992	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:47.489384890 CET	56992	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:47.489476919 CET	56992	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:47.490111113 CET	56994	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:47.611812115 CET	4258	56992	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:47.612215042 CET	4258	56994	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:47.612332106 CET	56994	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:47.612400055 CET	56994	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:47.732036114 CET	4258	56994	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:48.681782961 CET	4258	56994	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:48.681953907 CET	56994	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:48.682019949 CET	4258	56994	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:48.682178020 CET	56994	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:48.683002949 CET	56996	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:48.801619053 CET	4258	56994	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:48.802525043 CET	4258	56996	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:48.802687883 CET	56996	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:48.802748919 CET	56996	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:48.922528028 CET	4258	56996	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:49.869523048 CET	4258	56996	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:49.869600058 CET	4258	56996	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:49.869784117 CET	56996	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:49.869976997 CET	56996	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:49.870737076 CET	56998	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:49.989532948 CET	4258	56996	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:49.990385056 CET	4258	56998	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:49.990511894 CET	56998	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:49.990583897 CET	56998	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:50.110297918 CET	4258	56998	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:51.058017015 CET	4258	56998	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:51.058124065 CET	4258	56998	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:51.058257103 CET	56998	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:51.058345079 CET	56998	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:51.059020042 CET	57000	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:51.178514957 CET	4258	56998	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:51.178903103 CET	4258	57000	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:51.179214954 CET	57000	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:51.179214954 CET	57000	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:51.299084902 CET	4258	57000	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:52.245440006 CET	4258	57000	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:52.245469093 CET	4258	57000	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:52.245593071 CET	57000	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:52.245697021 CET	57000	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:52.246248007 CET	57002	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:52.365652084 CET	4258	57000	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:52.366122007 CET	4258	57002	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:52.366301060 CET	57002	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:52.366301060 CET	57002	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:52.486540079 CET	4258	57002	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:53.450355053 CET	4258	57002	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:53.450536966 CET	57002	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:53.450584888 CET	4258	57002	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:53.450700045 CET	57002	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:53.451431036 CET	57004	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:53.577003002 CET	4258	57002	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:53.577792883 CET	4258	57004	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:53.577935934 CET	57004	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:53.578047991 CET	57004	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:53.698235989 CET	4258	57004	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:54.655729055 CET	4258	57004	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:54.655839920 CET	57004	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:54.655848026 CET	4258	57004	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:54.655941963 CET	57004	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:54.656703949 CET	57006	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:54.775388002 CET	4258	57004	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:54.776201963 CET	4258	57006	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:54.776448965 CET	57006	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:54.776513100 CET	57006	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:54.896553040 CET	4258	57006	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:55.856066942 CET	4258	57006	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:55.856168032 CET	4258	57006	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:55.856192112 CET	57006	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:55.856234074 CET	57006	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:55.856812954 CET	57008	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:55.977771044 CET	4258	57006	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:55.977788925 CET	4258	57008	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:55.977871895 CET	57008	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:55.977951050 CET	57008	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:56.098634958 CET	4258	57008	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:57.047607899 CET	4258	57008	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:57.047728062 CET	57008	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:57.047785997 CET	4258	57008	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:57.047857046 CET	57008	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:57.048384905 CET	57010	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:57.167414904 CET	4258	57008	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:57.167896032 CET	4258	57010	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:57.167975903 CET	57010	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:57.168004036 CET	57010	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:57.288784027 CET	4258	57010	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:58.236044884 CET	4258	57010	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:58.236160994 CET	57010	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:58.236311913 CET	4258	57010	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:58.236417055 CET	57010	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:58.237263918 CET	57012	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:58.356136084 CET	4258	57010	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:58.356931925 CET	4258	57012	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:58.357192039 CET	57012	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:58.357192039 CET	57012	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:58.477123976 CET	4258	57012	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:59.423845053 CET	4258	57012	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:59.423902988 CET	4258	57012	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:59.424072981 CET	57012	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:59.424073935 CET	57012	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:59.424968004 CET	57014	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:59.544837952 CET	4258	57012	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:59.545423985 CET	4258	57014	31.172.83.147	192.168.2.14
Dec 22, 2024 16:16:59.545512915 CET	57014	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:59.545671940 CET	57014	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:16:59.665405035 CET	4258	57014	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:00.613578081 CET	4258	57014	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:00.613600969 CET	4258	57014	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:00.613904953 CET	57014	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:00.613904953 CET	57014	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:00.614973068 CET	57016	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:00.734597921 CET	4258	57014	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:00.735477924 CET	4258	57016	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:00.735677004 CET	57016	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:00.735708952 CET	57016	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:00.855559111 CET	4258	57016	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:01.832731009 CET	4258	57016	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:01.832916021 CET	4258	57016	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:01.833029985 CET	57016	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:01.833101988 CET	57016	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:01.833897114 CET	57018	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:01.952759981 CET	4258	57016	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:01.953392029 CET	4258	57018	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:01.953478098 CET	57018	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:01.953646898 CET	57018	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:02.073144913 CET	4258	57018	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:03.043746948 CET	4258	57018	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:03.043869972 CET	4258	57018	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:03.044039965 CET	57018	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:03.044101000 CET	57018	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:03.045207024 CET	57020	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:03.163932085 CET	4258	57018	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:03.164783955 CET	4258	57020	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:03.164974928 CET	57020	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:03.165014029 CET	57020	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:03.284666061 CET	4258	57020	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:04.249114990 CET	4258	57020	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:04.249211073 CET	4258	57020	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:04.249504089 CET	57020	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:04.249505043 CET	57020	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:04.250318050 CET	57022	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:04.369848013 CET	4258	57020	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:04.370678902 CET	4258	57022	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:04.370769024 CET	57022	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:04.370917082 CET	57022	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:04.490747929 CET	4258	57022	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:05.446500063 CET	4258	57022	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:05.446605921 CET	4258	57022	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:05.446821928 CET	57022	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:05.446927071 CET	57022	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:05.447839022 CET	57024	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:05.566534042 CET	4258	57022	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:05.567406893 CET	4258	57024	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:05.567461967 CET	57024	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:05.567514896 CET	57024	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:05.687077045 CET	4258	57024	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:06.638607979 CET	4258	57024	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:06.638731003 CET	4258	57024	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:06.638818026 CET	57024	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:06.638911963 CET	57024	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:06.639894962 CET	57026	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:06.758373976 CET	4258	57024	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:06.759430885 CET	4258	57026	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:06.759674072 CET	57026	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:06.759674072 CET	57026	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:06.879338026 CET	4258	57026	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:07.844455004 CET	4258	57026	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:07.844635963 CET	4258	57026	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:07.844655037 CET	57026	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:07.844727039 CET	57026	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:07.845504045 CET	57028	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:07.970386982 CET	4258	57026	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:07.971160889 CET	4258	57028	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:07.971354961 CET	57028	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:07.971419096 CET	57028	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:08.094891071 CET	4258	57028	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:09.053873062 CET	4258	57028	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:09.054035902 CET	57028	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:09.054049969 CET	4258	57028	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:09.054136038 CET	57028	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:09.054981947 CET	57030	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:09.174029112 CET	4258	57028	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:09.174655914 CET	4258	57030	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:09.174932003 CET	57030	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:09.174932003 CET	57030	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:09.294693947 CET	4258	57030	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:10.252376080 CET	4258	57030	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:10.252397060 CET	4258	57030	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:10.252770901 CET	57030	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:10.252856016 CET	57030	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:10.253432989 CET	57032	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:10.372807980 CET	4258	57030	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:10.373306036 CET	4258	57032	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:10.373435974 CET	57032	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:10.373522997 CET	57032	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:10.493103981 CET	4258	57032	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:11.447146893 CET	4258	57032	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:11.447170019 CET	4258	57032	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:11.447263956 CET	57032	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:11.447278976 CET	57032	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:11.448266029 CET	57034	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:11.567775965 CET	4258	57032	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:11.568542957 CET	4258	57034	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:11.568788052 CET	57034	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:11.568851948 CET	57034	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:11.689455986 CET	4258	57034	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:12.716396093 CET	4258	57034	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:12.716492891 CET	4258	57034	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:12.716650963 CET	57034	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:12.716701984 CET	57034	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:12.717489958 CET	57036	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:12.836769104 CET	4258	57034	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:12.837172985 CET	4258	57036	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:12.837517023 CET	57036	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:12.837517977 CET	57036	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:12.957277060 CET	4258	57036	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:13.917541981 CET	4258	57036	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:13.917589903 CET	4258	57036	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:13.917896986 CET	57036	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:13.917896986 CET	57036	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:13.918739080 CET	57038	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:14.038836002 CET	4258	57036	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:14.039458036 CET	4258	57038	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:14.039742947 CET	57038	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:14.039742947 CET	57038	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:14.160418034 CET	4258	57038	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:15.118494034 CET	4258	57038	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:15.118578911 CET	4258	57038	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:15.118678093 CET	57038	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:15.118779898 CET	57038	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:15.119533062 CET	57040	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:15.240310907 CET	4258	57038	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:15.240425110 CET	4258	57040	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:15.240659952 CET	57040	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:15.240762949 CET	57040	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:15.361557007 CET	4258	57040	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:16.308731079 CET	4258	57040	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:16.308871984 CET	4258	57040	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:16.308945894 CET	57040	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:16.309030056 CET	57040	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:16.309818029 CET	57042	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:16.429198027 CET	4258	57040	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:16.429713964 CET	4258	57042	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:16.429866076 CET	57042	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:16.429964066 CET	57042	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:16.550064087 CET	4258	57042	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:17.497024059 CET	4258	57042	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:17.497071028 CET	4258	57042	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:17.497405052 CET	57042	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:17.497405052 CET	57042	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:17.498405933 CET	57044	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:17.617988110 CET	4258	57042	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:17.618408918 CET	4258	57044	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:17.618587971 CET	57044	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:17.618618965 CET	57044	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:17.739437103 CET	4258	57044	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:18.722234011 CET	4258	57044	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:18.722374916 CET	4258	57044	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:18.722471952 CET	57044	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:18.722634077 CET	57044	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:18.723169088 CET	57046	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:18.842370033 CET	4258	57044	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:18.842746019 CET	4258	57046	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:18.842828035 CET	57046	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:18.842849970 CET	57046	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:18.962764978 CET	4258	57046	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:19.942641973 CET	4258	57046	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:19.942681074 CET	4258	57046	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:19.942918062 CET	57046	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:19.942918062 CET	57046	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:19.943607092 CET	57048	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:20.062663078 CET	4258	57046	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:20.063246965 CET	4258	57048	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:20.063462019 CET	57048	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:20.063462019 CET	57048	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:20.184262991 CET	4258	57048	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:21.148129940 CET	4258	57048	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:21.148216009 CET	4258	57048	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:21.148281097 CET	57048	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:21.148281097 CET	57048	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:21.148972988 CET	57050	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:21.270339966 CET	4258	57048	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:21.272082090 CET	4258	57050	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:21.272181034 CET	57050	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:21.272252083 CET	57050	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:21.393929005 CET	4258	57050	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:22.356537104 CET	4258	57050	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:22.356642962 CET	4258	57050	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:22.356797934 CET	57050	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:22.356839895 CET	57050	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:22.357712984 CET	57052	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:22.476572037 CET	4258	57050	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:22.477534056 CET	4258	57052	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:22.477648020 CET	57052	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:22.477729082 CET	57052	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:22.597310066 CET	4258	57052	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:23.544394016 CET	4258	57052	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:23.544641972 CET	57052	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:23.544687986 CET	4258	57052	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:23.544828892 CET	57052	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:23.545670986 CET	57054	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:23.665105104 CET	4258	57052	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:23.665278912 CET	4258	57054	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:23.665471077 CET	57054	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:23.665548086 CET	57054	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:23.785759926 CET	4258	57054	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:24.771249056 CET	4258	57054	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:24.771327972 CET	4258	57054	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:24.771373034 CET	57054	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:24.771420002 CET	57054	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:24.772265911 CET	57056	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:24.891623020 CET	4258	57054	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:24.892090082 CET	4258	57056	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:24.892189026 CET	57056	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:24.892257929 CET	57056	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:25.013909101 CET	4258	57056	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:25.959554911 CET	4258	57056	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:25.959628105 CET	4258	57056	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:25.959793091 CET	57056	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:25.959845066 CET	57056	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:25.960625887 CET	57058	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:26.079399109 CET	4258	57056	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:26.080208063 CET	4258	57058	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:26.080370903 CET	57058	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:26.080414057 CET	57058	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:26.199969053 CET	4258	57058	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:27.168803930 CET	4258	57058	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:27.168827057 CET	4258	57058	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:27.169006109 CET	57058	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:27.169006109 CET	57058	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:27.169841051 CET	57060	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:27.288964033 CET	4258	57058	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:27.289624929 CET	4258	57060	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:27.289752960 CET	57060	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:27.289787054 CET	57060	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:27.411380053 CET	4258	57060	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:28.389468908 CET	4258	57060	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:28.389549971 CET	4258	57060	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:28.389667034 CET	57060	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:28.389698982 CET	57060	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:28.390482903 CET	57062	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:28.509741068 CET	4258	57060	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:28.510529995 CET	4258	57062	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:28.510723114 CET	57062	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:28.510782957 CET	57062	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:28.630798101 CET	4258	57062	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:29.585786104 CET	4258	57062	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:29.585832119 CET	4258	57062	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:29.586009026 CET	57062	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:29.586097956 CET	57062	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:29.587105036 CET	57064	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:29.708491087 CET	4258	57062	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:29.709400892 CET	4258	57064	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:29.709537029 CET	57064	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:29.709567070 CET	57064	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:29.829138041 CET	4258	57064	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:30.776743889 CET	4258	57064	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:30.777178049 CET	57064	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:30.777630091 CET	4258	57064	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:30.777782917 CET	57064	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:30.778702021 CET	57066	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:30.897392988 CET	4258	57064	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:30.898422956 CET	4258	57066	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:30.898592949 CET	57066	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:30.898673058 CET	57066	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:31.018815041 CET	4258	57066	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:31.978048086 CET	4258	57066	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:31.978427887 CET	57066	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:31.978486061 CET	4258	57066	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:31.978593111 CET	57066	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:31.979430914 CET	57068	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:32.100722075 CET	4258	57066	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:32.100733042 CET	4258	57068	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:32.100940943 CET	57068	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:32.101022959 CET	57068	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:32.220664978 CET	4258	57068	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:33.216672897 CET	4258	57068	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:33.216728926 CET	4258	57068	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:33.216833115 CET	57068	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:33.217039108 CET	57068	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:33.218147993 CET	57070	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:33.338515043 CET	4258	57068	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:33.339335918 CET	4258	57070	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:33.339534044 CET	57070	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:33.339575052 CET	57070	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:33.460421085 CET	4258	57070	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:34.407124043 CET	4258	57070	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:34.407201052 CET	4258	57070	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:34.407435894 CET	57070	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:34.407500029 CET	57070	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:34.408549070 CET	57072	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:34.527235031 CET	4258	57070	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:34.528153896 CET	4258	57072	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:34.528306961 CET	57072	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:34.528367043 CET	57072	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:34.648026943 CET	4258	57072	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:35.595561981 CET	4258	57072	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:35.595592976 CET	4258	57072	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:35.595758915 CET	57072	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:35.595835924 CET	57072	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:35.596637964 CET	57074	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:35.715598106 CET	4258	57072	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:35.716142893 CET	4258	57074	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:35.716326952 CET	57074	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:35.716371059 CET	57074	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:35.836126089 CET	4258	57074	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:36.786716938 CET	4258	57074	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:36.786747932 CET	4258	57074	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:36.786921978 CET	57074	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:36.786969900 CET	57074	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:36.787594080 CET	57076	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:36.906732082 CET	4258	57074	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:36.907195091 CET	4258	57076	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:36.907649040 CET	57076	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:36.907649040 CET	57076	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:37.029336929 CET	4258	57076	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:37.977855921 CET	4258	57076	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:37.977890968 CET	4258	57076	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:37.978302002 CET	57076	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:37.978302002 CET	57076	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:37.979074955 CET	57078	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:38.097994089 CET	4258	57076	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:38.098627090 CET	4258	57078	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:38.099026918 CET	57078	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:38.099026918 CET	57078	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:38.219141960 CET	4258	57078	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:39.167577028 CET	4258	57078	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:39.167612076 CET	4258	57078	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:39.167957067 CET	57078	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:39.168123007 CET	57078	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:39.169126987 CET	57080	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:39.287719011 CET	4258	57078	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:39.288728952 CET	4258	57080	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:39.289041996 CET	57080	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:39.289041996 CET	57080	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:39.408842087 CET	4258	57080	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:40.365734100 CET	4258	57080	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:40.365792036 CET	4258	57080	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:40.366241932 CET	57080	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:40.366241932 CET	57080	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:40.366997004 CET	57082	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:40.485986948 CET	4258	57080	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:40.486707926 CET	4258	57082	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:40.487175941 CET	57082	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:40.487175941 CET	57082	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:40.607055902 CET	4258	57082	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:41.589248896 CET	4258	57082	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:41.589312077 CET	4258	57082	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:41.589668989 CET	57082	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:41.589668989 CET	57082	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:41.590605021 CET	57084	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:41.709904909 CET	4258	57082	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:41.710614920 CET	4258	57084	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:41.710897923 CET	57084	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:41.710897923 CET	57084	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:41.830699921 CET	4258	57084	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:42.777611971 CET	4258	57084	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:42.777664900 CET	4258	57084	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:42.777951002 CET	57084	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:42.777951956 CET	57084	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:42.778717041 CET	57086	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:42.897728920 CET	4258	57084	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:42.898241043 CET	4258	57086	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:42.898519039 CET	57086	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:42.898519039 CET	57086	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:43.018205881 CET	4258	57086	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:44.148704052 CET	4258	57086	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:44.148751974 CET	4258	57086	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:44.148932934 CET	57086	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:44.148932934 CET	57086	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:44.149842024 CET	57088	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:44.268827915 CET	4258	57086	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:44.269454002 CET	4258	57088	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:44.269587994 CET	57088	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:44.269664049 CET	57088	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:44.389561892 CET	4258	57088	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:45.336446047 CET	4258	57088	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:45.336534023 CET	4258	57088	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:45.336829901 CET	57088	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:45.336829901 CET	57088	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:45.337384939 CET	57090	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:45.456602097 CET	4258	57088	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:45.457007885 CET	4258	57090	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:45.457268953 CET	57090	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:45.457268953 CET	57090	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:45.576996088 CET	4258	57090	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:46.603796005 CET	4258	57090	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:46.603842974 CET	4258	57090	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:46.604104996 CET	57090	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:46.604104996 CET	57090	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:46.604963064 CET	57092	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:46.726739883 CET	4258	57090	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:46.726830006 CET	4258	57092	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:46.727134943 CET	57092	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:46.727216005 CET	57092	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:46.847155094 CET	4258	57092	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:47.796628952 CET	4258	57092	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:47.796771049 CET	4258	57092	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:47.796941042 CET	57092	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:47.796941042 CET	57092	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:47.797683954 CET	57094	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:47.918556929 CET	4258	57092	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:47.918589115 CET	4258	57094	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:47.918786049 CET	57094	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:47.918787003 CET	57094	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:48.038681984 CET	4258	57094	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:48.986457109 CET	4258	57094	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:48.986530066 CET	4258	57094	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:48.986716032 CET	57094	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:48.986716986 CET	57094	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:48.987482071 CET	57096	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:49.108902931 CET	4258	57094	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:49.109169006 CET	4258	57096	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:49.109376907 CET	57096	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:49.109376907 CET	57096	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:49.229213953 CET	4258	57096	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:50.175497055 CET	4258	57096	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:50.175678968 CET	4258	57096	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:50.175896883 CET	57096	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:50.175898075 CET	57096	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:50.177025080 CET	57098	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:50.295466900 CET	4258	57096	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:50.296711922 CET	4258	57098	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:50.297107935 CET	57098	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:50.297107935 CET	57098	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:50.416860104 CET	4258	57098	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:51.373599052 CET	4258	57098	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:51.373687983 CET	4258	57098	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:51.374017954 CET	57098	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:51.374018908 CET	57098	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:51.375099897 CET	57100	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:51.493769884 CET	4258	57098	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:51.494630098 CET	4258	57100	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:51.494891882 CET	57100	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:51.494891882 CET	57100	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:51.614622116 CET	4258	57100	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:52.562828064 CET	4258	57100	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:52.562858105 CET	4258	57100	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:52.563047886 CET	57100	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:52.563136101 CET	57100	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:52.564295053 CET	57102	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:52.682712078 CET	4258	57100	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:52.683799028 CET	4258	57102	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:52.683902979 CET	57102	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:52.683959007 CET	57102	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:52.803553104 CET	4258	57102	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:53.945131063 CET	4258	57102	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:53.945158958 CET	4258	57102	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:53.945348978 CET	57102	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:53.945435047 CET	57102	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:53.946368933 CET	57104	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:54.065066099 CET	4258	57102	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:54.065985918 CET	4258	57104	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:54.066142082 CET	57104	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:54.066195011 CET	57104	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:54.185831070 CET	4258	57104	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:55.133840084 CET	4258	57104	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:55.133871078 CET	4258	57104	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:55.134069920 CET	57104	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:55.134166002 CET	57104	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:55.135166883 CET	57106	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:55.257560015 CET	4258	57104	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:55.258423090 CET	4258	57106	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:55.258735895 CET	57106	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:55.258735895 CET	57106	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:55.382853031 CET	4258	57106	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:56.328044891 CET	4258	57106	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:56.328074932 CET	4258	57106	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:56.328388929 CET	57106	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:56.328500032 CET	57106	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:56.329324007 CET	57108	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:56.448245049 CET	4258	57106	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:56.448899984 CET	4258	57108	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:56.449064016 CET	57108	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:56.449139118 CET	57108	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:56.568768978 CET	4258	57108	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:57.526130915 CET	4258	57108	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:57.526164055 CET	4258	57108	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:57.526312113 CET	57108	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:57.526371002 CET	57108	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:57.527017117 CET	57110	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:57.646017075 CET	4258	57108	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:57.646507978 CET	4258	57110	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:57.646708012 CET	57110	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:57.646823883 CET	57110	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:57.768683910 CET	4258	57110	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:58.717593908 CET	4258	57110	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:58.717916012 CET	57110	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:58.718185902 CET	4258	57110	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:58.718291998 CET	57110	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:58.719513893 CET	57112	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:58.841202974 CET	4258	57110	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:58.843219995 CET	4258	57112	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:58.843375921 CET	57112	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:58.843424082 CET	57112	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:58.964129925 CET	4258	57112	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:59.924937963 CET	4258	57112	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:59.925059080 CET	4258	57112	31.172.83.147	192.168.2.14
Dec 22, 2024 16:17:59.925092936 CET	57112	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:59.925132990 CET	57112	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:17:59.926043987 CET	57114	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:00.051597118 CET	4258	57112	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:00.052810907 CET	4258	57114	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:00.052942991 CET	57114	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:00.052963972 CET	57114	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:00.172550917 CET	4258	57114	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:01.119251013 CET	4258	57114	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:01.119359970 CET	4258	57114	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:01.119441986 CET	57114	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:01.119519949 CET	57114	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:01.120747089 CET	57116	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:01.239048004 CET	4258	57114	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:01.240274906 CET	4258	57116	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:01.240421057 CET	57116	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:01.240495920 CET	57116	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:01.360284090 CET	4258	57116	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:02.307857037 CET	4258	57116	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:02.307929993 CET	4258	57116	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:02.308027983 CET	57116	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:02.308123112 CET	57116	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:02.308974981 CET	57118	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:02.427645922 CET	4258	57116	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:02.428575039 CET	4258	57118	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:02.428874016 CET	57118	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:02.428901911 CET	57118	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:02.548449039 CET	4258	57118	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:03.497088909 CET	4258	57118	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:03.497179985 CET	4258	57118	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:03.497417927 CET	57118	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:03.497512102 CET	57118	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:03.498677969 CET	57120	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:03.619580984 CET	4258	57118	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:03.619596958 CET	4258	57120	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:03.619796038 CET	57120	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:03.619896889 CET	57120	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:03.739392042 CET	4258	57120	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:04.687144995 CET	4258	57120	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:04.687309980 CET	57120	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:04.687390089 CET	4258	57120	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:04.687522888 CET	57120	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:04.688335896 CET	57122	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:04.808667898 CET	4258	57120	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:04.808696985 CET	4258	57122	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:04.808815002 CET	57122	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:04.808815956 CET	57122	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:04.929542065 CET	4258	57122	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:05.877331972 CET	4258	57122	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:05.877372026 CET	4258	57122	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:05.877633095 CET	57122	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:05.877729893 CET	57122	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:05.878729105 CET	57124	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:05.999389887 CET	4258	57122	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:06.000438929 CET	4258	57124	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:06.000574112 CET	57124	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:06.000653028 CET	57124	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:06.120223045 CET	4258	57124	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:07.068509102 CET	4258	57124	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:07.068536043 CET	4258	57124	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:07.068932056 CET	57124	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:07.068932056 CET	57124	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:07.070113897 CET	57126	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:07.188756943 CET	4258	57124	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:07.189701080 CET	4258	57126	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:07.189979076 CET	57126	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:07.190010071 CET	57126	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:07.309580088 CET	4258	57126	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:08.255861998 CET	4258	57126	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:08.256026983 CET	4258	57126	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:08.256057024 CET	57126	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:08.256130934 CET	57126	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:08.257114887 CET	57128	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:08.376986027 CET	4258	57126	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:08.377906084 CET	4258	57128	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:08.378169060 CET	57128	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:08.378227949 CET	57128	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:08.498209000 CET	4258	57128	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:09.463711023 CET	4258	57128	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:09.464015961 CET	57128	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:09.464050055 CET	4258	57128	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:09.464143991 CET	57128	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:09.465250015 CET	57130	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:09.584347963 CET	4258	57128	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:09.584901094 CET	4258	57130	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:09.585037947 CET	57130	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:09.585086107 CET	57130	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:09.704551935 CET	4258	57130	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:10.652533054 CET	4258	57130	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:10.652702093 CET	57130	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:10.652738094 CET	4258	57130	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:10.652820110 CET	57130	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:10.653399944 CET	57132	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:10.772876024 CET	4258	57130	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:10.773386002 CET	4258	57132	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:10.773575068 CET	57132	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:10.773575068 CET	57132	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:10.895231962 CET	4258	57132	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:11.844803095 CET	4258	57132	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:11.844902039 CET	4258	57132	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:11.845037937 CET	57132	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:11.845128059 CET	57132	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:11.846235991 CET	57134	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:11.964708090 CET	4258	57132	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:11.965724945 CET	4258	57134	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:11.965837002 CET	57134	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:11.965878010 CET	57134	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:12.091006041 CET	4258	57134	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:13.041060925 CET	4258	57134	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:13.041191101 CET	57134	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:13.041209936 CET	4258	57134	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:13.041268110 CET	57134	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:13.041930914 CET	57136	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:13.161978960 CET	4258	57134	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:13.162643909 CET	4258	57136	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:13.162731886 CET	57136	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:13.162782907 CET	57136	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:13.282399893 CET	4258	57136	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:14.239815950 CET	4258	57136	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:14.239865065 CET	4258	57136	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:14.239955902 CET	57136	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:14.239955902 CET	57136	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:14.240741968 CET	57138	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:14.360507965 CET	4258	57136	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:14.361313105 CET	4258	57138	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:14.361453056 CET	57138	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:14.361495018 CET	57138	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:14.481021881 CET	4258	57138	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:15.428478956 CET	4258	57138	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:15.428500891 CET	4258	57138	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:15.428678036 CET	57138	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:15.428762913 CET	57138	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:15.429780006 CET	57140	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:15.550968885 CET	4258	57138	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:15.551909924 CET	4258	57140	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:15.551987886 CET	57140	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:15.552037001 CET	57140	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:15.674287081 CET	4258	57140	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:16.623337030 CET	4258	57140	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:16.623475075 CET	57140	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:16.623507977 CET	4258	57140	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:16.623580933 CET	57140	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:16.624413967 CET	57142	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:16.743554115 CET	4258	57140	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:16.744328976 CET	4258	57142	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:16.744471073 CET	57142	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:16.744512081 CET	57142	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:16.864962101 CET	4258	57142	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:17.812125921 CET	4258	57142	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:17.812144995 CET	4258	57142	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:17.812416077 CET	57142	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:17.812499046 CET	57142	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:17.813648939 CET	57144	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:17.932116985 CET	4258	57142	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:17.933269978 CET	4258	57144	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:17.933362007 CET	57144	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:17.933362007 CET	57144	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:18.053261042 CET	4258	57144	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:19.030822039 CET	4258	57144	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:19.030864954 CET	4258	57144	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:19.031210899 CET	57144	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:19.031210899 CET	57144	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:19.031893969 CET	57146	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:19.153569937 CET	4258	57144	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:19.153589010 CET	4258	57146	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:19.153776884 CET	57146	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:19.154001951 CET	57146	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:19.273545980 CET	4258	57146	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:20.221741915 CET	4258	57146	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:20.221921921 CET	4258	57146	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:20.221936941 CET	57146	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:20.222017050 CET	57146	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:20.222683907 CET	57148	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:20.341959000 CET	4258	57146	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:20.342521906 CET	4258	57148	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:20.342695951 CET	57148	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:20.342768908 CET	57148	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:20.462866068 CET	4258	57148	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:21.410648108 CET	4258	57148	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:21.410828114 CET	4258	57148	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:21.410913944 CET	57148	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:21.410954952 CET	57148	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:21.411681890 CET	57150	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:21.531117916 CET	4258	57148	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:21.531685114 CET	4258	57150	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:21.531805038 CET	57150	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:21.531888962 CET	57150	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:21.652894974 CET	4258	57150	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:22.611538887 CET	4258	57150	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:22.611643076 CET	4258	57150	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:22.611740112 CET	57150	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:22.611740112 CET	57150	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:22.612699032 CET	57152	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:22.734482050 CET	4258	57150	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:22.735363960 CET	4258	57152	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:22.735487938 CET	57152	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:22.735551119 CET	57152	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:22.857566118 CET	4258	57152	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:23.813627005 CET	4258	57152	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:23.813707113 CET	4258	57152	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:23.813844919 CET	57152	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:23.813937902 CET	57152	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:23.814717054 CET	57154	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:23.939399958 CET	4258	57152	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:23.940109968 CET	4258	57154	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:23.940265894 CET	57154	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:23.940371990 CET	57154	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:24.060615063 CET	4258	57154	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:25.011193991 CET	4258	57154	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:25.011220932 CET	4258	57154	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:25.011475086 CET	57154	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:25.011655092 CET	57154	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:25.012305975 CET	57156	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:25.136722088 CET	4258	57154	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:25.137499094 CET	4258	57156	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:25.137810946 CET	57156	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:25.137871981 CET	57156	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:25.257714987 CET	4258	57156	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:26.205482960 CET	4258	57156	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:26.205558062 CET	4258	57156	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:26.205739021 CET	57156	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:26.205843925 CET	57156	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:26.206787109 CET	57158	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:26.325591087 CET	4258	57156	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:26.326474905 CET	4258	57158	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:26.326618910 CET	57158	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:26.326683998 CET	57158	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:26.451374054 CET	4258	57158	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:27.400373936 CET	4258	57158	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:27.400402069 CET	4258	57158	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:27.400443077 CET	57158	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:27.400511026 CET	57158	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:27.401701927 CET	57160	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:27.520035982 CET	4258	57158	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:27.521374941 CET	4258	57160	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:27.521466970 CET	57160	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:27.521516085 CET	57160	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:27.641262054 CET	4258	57160	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:27.905277014 CET	45432	53	192.168.2.14	8.8.8.8
Dec 22, 2024 16:18:28.025114059 CET	53	45432	8.8.8.8	192.168.2.14
Dec 22, 2024 16:18:28.025182962 CET	45432	53	192.168.2.14	8.8.8.8
Dec 22, 2024 16:18:28.025219917 CET	45432	53	192.168.2.14	8.8.8.8
Dec 22, 2024 16:18:28.025288105 CET	45432	53	192.168.2.14	8.8.8.8
Dec 22, 2024 16:18:28.144787073 CET	53	45432	8.8.8.8	192.168.2.14
Dec 22, 2024 16:18:28.144802094 CET	53	45432	8.8.8.8	192.168.2.14
Dec 22, 2024 16:18:28.606646061 CET	4258	57160	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:28.606762886 CET	57160	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:28.606786013 CET	4258	57160	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:28.606889009 CET	57160	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:28.607912064 CET	57164	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:28.726465940 CET	4258	57160	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:28.727430105 CET	4258	57164	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:28.727507114 CET	57164	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:28.727507114 CET	57164	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:28.847372055 CET	4258	57164	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:29.110604048 CET	53	45432	8.8.8.8	192.168.2.14
Dec 22, 2024 16:18:29.110733986 CET	45432	53	192.168.2.14	8.8.8.8
Dec 22, 2024 16:18:29.885829926 CET	4258	57164	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:29.885852098 CET	4258	57164	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:29.886157990 CET	57164	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:29.886157990 CET	57164	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:29.886681080 CET	57166	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:30.005733967 CET	4258	57164	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:30.006197929 CET	4258	57166	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:30.006402969 CET	57166	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:30.006402969 CET	57166	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:30.126415968 CET	4258	57166	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:31.083589077 CET	4258	57166	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:31.083838940 CET	57166	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:31.084212065 CET	4258	57166	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:31.084295988 CET	57166	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:31.084779024 CET	57168	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:31.110126019 CET	53	45432	8.8.8.8	192.168.2.14
Dec 22, 2024 16:18:31.110318899 CET	45432	53	192.168.2.14	8.8.8.8
Dec 22, 2024 16:18:31.204052925 CET	4258	57166	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:31.204502106 CET	4258	57168	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:31.204642057 CET	57168	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:31.204643011 CET	57168	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:31.229933023 CET	53	45432	8.8.8.8	192.168.2.14
Dec 22, 2024 16:18:31.324381113 CET	4258	57168	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:32.272548914 CET	4258	57168	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:32.272594929 CET	4258	57168	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:32.272758961 CET	57168	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:32.272839069 CET	57168	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:32.273200989 CET	57170	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:32.393017054 CET	4258	57168	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:32.393527031 CET	4258	57170	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:32.393627882 CET	57170	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:32.393627882 CET	57170	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:32.513670921 CET	4258	57170	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:34.248042107 CET	4258	57170	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:34.248486042 CET	57170	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:34.248996019 CET	57172	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:34.378247976 CET	4258	57170	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:34.378571987 CET	4258	57172	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:34.378688097 CET	57172	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:34.378719091 CET	57172	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:34.498301029 CET	4258	57172	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:35.456111908 CET	4258	57172	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:35.456298113 CET	4258	57172	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:35.456454039 CET	57172	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:35.456454039 CET	57172	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:35.456881046 CET	57174	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:35.577347994 CET	4258	57172	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:35.577477932 CET	4258	57174	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:35.577651978 CET	57174	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:35.577652931 CET	57174	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:35.697874069 CET	4258	57174	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:36.663335085 CET	4258	57174	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:36.663381100 CET	4258	57174	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:36.663589001 CET	57174	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:36.663589954 CET	57174	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:36.663997889 CET	57176	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:36.783358097 CET	4258	57174	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:36.783665895 CET	4258	57176	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:36.783874035 CET	57176	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:37.685818911 CET	57176	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:37.807265043 CET	4258	57176	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:37.807440042 CET	57176	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:37.807475090 CET	57176	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:37.928127050 CET	4258	57176	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:50.168100119 CET	4258	57176	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:50.168170929 CET	4258	57176	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:50.168457031 CET	4258	57176	31.172.83.147	192.168.2.14
Dec 22, 2024 16:18:50.168895960 CET	57176	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:50.168896914 CET	57176	4258	192.168.2.14	31.172.83.147
Dec 22, 2024 16:18:50.168896914 CET	57176	4258	192.168.2.14	31.172.83.147

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 22, 2024 16:18:28.025219917 CET	192.168.2.14	8.8.8.8	0xe66d	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Dec 22, 2024 16:18:28.025288105 CET	192.168.2.14	8.8.8.8	0xb1af	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

System Behavior

Analysis Process: hidakibest.x86.elf PID: 5573, Parent PID: 5492

General

Start time (UTC):	15:15:41
Start date (UTC):	22/12/2024
Path:	/tmp/hidakibest.x86.elf
Arguments:	/tmp/hidakibest.x86.elf
File size:	92628 bytes
MD5 hash:	f61f0d03b7c554e0d1917610b48d325f

Chronological Activities

Analysis Process: hidakibest.x86.elf PID: 5574, Parent PID: 5573

General

Start time (UTC):	15:15:41
Start date (UTC):	22/12/2024
Path:	/tmp/hidakibest.x86.elf
Arguments:	-
File size:	92628 bytes
MD5 hash:	f61f0d03b7c554e0d1917610b48d325f

Chronological Activities

Analysis Process: hidakibest.x86.elf PID: 5575, Parent PID: 5574

General

Start time (UTC):	15:15:41
Start date (UTC):	22/12/2024
Path:	/tmp/hidakibest.x86.elf
Arguments:	-
File size:	92628 bytes
MD5 hash:	f61f0d03b7c554e0d1917610b48d325f

Description:	Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping or `net view` using Net .
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report hidakibest.x86.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Threatname: Gafgyt

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

DNS Queries

System Behavior

Analysis Process: hidakibest.x86.elf PID: 5573, Parent PID: 5492

General

Chronological Activities

Analysis Process: hidakibest.x86.elf PID: 5574, Parent PID: 5573

General

Chronological Activities

Analysis Process: hidakibest.x86.elf PID: 5575, Parent PID: 5574

General

Chronological Activities

Linux Analysis Report
hidakibest.x86.elf