Edit tour

Linux Analysis Report
spc.elf

Overview

General Information

Sample name:	spc.elf
Analysis ID:	1580611
MD5:	fd7c9839b570e611e81ffc191c8b293d
SHA1:	c12760b84fe5ea548896e5c33fb59799010f2320
SHA256:	f541347bd4e8dc583bf8419832919734ff59e6da907bda46ce42ef3979b9aa6a
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai, Moobot

Score:	96
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Yara detected Moobot

Contains symbols with names commonly found in malware

Sample deletes itself

Enumerates processes within the "proc" file system

Executes the "rm" command used to delete files or directories

Sample and/or dropped files contains symbols with suspicious names

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1580611
Start date and time:	2024-12-25 12:44:58 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	spc.elf
Detection:	MAL
Classification:	mal96.troj.evad.linELF@0/0@114/0

Warnings

VT rate limit hit for: chinagov.one

Runtime Messages

Command:	/tmp/spc.elf
PID:	6268
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	done.
Standard Error:

Process Tree

system is lnxubuntu20

spc.elf (PID: 6268, Parent: 6194, MD5: 7dc1c0e23cd5e102bb12e5c29403410e) Arguments: /tmp/spc.elf

spc.elf New Fork (PID: 6271, Parent: 6268)

spc.elf New Fork (PID: 6273, Parent: 6271)

spc.elf New Fork (PID: 6274, Parent: 6271)

spc.elf New Fork (PID: 6277, Parent: 6274)

dash New Fork (PID: 6284, Parent: 4331)

rm (PID: 6284, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.fgaJzem5r5 /tmp/tmp.pfvNyMqYUZ /tmp/tmp.t2q3EDGji5

dash New Fork (PID: 6285, Parent: 4331)

rm (PID: 6285, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.fgaJzem5r5 /tmp/tmp.pfvNyMqYUZ /tmp/tmp.t2q3EDGji5

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Name	Description	Attribution	Blogpost URLs	Link
MooBot		No Attribution	https://blog.netlab.360.com/ddos-botnet-moobot-en/ https://blog.netlab.360.com/moobot-0day-unixcctv-dvr-en/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/ https://media.defense.gov/2024/Feb/27/2003400753/-1/-1/0/CSA-RUSSIAN-ACTORS-USE-ROUTERS-FACILITATE-CYBER_OPERATIONS.PDF https://otx.alienvault.com/pulse/6075b645942d5adf9bb8949b	https://malpedia.caad.fkie.fraunhofer.de/details/elf.moobot

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
spc.elf	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
spc.elf	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
spc.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
spc.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x123f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1240c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12420:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12434:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12448:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1245c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12470:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12484:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12498:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x124ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x124c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x124d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x124e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x124fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12510:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12524:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12538:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1254c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12560:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12574:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12588:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
6268.1.00007fd954011000.00007fd954025000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6268.1.00007fd954011000.00007fd954025000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6268.1.00007fd954011000.00007fd954025000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x123f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1240c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12420:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12434:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12448:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1245c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12470:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12484:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12498:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x124ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x124c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x124d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x124e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x124fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12510:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12524:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12538:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1254c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12560:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12574:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12588:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: spc.elf PID: 6268	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
Process Memory Space: spc.elf PID: 6268	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: spc.elf PID: 6268	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x142:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x156:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x192:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ba:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ce:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x232:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x246:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x25a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x26e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x282:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x296:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2aa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2be:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2d2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 1 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: spc.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: spc.elf	Virustotal: Detection: 49%			Perma Link
Source: spc.elf	ReversingLabs: Detection: 47%

Source: unknown

DNS traffic detected: query: chinagov.one replaycode: Name error (3)

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 34.249.145.219
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42

Source: global traffic

DNS traffic detected: DNS query: chinagov.one

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39256
Source: unknown	Network traffic detected: HTTP traffic on port 39256 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: spc.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6268.1.00007fd954011000.00007fd954025000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: spc.elf PID: 6268, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Contains symbols with names commonly found in malware

Source: ELF static info symbol of initial sample	Name: attack.c
Source: ELF static info symbol of initial sample	Name: attack_get_opt_int
Source: ELF static info symbol of initial sample	Name: attack_get_opt_ip
Source: ELF static info symbol of initial sample	Name: attack_init
Source: ELF static info symbol of initial sample	Name: attack_kill_all
Source: ELF static info symbol of initial sample	Name: attack_method_nudp
Source: ELF static info symbol of initial sample	Name: attack_method_raw
Source: ELF static info symbol of initial sample	Name: attack_method_stdhex
Source: ELF static info symbol of initial sample	Name: attack_method_tcp
Source: ELF static info symbol of initial sample	Name: attack_ongoing

Source: spc.elf

ELF static info symbol of initial sample: hexPayload

Source: spc.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6268.1.00007fd954011000.00007fd954025000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: spc.elf PID: 6268, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal96.troj.evad.linELF@0/0@114/0

Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/1582/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/1579/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/1698/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/1576/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/910/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/912/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/2307/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/918/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/1594/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/1349/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/1344/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/1465/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/1586/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/248/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/249/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/1463/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/801/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/1900/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/6252/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/6253/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/491/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/252/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/253/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/254/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/255/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/256/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/1599/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/257/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/1477/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/379/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/1476/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/1475/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/936/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/30/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/2208/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/35/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/1809/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/1494/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/260/cmdline	Jump to behavior
Source: /tmp/spc.elf (PID: 6273)	File opened: /proc/261/cmdline	Jump to behavior

Source: /usr/bin/dash (PID: 6284)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.fgaJzem5r5 /tmp/tmp.pfvNyMqYUZ /tmp/tmp.t2q3EDGji5			Jump to behavior
Source: /usr/bin/dash (PID: 6285)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.fgaJzem5r5 /tmp/tmp.pfvNyMqYUZ /tmp/tmp.t2q3EDGji5			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/spc.elf (PID: 6268)

File: /tmp/spc.elf

Jump to behavior

Source: /tmp/spc.elf (PID: 6268)

Queries kernel information via 'uname':

Jump to behavior

Source: spc.elf, 6268.1.00005637aae86000.00005637aaeeb000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sparc
Source: spc.elf, 6268.1.00005637aae86000.00005637aaeeb000.rw-.sdmp	Binary or memory string: 7V!/etc/qemu-binfmt/sparc
Source: spc.elf, 6268.1.00007fff40465000.00007fff40486000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-sparc/tmp/spc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/spc.elf
Source: spc.elf, 6268.1.00007fff40465000.00007fff40486000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sparc

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: spc.elf, type: SAMPLE
Source: Yara match	File source: 6268.1.00007fd954011000.00007fd954025000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: spc.elf PID: 6268, type: MEMORYSTR

Yara detected Moobot

Source: Yara match	File source: spc.elf, type: SAMPLE
Source: Yara match	File source: 6268.1.00007fd954011000.00007fd954025000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: spc.elf PID: 6268, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: spc.elf, type: SAMPLE
Source: Yara match	File source: 6268.1.00007fd954011000.00007fd954025000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: spc.elf PID: 6268, type: MEMORYSTR

Yara detected Moobot

Source: Yara match	File source: spc.elf, type: SAMPLE
Source: Yara match	File source: 6268.1.00007fd954011000.00007fd954025000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: spc.elf PID: 6268, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Masquerading	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	11 File Deletion	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
spc.elf	49%	Virustotal		Browse
spc.elf	47%	ReversingLabs	Linux.Trojan.Mirai
spc.elf	100%	Avira	EXP/ELF.Mirai.Z.A

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
chinagov.one	unknown	unknown	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
34.249.145.219	unknown	United States	16509	AMAZON-02US	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
34.249.145.219	Space.x86.elf	Get hash	malicious	Unknown	Browse
	Space.x86_64.elf	Get hash	malicious	Unknown	Browse
	zerm68k.elf	Get hash	malicious	Unknown	Browse
	hidakibest.ppc.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	hidakibest.arm6.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	main_mips.elf	Get hash	malicious	Mirai	Browse
	powerpc.elf	Get hash	malicious	Mirai	Browse
	main_arm6.elf	Get hash	malicious	Mirai	Browse
	main_x86.elf	Get hash	malicious	Mirai	Browse
	main_m68k.elf	Get hash	malicious	Mirai	Browse
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.42	win.elf	Get hash	malicious	Unknown	Browse
	165.3.86.135-mips-2024-12-25T09_39_46.elf	Get hash	malicious	Mirai, Moobot	Browse
	Space.x86.elf	Get hash	malicious	Unknown	Browse
	Space.x86_64.elf	Get hash	malicious	Unknown	Browse
	Space.arc.elf	Get hash	malicious	Mirai	Browse
	Space.arm5.elf	Get hash	malicious	Unknown	Browse
	byte.x86.elf	Get hash	malicious	Mirai, Okiru	Browse
	armv4eb.elf	Get hash	malicious	Unknown	Browse
	armv5l.elf	Get hash	malicious	Unknown	Browse
	armv4eb.elf	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	win.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	165.3.86.135-mips-2024-12-25T09_39_46.elf	Get hash	malicious	Mirai, Moobot	Browse	91.189.91.42
	Space.x86.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	Space.x86_64.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	Space.arc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	Space.m68k.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	Space.arm5.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	byte.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	armv4eb.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	armv5l.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
INIT7CH	win.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	165.3.86.135-mips-2024-12-25T09_39_46.elf	Get hash	malicious	Mirai, Moobot	Browse	109.202.202.202
	Space.x86.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	Space.x86_64.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	Space.arc.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	Space.arm5.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	byte.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	109.202.202.202
	armv4eb.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	armv5l.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	armv4eb.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
AMAZON-02US	armv6l.elf	Get hash	malicious	Unknown	Browse	52.64.88.123
	Space.x86.elf	Get hash	malicious	Unknown	Browse	34.249.145.219
	Space.x86_64.elf	Get hash	malicious	Unknown	Browse	34.249.145.219
	byte.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	54.171.230.55
	armv4l.elf	Get hash	malicious	Unknown	Browse	52.221.127.63
	armv4eb.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
	telnet.x86.elf	Get hash	malicious	Unknown	Browse	54.154.23.188
	https://email.equifaxbreachsettlement.com/c/eJwUys9qtDAQAPCnSY6STLL_DjnIp4GFr-3iLrX0EuLMiMLqWo1r-_al9x-5yDrGo2SnD8YednvYK9m5lhEPSJpaYtPgDk-NUUQKCS3r2MjegQKrAbSy1oLKWmC1UycbkU9asxZW8dfat_G7mTlit3BKdx54TBk-Bnl3XUrTIkwuwAvw27Zlw8808xR7Qh4Tz39OgJ-ZmAdhPOODWJiihuP7y__al5_1Vc5uoPhMfRyFVeuCGdMqkyv9R7hUb6HKb3m4VOUlPxfhX14VoThfb-Favhby6eA3AAD__0qSUF8	Get hash	malicious	Unknown	Browse	18.221.139.220
	http://assets.website-files.com/65efffe8d4e10d26910f0543/65f65633ab8b2f021b357c18_64146967722.pdf	Get hash	malicious	Unknown	Browse	52.211.121.244
	armv5l.elf	Get hash	malicious	Mirai	Browse	52.11.1.37

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit MSB executable, SPARC, version 1 (SYSV), statically linked, not stripped
Entropy (8bit):	6.08097447106282
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	spc.elf
File size:	106'424 bytes
MD5:	fd7c9839b570e611e81ffc191c8b293d
SHA1:	c12760b84fe5ea548896e5c33fb59799010f2320
SHA256:	f541347bd4e8dc583bf8419832919734ff59e6da907bda46ce42ef3979b9aa6a
SHA512:	dd40d5c407b989850852848edbeff28bc31259befeb90cbaa9a9a2f5fa463ed4a71ca0b913cf91fcbf9cd0d88c79a71ccd27678e8afb7a5c216c8cc2d869fb4a
SSDEEP:	1536:8AXQtvdZxJB/FUmixpKBQ1nQgbEbCvfoRruBD8aetplNnR07Dmjlp/:OX4mixDnZQb3Rk8aSlNn23QH
TLSH:	F8A34B32773A0B23C0E6A47500E79737B3B68BC92A64920B7A641F9C7F56AD035437B5
File Content Preview:	.ELF...........................4..N......4. ...(......................>(..>(..............@...@...@.......3...............@H..@H..@H................dt.Q................................@..(....@.H~................#.....c...`.....!.....!...@.....".........`

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	Sparc
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x101c4
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	4
Section Header Offset:	85704
Section Header Size:	40
Number of Section Headers:	17
Header String Table Index:	14

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x100b4	0xb4	0x1c	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x100d0	0xd0	0x12230	0x0	0x6	AX	0	0	4
.fini	PROGBITS	0x22300	0x12300	0x14	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x22318	0x12318	0x1b10	0x0	0x2	A	0	0	8
.eh_frame	PROGBITS	0x34000	0x14000	0x48	0x0	0x3	WA	0	0	4
.tbss	NOBITS	0x34048	0x14048	0x8	0x0	0x403	WAT	0	0	4
.ctors	PROGBITS	0x34048	0x14048	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x34050	0x14050	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x34058	0x14058	0x4	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x3405c	0x1405c	0x180	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x341dc	0x141dc	0x210	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x343f0	0x143ec	0x3008	0x0	0x3	WA	0	0	8
.comment	PROGBITS	0x0	0x143ec	0xa68	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x14e54	0x71	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x15170	0x2c30	0x10	0x0		16	256	4
.strtab	STRTAB	0x0	0x17da0	0x2218	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x10000	0x10000	0x13e28	0x13e28	6.0778	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x14000	0x34000	0x34000	0x3ec	0x33f8	4.5347	0x6	RW	0x10000	.eh_frame .tbss .ctors .dtors .jcr .got .data .bss
TLS	0x14048	0x34048	0x34048	0x0	0x8	0.0000	0x4	R	0x4	.tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x100b4	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x100d0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x22300	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x22318	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x34000	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x34048	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x34048	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x34050	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x34058	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x3405c	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x341dc	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x343f0	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	13
.LLC3	.symtab	0x23a68	0	NOTYPE	<unknown>	DEFAULT	4
.rem	.symtab	0x16724	44	FUNC	<unknown>	DEFAULT	2
.udiv	.symtab	0x16704	20	FUNC	<unknown>	DEFAULT	2
.umul	.symtab	0x16718	12	FUNC	<unknown>	DEFAULT	2
.urem	.symtab	0x166e4	32	FUNC	<unknown>	DEFAULT	2
C.23.5636	.symtab	0x22d04	24	OBJECT	<unknown>	DEFAULT	4
GET_UID	.symtab	0x36f7c	1	OBJECT	<unknown>	DEFAULT	12
LOCAL_ADDR	.symtab	0x36f78	4	OBJECT	<unknown>	DEFAULT	12
_Exit	.symtab	0x1691c	128	FUNC	<unknown>	DEFAULT	2
_GLOBAL_OFFSET_TABLE_	.symtab	0x3405c	0	OBJECT	<unknown>	HIDDEN	10
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x3404c	0	OBJECT	<unknown>	DEFAULT	7
__CTOR_LIST__	.symtab	0x34048	0	OBJECT	<unknown>	DEFAULT	7
__C_ctype_b	.symtab	0x342fc	4	OBJECT	<unknown>	DEFAULT	11
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x23a7a	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x34054	0	OBJECT	<unknown>	DEFAULT	8
__DTOR_LIST__	.symtab	0x34050	0	OBJECT	<unknown>	DEFAULT	8
__EH_FRAME_BEGIN__	.symtab	0x34000	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x34044	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x342fc	4	OBJECT	<unknown>	HIDDEN	11
__GI___close	.symtab	0x1d064	124	FUNC	<unknown>	HIDDEN	2
__GI___close_nocancel	.symtab	0x1d070	32	FUNC	<unknown>	HIDDEN	2
__GI___ctype_b	.symtab	0x34300	4	OBJECT	<unknown>	HIDDEN	11
__GI___errno_location	.symtab	0x17134	36	FUNC	<unknown>	HIDDEN	2
__GI___fcntl_nocancel	.symtab	0x16758	196	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x207e8	344	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x19f60	32	FUNC	<unknown>	HIDDEN	2
__GI___libc_close	.symtab	0x1d064	124	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x1681c	248	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x1d0e0	132	FUNC	<unknown>	HIDDEN	2
__GI___libc_read	.symtab	0x1d1e8	132	FUNC	<unknown>	HIDDEN	2
__GI___libc_write	.symtab	0x1d164	132	FUNC	<unknown>	HIDDEN	2
__GI___open	.symtab	0x1d0e0	132	FUNC	<unknown>	HIDDEN	2
__GI___open_nocancel	.symtab	0x1d0ec	32	FUNC	<unknown>	HIDDEN	2
__GI___read	.symtab	0x1d1e8	132	FUNC	<unknown>	HIDDEN	2
__GI___read_nocancel	.symtab	0x1d1f4	32	FUNC	<unknown>	HIDDEN	2
__GI___sigaddset	.symtab	0x1a510	44	FUNC	<unknown>	HIDDEN	2
__GI___sigdelset	.symtab	0x1a53c	44	FUNC	<unknown>	HIDDEN	2
__GI___sigismember	.symtab	0x1a4e8	40	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x1d48c	168	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x1d588	92	FUNC	<unknown>	HIDDEN	2
__GI___write	.symtab	0x1d164	132	FUNC	<unknown>	HIDDEN	2
__GI___write_nocancel	.symtab	0x1d170	32	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x19f88	300	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x1691c	128	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x1b91c	280	FUNC	<unknown>	HIDDEN	2
__GI_accept	.symtab	0x1a0dc	96	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x21404	24	FUNC	<unknown>	HIDDEN	2
__GI_bind	.symtab	0x1a13c	36	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x21a24	88	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0x169a4	88	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x1d064	124	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0x16d50	208	FUNC	<unknown>	HIDDEN	2
__GI_config_close	.symtab	0x1e698	64	FUNC	<unknown>	HIDDEN	2
__GI_config_open	.symtab	0x1e6e0	80	FUNC	<unknown>	HIDDEN	2
__GI_config_read	.symtab	0x1e33c	860	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x1a160	96	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x1bfb0	168	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x1e868	860	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x1681c	248	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x20400	992	FUNC	<unknown>	HIDDEN	2
__GI_fgetc	.symtab	0x1fed4	320	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x207e8	344	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x20014	260	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x20940	160	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x1ebc4	24	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x1c8a0	1088	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x18410	60	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x21ca0	36	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x21ccc	448	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x1dc60	116	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x18454	196	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x207e8	344	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x1dd8c	40	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x1ddb4	32	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x1ddd4	32	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x1ddf4	32	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x1de1c	56	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x1cda4	88	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x1de5c	92	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x1a1c0	36	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x1deb8	32	FUNC	<unknown>	HIDDEN	2
__GI_inet_addr	.symtab	0x1a0b4	40	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x212d4	244	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x1bda0	244	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x21a84	228	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x21240	32	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x16a24	92	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x2223c	124	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x20a60	280	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x18b44	4212	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x18560	1508	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x22214	32	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x20eb8	256	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x19bec	416	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x1dee0	108	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x1df54	104	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x1dfc4	92	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x1e084	72	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x1d0e0	132	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0x16ed8	228	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x1ce04	264	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x1ba4c	108	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x1bc18	152	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x1d1e8	132	FUNC	<unknown>	HIDDEN	2
__GI_readdir	.symtab	0x17074	184	FUNC	<unknown>	HIDDEN	2
__GI_readdir64	.symtab	0x1e280	188	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x1a210	92	FUNC	<unknown>	HIDDEN	2
__GI_recvfrom	.symtab	0x1a26c	96	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x1e0d4	108	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x16b60	84	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x1a2cc	92	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x1a328	96	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x16bbc	80	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x1a388	44	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x1be94	276	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x1da5c	264	FUNC	<unknown>	HIDDEN	2
__GI_sigaddset	.symtab	0x1a3e0	72	FUNC	<unknown>	HIDDEN	2
__GI_sigemptyset	.symtab	0x1a428	16	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x1a440	168	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x16c14	172	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x1cf14	336	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x1a3b4	36	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x17190	52	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x1bcb0	232	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x20bec	524	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul	.symtab	0x20fb8	260	FUNC	<unknown>	HIDDEN	2
__GI_strcspn	.symtab	0x210bc	60	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x19df4	120	FUNC	<unknown>	HIDDEN	2
__GI_strncmp	.symtab	0x210f8	244	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x19e6c	244	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x20df8	192	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x211ec	84	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x2141c	20	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x1c424	1140	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x21260	108	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x16cc0	40	FUNC	<unknown>	HIDDEN	2
__GI_times	.symtab	0x1e140	40	FUNC	<unknown>	HIDDEN	2
__GI_unlink	.symtab	0x16cf0	88	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x171c4	164	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x1e730	76	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x1e7a0	192	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x1e77c	28	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x1d164	132	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x34058	0	OBJECT	<unknown>	DEFAULT	9
__JCR_LIST__	.symtab	0x34058	0	OBJECT	<unknown>	DEFAULT	9
__app_fini	.symtab	0x34a0c	4	OBJECT	<unknown>	HIDDEN	12
__atexit_lock	.symtab	0x342d8	24	OBJECT	<unknown>	DEFAULT	11
__bss_start	.symtab	0x343ec	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x1d534	84	FUNC	<unknown>	DEFAULT	2
__close	.symtab	0x1d064	124	FUNC	<unknown>	DEFAULT	2
__close_nocancel	.symtab	0x1d070	32	FUNC	<unknown>	DEFAULT	2
__ctype_b	.symtab	0x34300	4	OBJECT	<unknown>	DEFAULT	11
__curbrk	.symtab	0x36f74	4	OBJECT	<unknown>	HIDDEN	12
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__do_global_ctors_aux	.symtab	0x222b8	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x100d0	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x341dc	0	OBJECT	<unknown>	HIDDEN	11
__environ	.symtab	0x34a04	4	OBJECT	<unknown>	DEFAULT	12
__errno_location	.symtab	0x17134	36	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x344b4	4	OBJECT	<unknown>	HIDDEN	12
__fcntl_nocancel	.symtab	0x16758	196	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x207e8	344	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x34048	0	NOTYPE	<unknown>	HIDDEN	6
__fini_array_start	.symtab	0x34048	0	NOTYPE	<unknown>	HIDDEN	6
__fork	.symtab	0x1c8a0	1088	FUNC	<unknown>	DEFAULT	2
__fork_generation_pointer	.symtab	0x373c8	4	OBJECT	<unknown>	HIDDEN	12
__fork_handlers	.symtab	0x373cc	4	OBJECT	<unknown>	HIDDEN	12
__fork_lock	.symtab	0x344b8	4	OBJECT	<unknown>	HIDDEN	12
__getdents	.symtab	0x1dcdc	176	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x21b70	304	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x1de1c	56	FUNC	<unknown>	DEFAULT	2
__getpid	.symtab	0x1cda4	88	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x19f60	32	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__h_errno_location	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__init_array_end	.symtab	0x34048	0	NOTYPE	<unknown>	HIDDEN	6
__init_array_start	.symtab	0x34048	0	NOTYPE	<unknown>	HIDDEN	6
__libc_accept	.symtab	0x1a0dc	96	FUNC	<unknown>	DEFAULT	2
__libc_close	.symtab	0x1d064	124	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x1a160	96	FUNC	<unknown>	DEFAULT	2
__libc_disable_asynccancel	.symtab	0x1d274	196	FUNC	<unknown>	HIDDEN	2
__libc_enable_asynccancel	.symtab	0x1d338	268	FUNC	<unknown>	HIDDEN	2
__libc_errno	.symtab	0x0	4	TLS	<unknown>	HIDDEN	6
__libc_fcntl	.symtab	0x1681c	248	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x1c8a0	1088	FUNC	<unknown>	DEFAULT	2
__libc_h_errno	.symtab	0x4	4	TLS	<unknown>	HIDDEN	6
__libc_nanosleep	.symtab	0x1e084	72	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x1d0e0	132	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x1d1e8	132	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x1a210	92	FUNC	<unknown>	DEFAULT	2
__libc_recvfrom	.symtab	0x1a26c	96	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x16b60	84	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x1a2cc	92	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x1a328	96	FUNC	<unknown>	DEFAULT	2
__libc_setup_tls	.symtab	0x216ec	636	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x1da5c	264	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x34a00	4	OBJECT	<unknown>	DEFAULT	12
__libc_write	.symtab	0x1d164	132	FUNC	<unknown>	DEFAULT	2
__lll_lock_wait_private	.symtab	0x1ccf8	172	FUNC	<unknown>	HIDDEN	2
__malloc_consolidate	.symtab	0x1b4f4	436	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x1a568	144	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x341fc	24	OBJECT	<unknown>	DEFAULT	11
__malloc_state	.symtab	0x37050	888	OBJECT	<unknown>	DEFAULT	12
__malloc_trim	.symtab	0x1b444	176	FUNC	<unknown>	DEFAULT	2
__nptl_deallocate_tsd	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__nptl_nthreads	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__open	.symtab	0x1d0e0	132	FUNC	<unknown>	DEFAULT	2
__open_nocancel	.symtab	0x1d0ec	32	FUNC	<unknown>	DEFAULT	2
__pagesize	.symtab	0x34a08	4	OBJECT	<unknown>	DEFAULT	12
__preinit_array_end	.symtab	0x34048	0	NOTYPE	<unknown>	HIDDEN	6
__preinit_array_start	.symtab	0x34048	0	NOTYPE	<unknown>	HIDDEN	6
__progname	.symtab	0x342f4	4	OBJECT	<unknown>	DEFAULT	11
__progname_full	.symtab	0x342f8	4	OBJECT	<unknown>	DEFAULT	11
__pthread_initialize_minimal	.symtab	0x21968	24	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_init	.symtab	0x1d44c	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x1d444	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x1d444	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x1d444	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x1d444	8	FUNC	<unknown>	DEFAULT	2
__pthread_unwind	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__read	.symtab	0x1d1e8	132	FUNC	<unknown>	DEFAULT	2
__read_nocancel	.symtab	0x1d1f4	32	FUNC	<unknown>	DEFAULT	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__rt_sigreturn_stub	.symtab	0x1da34	16	FUNC	<unknown>	DEFAULT	2
__rtld_fini	.symtab	0x34a10	4	OBJECT	<unknown>	HIDDEN	12
__sigaddset	.symtab	0x1a510	44	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x1a53c	44	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x1a4e8	40	FUNC	<unknown>	DEFAULT	2
__sigjmp_save	.symtab	0x213c8	60	FUNC	<unknown>	HIDDEN	2
__sigreturn_stub	.symtab	0x1da44	16	FUNC	<unknown>	DEFAULT	2
__sigsetjmp	.symtab	0x1dbd8	28	FUNC	<unknown>	DEFAULT	2
__socketcall	.symtab	0x1dbfc	92	FUNC	<unknown>	HIDDEN	2
__socketcall.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__sparc32_atomic_locks	.symtab	0x34460	64	OBJECT	<unknown>	HIDDEN	12
__stdin	.symtab	0x34314	4	OBJECT	<unknown>	DEFAULT	11
__stdio_READ	.symtab	0x21e8c	104	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x21efc	248	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x21ffc	248	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x1f088	320	FUNC	<unknown>	HIDDEN	2
__stdio_rfill	.symtab	0x220f4	56	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x221e0	52	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x22134	172	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x1f390	272	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x1f4a0	56	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x34318	4	OBJECT	<unknown>	DEFAULT	11
__syscall_error	.symtab	0x1da0c	40	FUNC	<unknown>	HIDDEN	2
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_nanosleep	.symtab	0x1e028	92	FUNC	<unknown>	DEFAULT	2
__syscall_select	.symtab	0x16af8	104	FUNC	<unknown>	DEFAULT	2
__uClibc_fini	.symtab	0x1d48c	168	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x1d588	92	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x1d5e4	1056	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__ubp_memchr	.symtab	0x20a60	280	FUNC	<unknown>	DEFAULT	2
__uclibc_progname	.symtab	0x342f0	4	OBJECT	<unknown>	HIDDEN	11
__write	.symtab	0x1d164	132	FUNC	<unknown>	DEFAULT	2
__write_nocancel	.symtab	0x1d170	32	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r	.symtab	0x19f88	300	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__xstat32_conv	.symtab	0x1e1f4	132	FUNC	<unknown>	HIDDEN	2
__xstat64_conv	.symtab	0x1e168	140	FUNC	<unknown>	HIDDEN	2
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_bss_custom_printf_spec	.symtab	0x344a0	10	OBJECT	<unknown>	DEFAULT	12
_charpad	.symtab	0x17268	64	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_custom_printf_arginfo	.symtab	0x36ff8	40	OBJECT	<unknown>	HIDDEN	12
_custom_printf_handler	.symtab	0x37020	40	OBJECT	<unknown>	HIDDEN	12
_custom_printf_spec	.symtab	0x341f8	4	OBJECT	<unknown>	HIDDEN	11
_dl_aux_init	.symtab	0x21988	64	FUNC	<unknown>	DEFAULT	2
_dl_nothread_init_static_tls	.symtab	0x219c8	84	FUNC	<unknown>	HIDDEN	2
_dl_phdr	.symtab	0x373f0	4	OBJECT	<unknown>	DEFAULT	12
_dl_phnum	.symtab	0x373f4	4	OBJECT	<unknown>	DEFAULT	12
_dl_tls_dtv_gaps	.symtab	0x373e4	1	OBJECT	<unknown>	DEFAULT	12
_dl_tls_dtv_slotinfo_list	.symtab	0x373e0	4	OBJECT	<unknown>	DEFAULT	12
_dl_tls_generation	.symtab	0x373e8	4	OBJECT	<unknown>	DEFAULT	12
_dl_tls_max_dtv_idx	.symtab	0x373d8	4	OBJECT	<unknown>	DEFAULT	12
_dl_tls_setup	.symtab	0x21690	92	FUNC	<unknown>	DEFAULT	2
_dl_tls_static_align	.symtab	0x373d4	4	OBJECT	<unknown>	DEFAULT	12
_dl_tls_static_nelem	.symtab	0x373ec	4	OBJECT	<unknown>	DEFAULT	12
_dl_tls_static_size	.symtab	0x373dc	4	OBJECT	<unknown>	DEFAULT	12
_dl_tls_static_used	.symtab	0x373d0	4	OBJECT	<unknown>	DEFAULT	12
_edata	.symtab	0x343ec	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x373f8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_exit	.symtab	0x1691c	128	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x22300	0	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x34a38	8192	OBJECT	<unknown>	DEFAULT	12
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x172a8	116	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x1f6e4	2032	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_init	.symtab	0x100b4	0	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x1f4d8	144	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_init	.symtab	0x17a8c	156	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x17dcc	1604	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x17b28	60	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x17b64	492	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x17d58	116	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x1d460	36	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x1d454	12	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_setjmp	.symtab	0x1dbcc	8	FUNC	<unknown>	DEFAULT	2
_sigintr	.symtab	0x37048	8	OBJECT	<unknown>	HIDDEN	12
_start	.symtab	0x101c4	56	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x1ebe4	1188	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x1f1d0	124	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x3431c	4	OBJECT	<unknown>	DEFAULT	11
_stdio_openlist_add_lock	.symtab	0x34a18	12	OBJECT	<unknown>	DEFAULT	12
_stdio_openlist_dec_use	.symtab	0x20120	736	FUNC	<unknown>	HIDDEN	2
_stdio_openlist_del_count	.symtab	0x34a34	4	OBJECT	<unknown>	DEFAULT	12
_stdio_openlist_del_lock	.symtab	0x34a24	12	OBJECT	<unknown>	DEFAULT	12
_stdio_openlist_use_count	.symtab	0x34a30	4	OBJECT	<unknown>	DEFAULT	12
_stdio_streams	.symtab	0x34320	204	OBJECT	<unknown>	DEFAULT	11
_stdio_term	.symtab	0x1f24c	316	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x34304	4	OBJECT	<unknown>	DEFAULT	11
_stdlib_strto_l	.symtab	0x21438	472	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x1f568	60	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x22e68	2934	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x1f5a4	312	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x17324	1896	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x1b91c	280	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
accept	.symtab	0x1a0dc	96	FUNC	<unknown>	DEFAULT	2
accept.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
anti_gdb_entry	.symtab	0x15008	20	FUNC	<unknown>	DEFAULT	2
atoi	.symtab	0x21404	24	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x21404	24	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack_get_opt_int	.symtab	0x106dc	112	FUNC	<unknown>	DEFAULT	2
attack_get_opt_ip	.symtab	0x1066c	112	FUNC	<unknown>	DEFAULT	2
attack_init	.symtab	0x1074c	1024	FUNC	<unknown>	DEFAULT	2
attack_kill_all	.symtab	0x102d4	392	FUNC	<unknown>	DEFAULT	2
attack_method_nudp	.symtab	0x14650	1408	FUNC	<unknown>	DEFAULT	2
attack_method_raw	.symtab	0x13a90	1640	FUNC	<unknown>	DEFAULT	2
attack_method_stdhex	.symtab	0x14388	712	FUNC	<unknown>	DEFAULT	2
attack_method_tcp	.symtab	0x111cc	1620	FUNC	<unknown>	DEFAULT	2
attack_ongoing	.symtab	0x34414	32	OBJECT	<unknown>	DEFAULT	12
attack_parse	.symtab	0x1045c	528	FUNC	<unknown>	DEFAULT	2
attack_start	.symtab	0x101fc	216	FUNC	<unknown>	DEFAULT	2
attack_tcp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack_tcp_ack	.symtab	0x125ac	1744	FUNC	<unknown>	DEFAULT	2
attack_tcp_null	.symtab	0x13318	1904	FUNC	<unknown>	DEFAULT	2
attack_tcp_sack2	.symtab	0x11820	1640	FUNC	<unknown>	DEFAULT	2
attack_tcp_stomp	.symtab	0x11e88	1828	FUNC	<unknown>	DEFAULT	2
attack_tcp_syn	.symtab	0x10b4c	1664	FUNC	<unknown>	DEFAULT	2
attack_tcp_syndata	.symtab	0x12c7c	1692	FUNC	<unknown>	DEFAULT	2
attack_udp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack_udp_plain	.symtab	0x140f8	656	FUNC	<unknown>	DEFAULT	2
bcopy	.symtab	0x18554	12	FUNC	<unknown>	DEFAULT	2
been_there_done_that	.symtab	0x344b0	4	OBJECT	<unknown>	DEFAULT	12
bind	.symtab	0x1a13c	36	FUNC	<unknown>	DEFAULT	2
bind.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
brk	.symtab	0x21a24	88	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x1a440	168	FUNC	<unknown>	DEFAULT	2
bzero	.symtab	0x19bb8	52	FUNC	<unknown>	DEFAULT	2
call___do_global_ctors_aux	.symtab	0x222f4	0	FUNC	<unknown>	DEFAULT	2
call___do_global_dtors_aux	.symtab	0x1014c	0	FUNC	<unknown>	DEFAULT	2
call_frame_dummy	.symtab	0x101b8	0	FUNC	<unknown>	DEFAULT	2
calloc	.symtab	0x1af8c	284	FUNC	<unknown>	DEFAULT	2
calloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
chdir	.symtab	0x169a4	88	FUNC	<unknown>	DEFAULT	2
chdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
checksum.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
checksum_generic	.symtab	0x14bd0	100	FUNC	<unknown>	DEFAULT	2
checksum_tcpudp	.symtab	0x14c34	200	FUNC	<unknown>	DEFAULT	2
clock	.symtab	0x17158	56	FUNC	<unknown>	DEFAULT	2
clock.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x1d064	124	FUNC	<unknown>	DEFAULT	2
closedir	.symtab	0x16d50	208	FUNC	<unknown>	DEFAULT	2
closedir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
completed.4753	.symtab	0x343f0	1	OBJECT	<unknown>	DEFAULT	12
connect	.symtab	0x1a160	96	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
entries	.symtab	0x36fa8	4	OBJECT	<unknown>	DEFAULT	12
environ	.symtab	0x34a04	4	OBJECT	<unknown>	DEFAULT	12
errno	.symtab	0x0	4	TLS	<unknown>	DEFAULT	6
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
estridx	.symtab	0x22dd8	126	OBJECT	<unknown>	DEFAULT	4
exit	.symtab	0x1bfb0	168	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x23de0	72	OBJECT	<unknown>	DEFAULT	4
fclose	.symtab	0x1e868	860	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x1681c	248	FUNC	<unknown>	DEFAULT	2
fd_ctrl	.symtab	0x341e8	4	OBJECT	<unknown>	DEFAULT	11
fd_serv	.symtab	0x341ec	4	OBJECT	<unknown>	DEFAULT	11
fd_to_DIR	.symtab	0x16e28	176	FUNC	<unknown>	DEFAULT	2
fdopendir	.symtab	0x16fbc	176	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x20400	992	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc	.symtab	0x1fed4	320	FUNC	<unknown>	DEFAULT	2
fgetc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x207e8	344	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x20014	260	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x20940	160	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fmt	.symtab	0x23dc8	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x1ebc4	24	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0x1c8a0	1088	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork_handler_pool	.symtab	0x344bc	1348	OBJECT	<unknown>	DEFAULT	12
fputs_unlocked	.symtab	0x18410	60	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x10158	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x1b6b0	564	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x21ca0	36	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x21ca0	36	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x21ccc	448	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fstat	.symtab	0x1dc60	116	FUNC	<unknown>	DEFAULT	2
fstat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fwrite_unlocked	.symtab	0x18454	196	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getc	.symtab	0x1fed4	320	FUNC	<unknown>	DEFAULT	2
getc_unlocked	.symtab	0x207e8	344	FUNC	<unknown>	DEFAULT	2
getdents.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdents64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdtablesize	.symtab	0x1dd8c	40	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x1ddb4	32	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x1ddd4	32	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x1ddf4	32	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpagesize	.symtab	0x1de1c	56	FUNC	<unknown>	DEFAULT	2
getpagesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x1cda4	88	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getppid	.symtab	0x169fc	32	FUNC	<unknown>	DEFAULT	2
getppid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x1de5c	92	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockname	.symtab	0x1a1c0	36	FUNC	<unknown>	DEFAULT	2
getsockname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x1a1e4	44	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x1deb8	32	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
h_errno	.symtab	0x4	4	TLS	<unknown>	DEFAULT	6
hexPayload	.symtab	0x341e4	4	OBJECT	<unknown>	DEFAULT	11
httpd_port	.symtab	0x3443c	4	OBJECT	<unknown>	DEFAULT	12
httpd_started	.symtab	0x34440	4	OBJECT	<unknown>	DEFAULT	12
id_buf	.symtab	0x36f88	32	OBJECT	<unknown>	DEFAULT	12
index	.symtab	0x20bec	524	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x1a0b4	40	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x212d4	244	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
init_static_tls	.symtab	0x21618	120	FUNC	<unknown>	DEFAULT	2
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initstate	.symtab	0x1bb34	124	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x1bda0	244	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x21a84	228	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isatty	.symtab	0x21240	32	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0x16a24	92	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
killer.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
killer_init	.symtab	0x14efc	268	FUNC	<unknown>	DEFAULT	2
killer_kill	.symtab	0x14cfc	44	FUNC	<unknown>	DEFAULT	2
killer_mirai_exists	.symtab	0x14d9c	352	FUNC	<unknown>	DEFAULT	2
killer_pid	.symtab	0x34434	4	OBJECT	<unknown>	DEFAULT	12
libc-cancellation.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc-lowlevellock.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc-tls.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lockdown	.symtab	0x36f80	4	OBJECT	<unknown>	DEFAULT	12
lseek64	.symtab	0x2223c	124	FUNC	<unknown>	DEFAULT	2
main	.symtab	0x150a4	2172	FUNC	<unknown>	DEFAULT	2
main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
main_pid	.symtab	0x36fac	4	OBJECT	<unknown>	DEFAULT	12
malloc	.symtab	0x1a600	2436	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
malloc_trim	.symtab	0x1b8e4	48	FUNC	<unknown>	DEFAULT	2
memchr	.symtab	0x20a60	280	FUNC	<unknown>	DEFAULT	2
memcpy	.symtab	0x18b44	4212	FUNC	<unknown>	DEFAULT	2
memmove	.symtab	0x18560	1508	FUNC	<unknown>	DEFAULT	2
mempcpy	.symtab	0x22214	32	FUNC	<unknown>	DEFAULT	2
mempcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memrchr	.symtab	0x20eb8	256	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x19bec	416	FUNC	<unknown>	DEFAULT	2
methods	.symtab	0x34410	4	OBJECT	<unknown>	DEFAULT	12
methods_len	.symtab	0x3440c	1	OBJECT	<unknown>	DEFAULT	12
mmap	.symtab	0x1dee0	108	FUNC	<unknown>	DEFAULT	2
mmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mremap	.symtab	0x1df54	104	FUNC	<unknown>	DEFAULT	2
mremap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
munmap	.symtab	0x1dfc4	92	FUNC	<unknown>	DEFAULT	2
munmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mylock	.symtab	0x34214	24	OBJECT	<unknown>	DEFAULT	11
mylock	.symtab	0x3422c	24	OBJECT	<unknown>	DEFAULT	11
nanosleep	.symtab	0x1e084	72	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
object.4768	.symtab	0x343f4	24	OBJECT	<unknown>	DEFAULT	12
open	.symtab	0x1d0e0	132	FUNC	<unknown>	DEFAULT	2
opendir	.symtab	0x16ed8	228	FUNC	<unknown>	DEFAULT	2
opendir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
p.4751	.symtab	0x341e0	0	OBJECT	<unknown>	DEFAULT	11
parse_config.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pending_connection	.symtab	0x34444	1	OBJECT	<unknown>	DEFAULT	12
pgid	.symtab	0x34448	4	OBJECT	<unknown>	DEFAULT	12
prctl	.symtab	0x16a88	104	FUNC	<unknown>	DEFAULT	2
prctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prefix.6476	.symtab	0x22d30	12	OBJECT	<unknown>	DEFAULT	4
program_invocation_name	.symtab	0x342f8	4	OBJECT	<unknown>	DEFAULT	11
program_invocation_short_name	.symtab	0x342f4	4	OBJECT	<unknown>	DEFAULT	11
protect_d	.symtab	0x14d28	116	FUNC	<unknown>	DEFAULT	2
qual_chars.6485	.symtab	0x22d48	20	OBJECT	<unknown>	DEFAULT	4
raise	.symtab	0x1ce04	264	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x1ba34	16	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand_alphastr	.symtab	0x159c0	300	FUNC	<unknown>	DEFAULT	2
rand_init	.symtab	0x15970	80	FUNC	<unknown>	DEFAULT	2
rand_next	.symtab	0x15920	80	FUNC	<unknown>	DEFAULT	2
rand_str	.symtab	0x15aec	248	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x1ba4c	108	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x239e0	40	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x1bc18	152	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randtbl	.symtab	0x34244	128	OBJECT	<unknown>	DEFAULT	11
read	.symtab	0x1d1e8	132	FUNC	<unknown>	DEFAULT	2
readdir	.symtab	0x17074	184	FUNC	<unknown>	DEFAULT	2
readdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
readdir64	.symtab	0x1e280	188	FUNC	<unknown>	DEFAULT	2
readdir64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
readlink.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
realloc	.symtab	0x1b0b0	916	FUNC	<unknown>	DEFAULT	2
realloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recv	.symtab	0x1a210	92	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recvfrom	.symtab	0x1a26c	96	FUNC	<unknown>	DEFAULT	2
recvfrom.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
register-atfork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
remove.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
resolv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
resolv_entries_free	.symtab	0x15be4	56	FUNC	<unknown>	DEFAULT	2
resolv_lookup	.symtab	0x15c1c	1296	FUNC	<unknown>	DEFAULT	2
resolve_cnc_addr	.symtab	0x1501c	136	FUNC	<unknown>	DEFAULT	2
resolve_func	.symtab	0x341f0	4	OBJECT	<unknown>	DEFAULT	11
rindex	.symtab	0x20df8	192	FUNC	<unknown>	DEFAULT	2
rmdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rt_sigaction	.symtab	0x1db64	104	FUNC	<unknown>	DEFAULT	2
sbrk	.symtab	0x1e0d4	108	FUNC	<unknown>	DEFAULT	2
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
select	.symtab	0x16b60	84	FUNC	<unknown>	DEFAULT	2
select.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send	.symtab	0x1a2cc	92	FUNC	<unknown>	DEFAULT	2
send.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sendto	.symtab	0x1a328	96	FUNC	<unknown>	DEFAULT	2
sendto.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setjmp	.symtab	0x1dbd4	4	FUNC	<unknown>	DEFAULT	2
setsid	.symtab	0x16bbc	80	FUNC	<unknown>	DEFAULT	2
setsid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsockopt	.symtab	0x1a388	44	FUNC	<unknown>	DEFAULT	2
setsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate	.symtab	0x1bab8	124	FUNC	<unknown>	DEFAULT	2
setstate_r	.symtab	0x1be94	276	FUNC	<unknown>	DEFAULT	2
sigaction	.symtab	0x1da5c	264	FUNC	<unknown>	DEFAULT	2
sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigaddset	.symtab	0x1a3e0	72	FUNC	<unknown>	DEFAULT	2
sigaddset.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigempty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigemptyset	.symtab	0x1a428	16	FUNC	<unknown>	DEFAULT	2
sigjmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
signal	.symtab	0x1a440	168	FUNC	<unknown>	DEFAULT	2
signal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigprocmask	.symtab	0x16c14	172	FUNC	<unknown>	DEFAULT	2
sigprocmask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigsetops.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sleep	.symtab	0x1cf14	336	FUNC	<unknown>	DEFAULT	2
sleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket	.symtab	0x1a3b4	36	FUNC	<unknown>	DEFAULT	2
socket.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
spec_and_mask.6484	.symtab	0x22d5c	16	OBJECT	<unknown>	DEFAULT	4
spec_base.6475	.symtab	0x22d40	7	OBJECT	<unknown>	DEFAULT	4
spec_chars.6481	.symtab	0x22db8	21	OBJECT	<unknown>	DEFAULT	4
spec_flags.6480	.symtab	0x22dd0	8	OBJECT	<unknown>	DEFAULT	4
spec_or_mask.6483	.symtab	0x22d6c	16	OBJECT	<unknown>	DEFAULT	4
spec_ranges.6482	.symtab	0x22d80	9	OBJECT	<unknown>	DEFAULT	4
sprintf	.symtab	0x17190	52	FUNC	<unknown>	DEFAULT	2
sprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
srand	.symtab	0x1bbb0	104	FUNC	<unknown>	DEFAULT	2
srandom	.symtab	0x1bbb0	104	FUNC	<unknown>	DEFAULT	2
srandom_r	.symtab	0x1bcb0	232	FUNC	<unknown>	DEFAULT	2
srv_addr	.symtab	0x36fb0	16	OBJECT	<unknown>	DEFAULT	12
static_dtv	.symtab	0x36a38	512	OBJECT	<unknown>	DEFAULT	12
static_map	.symtab	0x36f40	52	OBJECT	<unknown>	DEFAULT	12
static_slotinfo	.symtab	0x36c38	776	OBJECT	<unknown>	DEFAULT	12
stderr	.symtab	0x34310	4	OBJECT	<unknown>	DEFAULT	11
stdin	.symtab	0x34308	4	OBJECT	<unknown>	DEFAULT	11
stdout	.symtab	0x3430c	4	OBJECT	<unknown>	DEFAULT	11
strchr	.symtab	0x20bec	524	FUNC	<unknown>	DEFAULT	2
strchrnul	.symtab	0x20fb8	260	FUNC	<unknown>	DEFAULT	2
strchrnul.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcspn	.symtab	0x210bc	60	FUNC	<unknown>	DEFAULT	2
strcspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strerror_r	.symtab	0x19f88	300	FUNC	<unknown>	DEFAULT	2
strlen	.symtab	0x19df4	120	FUNC	<unknown>	DEFAULT	2
strncmp	.symtab	0x210f8	244	FUNC	<unknown>	DEFAULT	2
strncmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strnlen	.symtab	0x19e6c	244	FUNC	<unknown>	DEFAULT	2
strnlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strrchr	.symtab	0x20df8	192	FUNC	<unknown>	DEFAULT	2
strspn	.symtab	0x211ec	84	FUNC	<unknown>	DEFAULT	2
strspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtol	.symtab	0x2141c	20	FUNC	<unknown>	DEFAULT	2
strtol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sysconf	.symtab	0x1c424	1140	FUNC	<unknown>	DEFAULT	2
sysconf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
table	.symtab	0x36fc0	56	OBJECT	<unknown>	DEFAULT	12
table.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
table_init	.symtab	0x16284	260	FUNC	<unknown>	DEFAULT	2
table_key	.symtab	0x341f4	4	OBJECT	<unknown>	DEFAULT	11
table_lock_val	.symtab	0x16154	152	FUNC	<unknown>	DEFAULT	2
table_retrieve_val	.symtab	0x1612c	40	FUNC	<unknown>	DEFAULT	2
table_unlock_val	.symtab	0x161ec	152	FUNC	<unknown>	DEFAULT	2
tcgetattr	.symtab	0x21260	108	FUNC	<unknown>	DEFAULT	2
tcgetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
time	.symtab	0x16cc0	40	FUNC	<unknown>	DEFAULT	2
time.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
times	.symtab	0x1e140	40	FUNC	<unknown>	DEFAULT	2
times.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
type_codes	.symtab	0x22d8a	24	OBJECT	<unknown>	DEFAULT	4
type_sizes	.symtab	0x22da8	12	OBJECT	<unknown>	DEFAULT	4
unknown.1356	.symtab	0x22e58	14	OBJECT	<unknown>	DEFAULT	4
unlink	.symtab	0x16cf0	88	FUNC	<unknown>	DEFAULT	2
unlink.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
unsafe_state	.symtab	0x342c4	20	OBJECT	<unknown>	DEFAULT	11
update_process	.symtab	0x13a88	8	FUNC	<unknown>	DEFAULT	2
updating	.symtab	0x34438	4	OBJECT	<unknown>	DEFAULT	12
util.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
util_atoi	.symtab	0x1656c	376	FUNC	<unknown>	DEFAULT	2
util_isalpha	.symtab	0x164ac	40	FUNC	<unknown>	DEFAULT	2
util_isdigit	.symtab	0x164d4	20	FUNC	<unknown>	DEFAULT	2
util_local_addr	.symtab	0x164e8	132	FUNC	<unknown>	DEFAULT	2
util_memcpy	.symtab	0x16458	44	FUNC	<unknown>	DEFAULT	2
util_strcat	.symtab	0x163b8	76	FUNC	<unknown>	DEFAULT	2
util_strcpy	.symtab	0x16404	84	FUNC	<unknown>	DEFAULT	2
util_strlen	.symtab	0x16388	48	FUNC	<unknown>	DEFAULT	2
util_zero	.symtab	0x16484	40	FUNC	<unknown>	DEFAULT	2
vsnprintf	.symtab	0x171c4	164	FUNC	<unknown>	DEFAULT	2
vsnprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
w	.symtab	0x34458	4	OBJECT	<unknown>	DEFAULT	12
wcrtomb	.symtab	0x1e730	76	FUNC	<unknown>	DEFAULT	2
wcrtomb.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsnrtombs	.symtab	0x1e7a0	192	FUNC	<unknown>	DEFAULT	2
wcsnrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsrtombs	.symtab	0x1e77c	28	FUNC	<unknown>	DEFAULT	2
wcsrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
write	.symtab	0x1d164	132	FUNC	<unknown>	DEFAULT	2
x	.symtab	0x3444c	4	OBJECT	<unknown>	DEFAULT	12
xstatconv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
y	.symtab	0x34450	4	OBJECT	<unknown>	DEFAULT	12
z	.symtab	0x34454	4	OBJECT	<unknown>	DEFAULT	12

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 25, 2024 12:46:13.378448009 CET	43928	443	192.168.2.23	91.189.91.42
Dec 25, 2024 12:46:26.779643059 CET	443	39256	34.249.145.219	192.168.2.23
Dec 25, 2024 12:46:26.779921055 CET	39256	443	192.168.2.23	34.249.145.219
Dec 25, 2024 12:46:27.100629091 CET	443	39256	34.249.145.219	192.168.2.23
Dec 25, 2024 12:46:30.016249895 CET	42516	80	192.168.2.23	109.202.202.202
Dec 25, 2024 12:46:34.111660004 CET	43928	443	192.168.2.23	91.189.91.42
Dec 25, 2024 12:47:15.066119909 CET	43928	443	192.168.2.23	91.189.91.42

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 25, 2024 12:46:13.608741045 CET	40334	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:46:13.742928982 CET	53	40334	8.8.8.8	192.168.2.23
Dec 25, 2024 12:46:13.744385958 CET	58152	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:46:13.867208004 CET	53	58152	8.8.8.8	192.168.2.23
Dec 25, 2024 12:46:13.868362904 CET	49353	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:46:13.990875959 CET	53	49353	8.8.8.8	192.168.2.23
Dec 25, 2024 12:46:13.992326021 CET	44356	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:46:14.114942074 CET	53	44356	8.8.8.8	192.168.2.23
Dec 25, 2024 12:46:14.116065979 CET	59170	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:46:14.238544941 CET	53	59170	8.8.8.8	192.168.2.23
Dec 25, 2024 12:46:19.242088079 CET	51096	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:46:19.364664078 CET	53	51096	8.8.8.8	192.168.2.23
Dec 25, 2024 12:46:19.366085052 CET	49100	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:46:19.489032984 CET	53	49100	8.8.8.8	192.168.2.23
Dec 25, 2024 12:46:19.490494013 CET	49176	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:46:19.625112057 CET	53	49176	8.8.8.8	192.168.2.23
Dec 25, 2024 12:46:19.626267910 CET	41655	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:46:19.748909950 CET	53	41655	8.8.8.8	192.168.2.23
Dec 25, 2024 12:46:19.750540972 CET	53322	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:46:19.873260021 CET	53	53322	8.8.8.8	192.168.2.23
Dec 25, 2024 12:46:20.876820087 CET	54514	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:46:20.999319077 CET	53	54514	8.8.8.8	192.168.2.23
Dec 25, 2024 12:46:21.000576973 CET	35502	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:46:21.123198986 CET	53	35502	8.8.8.8	192.168.2.23
Dec 25, 2024 12:46:21.124507904 CET	44549	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:46:21.247047901 CET	53	44549	8.8.8.8	192.168.2.23
Dec 25, 2024 12:46:21.248297930 CET	56975	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:46:21.370728016 CET	53	56975	8.8.8.8	192.168.2.23
Dec 25, 2024 12:46:21.372076988 CET	40461	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:46:21.506477118 CET	53	40461	8.8.8.8	192.168.2.23
Dec 25, 2024 12:46:24.509399891 CET	36838	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:46:24.643420935 CET	53	36838	8.8.8.8	192.168.2.23
Dec 25, 2024 12:46:24.644831896 CET	37416	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:46:24.767347097 CET	53	37416	8.8.8.8	192.168.2.23
Dec 25, 2024 12:46:24.787599087 CET	59901	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:46:24.910151958 CET	53	59901	8.8.8.8	192.168.2.23
Dec 25, 2024 12:46:24.911303997 CET	57457	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:46:25.045429945 CET	53	57457	8.8.8.8	192.168.2.23
Dec 25, 2024 12:46:25.046524048 CET	51764	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:46:25.180937052 CET	53	51764	8.8.8.8	192.168.2.23
Dec 25, 2024 12:46:30.183358908 CET	48947	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:46:30.318631887 CET	53	48947	8.8.8.8	192.168.2.23
Dec 25, 2024 12:46:30.320143938 CET	33987	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:46:30.571970940 CET	53	33987	8.8.8.8	192.168.2.23
Dec 25, 2024 12:46:30.573467970 CET	56125	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:46:30.696007967 CET	53	56125	8.8.8.8	192.168.2.23
Dec 25, 2024 12:46:30.697669029 CET	37856	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:46:30.831908941 CET	53	37856	8.8.8.8	192.168.2.23
Dec 25, 2024 12:46:30.832923889 CET	33062	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:46:30.955537081 CET	53	33062	8.8.8.8	192.168.2.23
Dec 25, 2024 12:46:35.958947897 CET	40535	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:46:36.081768036 CET	53	40535	8.8.8.8	192.168.2.23
Dec 25, 2024 12:46:36.083550930 CET	34167	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:46:36.217530012 CET	53	34167	8.8.8.8	192.168.2.23
Dec 25, 2024 12:46:36.219271898 CET	39756	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:46:36.353571892 CET	53	39756	8.8.8.8	192.168.2.23
Dec 25, 2024 12:46:36.355218887 CET	36837	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:46:36.477874041 CET	53	36837	8.8.8.8	192.168.2.23
Dec 25, 2024 12:46:36.479671001 CET	59932	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:46:36.602262974 CET	53	59932	8.8.8.8	192.168.2.23
Dec 25, 2024 12:46:44.604276896 CET	43174	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:46:44.746174097 CET	53	43174	8.8.8.8	192.168.2.23
Dec 25, 2024 12:46:44.747499943 CET	37576	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:46:44.881572962 CET	53	37576	8.8.8.8	192.168.2.23
Dec 25, 2024 12:46:44.882865906 CET	43041	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:46:45.005477905 CET	53	43041	8.8.8.8	192.168.2.23
Dec 25, 2024 12:46:45.006510973 CET	39707	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:46:45.141006947 CET	53	39707	8.8.8.8	192.168.2.23
Dec 25, 2024 12:46:45.141993046 CET	34221	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:46:45.276009083 CET	53	34221	8.8.8.8	192.168.2.23
Dec 25, 2024 12:46:55.277831078 CET	33032	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:46:55.411847115 CET	53	33032	8.8.8.8	192.168.2.23
Dec 25, 2024 12:46:55.413084030 CET	49634	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:46:55.535563946 CET	53	49634	8.8.8.8	192.168.2.23
Dec 25, 2024 12:46:55.537081957 CET	34902	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:46:55.671566963 CET	53	34902	8.8.8.8	192.168.2.23
Dec 25, 2024 12:46:55.672862053 CET	33610	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:46:55.796139956 CET	53	33610	8.8.8.8	192.168.2.23
Dec 25, 2024 12:46:55.797374964 CET	33195	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:46:55.920340061 CET	53	33195	8.8.8.8	192.168.2.23
Dec 25, 2024 12:46:57.922523975 CET	37510	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:46:58.056369066 CET	53	37510	8.8.8.8	192.168.2.23
Dec 25, 2024 12:46:58.057145119 CET	45552	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:46:58.182003021 CET	53	45552	8.8.8.8	192.168.2.23
Dec 25, 2024 12:46:58.183125973 CET	55134	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:46:58.317281961 CET	53	55134	8.8.8.8	192.168.2.23
Dec 25, 2024 12:46:58.318552017 CET	45497	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:46:58.441869974 CET	53	45497	8.8.8.8	192.168.2.23
Dec 25, 2024 12:46:58.442828894 CET	38417	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:46:58.567703009 CET	53	38417	8.8.8.8	192.168.2.23
Dec 25, 2024 12:47:07.569103003 CET	52242	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:47:07.703476906 CET	53	52242	8.8.8.8	192.168.2.23
Dec 25, 2024 12:47:07.704269886 CET	36488	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:47:07.826740026 CET	53	36488	8.8.8.8	192.168.2.23
Dec 25, 2024 12:47:07.827685118 CET	48291	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:47:07.962373018 CET	53	48291	8.8.8.8	192.168.2.23
Dec 25, 2024 12:47:07.963176012 CET	35091	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:47:08.097135067 CET	53	35091	8.8.8.8	192.168.2.23
Dec 25, 2024 12:47:08.098119020 CET	46083	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:47:08.221004963 CET	53	46083	8.8.8.8	192.168.2.23
Dec 25, 2024 12:47:11.223282099 CET	39302	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:47:11.346031904 CET	53	39302	8.8.8.8	192.168.2.23
Dec 25, 2024 12:47:11.347120047 CET	46733	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:47:11.469647884 CET	53	46733	8.8.8.8	192.168.2.23
Dec 25, 2024 12:47:11.470594883 CET	45571	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:47:11.593071938 CET	53	45571	8.8.8.8	192.168.2.23
Dec 25, 2024 12:47:11.593957901 CET	55087	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:47:11.716552973 CET	53	55087	8.8.8.8	192.168.2.23
Dec 25, 2024 12:47:11.717431068 CET	41236	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:47:11.839868069 CET	53	41236	8.8.8.8	192.168.2.23
Dec 25, 2024 12:47:17.841974974 CET	40154	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:47:17.964623928 CET	53	40154	8.8.8.8	192.168.2.23
Dec 25, 2024 12:47:17.965924978 CET	41081	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:47:18.088512897 CET	53	41081	8.8.8.8	192.168.2.23
Dec 25, 2024 12:47:18.089680910 CET	56647	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:47:18.223623991 CET	53	56647	8.8.8.8	192.168.2.23
Dec 25, 2024 12:47:18.224925041 CET	50386	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:47:18.347467899 CET	53	50386	8.8.8.8	192.168.2.23
Dec 25, 2024 12:47:18.348566055 CET	43025	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:47:18.471254110 CET	53	43025	8.8.8.8	192.168.2.23
Dec 25, 2024 12:47:21.474050999 CET	59701	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:47:21.596744061 CET	53	59701	8.8.8.8	192.168.2.23
Dec 25, 2024 12:47:21.597771883 CET	45960	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:47:21.720370054 CET	53	45960	8.8.8.8	192.168.2.23
Dec 25, 2024 12:47:21.721599102 CET	45442	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:47:21.844024897 CET	53	45442	8.8.8.8	192.168.2.23
Dec 25, 2024 12:47:21.845297098 CET	60324	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:47:21.967911959 CET	53	60324	8.8.8.8	192.168.2.23
Dec 25, 2024 12:47:21.969008923 CET	34505	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:47:22.092978954 CET	53	34505	8.8.8.8	192.168.2.23
Dec 25, 2024 12:47:28.095169067 CET	50962	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:47:28.217732906 CET	53	50962	8.8.8.8	192.168.2.23
Dec 25, 2024 12:47:28.219139099 CET	36873	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:47:28.343036890 CET	53	36873	8.8.8.8	192.168.2.23
Dec 25, 2024 12:47:28.344414949 CET	51140	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:47:28.467051983 CET	53	51140	8.8.8.8	192.168.2.23
Dec 25, 2024 12:47:28.468044996 CET	56028	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:47:28.590507984 CET	53	56028	8.8.8.8	192.168.2.23
Dec 25, 2024 12:47:28.591332912 CET	57505	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:47:28.713879108 CET	53	57505	8.8.8.8	192.168.2.23
Dec 25, 2024 12:47:29.718497038 CET	60881	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:47:29.841578007 CET	53	60881	8.8.8.8	192.168.2.23
Dec 25, 2024 12:47:29.842425108 CET	58429	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:47:29.964834929 CET	53	58429	8.8.8.8	192.168.2.23
Dec 25, 2024 12:47:29.966063976 CET	42761	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:47:30.088538885 CET	53	42761	8.8.8.8	192.168.2.23
Dec 25, 2024 12:47:30.089387894 CET	53763	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:47:30.212186098 CET	53	53763	8.8.8.8	192.168.2.23
Dec 25, 2024 12:47:30.213135004 CET	56335	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:47:30.335486889 CET	53	56335	8.8.8.8	192.168.2.23
Dec 25, 2024 12:47:34.337393045 CET	53846	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:47:34.472309113 CET	53	53846	8.8.8.8	192.168.2.23
Dec 25, 2024 12:47:34.472934961 CET	37445	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:47:34.595381021 CET	53	37445	8.8.8.8	192.168.2.23
Dec 25, 2024 12:47:34.596009970 CET	48881	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:47:34.718652010 CET	53	48881	8.8.8.8	192.168.2.23
Dec 25, 2024 12:47:34.719531059 CET	39627	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:47:34.842196941 CET	53	39627	8.8.8.8	192.168.2.23
Dec 25, 2024 12:47:34.843452930 CET	49583	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:47:34.966008902 CET	53	49583	8.8.8.8	192.168.2.23
Dec 25, 2024 12:47:37.967549086 CET	33070	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:47:38.161206961 CET	53	33070	8.8.8.8	192.168.2.23
Dec 25, 2024 12:47:38.161925077 CET	37450	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:47:38.286818027 CET	53	37450	8.8.8.8	192.168.2.23
Dec 25, 2024 12:47:38.287735939 CET	50446	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:47:38.421686888 CET	53	50446	8.8.8.8	192.168.2.23
Dec 25, 2024 12:47:38.422277927 CET	54725	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:47:38.544853926 CET	53	54725	8.8.8.8	192.168.2.23
Dec 25, 2024 12:47:38.545413971 CET	58903	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:47:38.667859077 CET	53	58903	8.8.8.8	192.168.2.23
Dec 25, 2024 12:47:46.668638945 CET	32871	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:47:46.791179895 CET	53	32871	8.8.8.8	192.168.2.23
Dec 25, 2024 12:47:46.791987896 CET	45201	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:47:46.914554119 CET	53	45201	8.8.8.8	192.168.2.23
Dec 25, 2024 12:47:46.915487051 CET	57196	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:47:47.037977934 CET	53	57196	8.8.8.8	192.168.2.23
Dec 25, 2024 12:47:47.038873911 CET	46811	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:47:47.161345959 CET	53	46811	8.8.8.8	192.168.2.23
Dec 25, 2024 12:47:47.162832975 CET	59522	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:47:47.285478115 CET	53	59522	8.8.8.8	192.168.2.23
Dec 25, 2024 12:47:50.288310051 CET	57651	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:47:50.411026001 CET	53	57651	8.8.8.8	192.168.2.23
Dec 25, 2024 12:47:50.411963940 CET	47834	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:47:50.534373045 CET	53	47834	8.8.8.8	192.168.2.23
Dec 25, 2024 12:47:50.535119057 CET	40475	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:47:50.657871962 CET	53	40475	8.8.8.8	192.168.2.23
Dec 25, 2024 12:47:50.659120083 CET	55602	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:47:50.781974077 CET	53	55602	8.8.8.8	192.168.2.23
Dec 25, 2024 12:47:50.783380032 CET	48929	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:47:50.905946016 CET	53	48929	8.8.8.8	192.168.2.23
Dec 25, 2024 12:47:56.907644033 CET	41425	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:47:57.029983997 CET	53	41425	8.8.8.8	192.168.2.23
Dec 25, 2024 12:47:57.030627966 CET	40520	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:47:57.153137922 CET	53	40520	8.8.8.8	192.168.2.23
Dec 25, 2024 12:47:57.153763056 CET	38788	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:47:57.276124001 CET	53	38788	8.8.8.8	192.168.2.23
Dec 25, 2024 12:47:57.276715994 CET	46589	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:47:57.399117947 CET	53	46589	8.8.8.8	192.168.2.23
Dec 25, 2024 12:47:57.399816036 CET	57939	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:47:57.522155046 CET	53	57939	8.8.8.8	192.168.2.23
Dec 25, 2024 12:48:05.524257898 CET	58199	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:48:05.646836042 CET	53	58199	8.8.8.8	192.168.2.23
Dec 25, 2024 12:48:05.647895098 CET	33064	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:48:05.770673037 CET	53	33064	8.8.8.8	192.168.2.23
Dec 25, 2024 12:48:05.771539927 CET	55870	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:48:05.894424915 CET	53	55870	8.8.8.8	192.168.2.23
Dec 25, 2024 12:48:05.895416021 CET	40007	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:48:06.018105984 CET	53	40007	8.8.8.8	192.168.2.23
Dec 25, 2024 12:48:06.018758059 CET	34209	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:48:06.141427994 CET	53	34209	8.8.8.8	192.168.2.23
Dec 25, 2024 12:48:09.144387960 CET	58945	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:48:09.266921997 CET	53	58945	8.8.8.8	192.168.2.23
Dec 25, 2024 12:48:09.267906904 CET	52872	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:48:09.390551090 CET	53	52872	8.8.8.8	192.168.2.23
Dec 25, 2024 12:48:09.391923904 CET	39085	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:48:09.515223980 CET	53	39085	8.8.8.8	192.168.2.23
Dec 25, 2024 12:48:09.516120911 CET	37546	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:48:09.638712883 CET	53	37546	8.8.8.8	192.168.2.23
Dec 25, 2024 12:48:09.639664888 CET	53023	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:48:09.762156963 CET	53	53023	8.8.8.8	192.168.2.23
Dec 25, 2024 12:48:17.763418913 CET	58571	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:48:17.885906935 CET	53	58571	8.8.8.8	192.168.2.23
Dec 25, 2024 12:48:17.886924028 CET	45880	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:48:18.009613037 CET	53	45880	8.8.8.8	192.168.2.23
Dec 25, 2024 12:48:18.010579109 CET	46470	53	192.168.2.23	8.8.8.8
Dec 25, 2024 12:48:18.134867907 CET	53	46470	8.8.8.8	192.168.2.23
Dec 25, 2024 12:48:18.136022091 CET	55005	53	192.168.2.23	8.8.8.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 25, 2024 12:46:13.608741045 CET	192.168.2.23	8.8.8.8	0xdc31	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:13.744385958 CET	192.168.2.23	8.8.8.8	0xdc31	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:13.868362904 CET	192.168.2.23	8.8.8.8	0xdc31	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:13.992326021 CET	192.168.2.23	8.8.8.8	0xdc31	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:14.116065979 CET	192.168.2.23	8.8.8.8	0xdc31	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:19.242088079 CET	192.168.2.23	8.8.8.8	0xebeb	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:19.366085052 CET	192.168.2.23	8.8.8.8	0xebeb	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:19.490494013 CET	192.168.2.23	8.8.8.8	0xebeb	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:19.626267910 CET	192.168.2.23	8.8.8.8	0xebeb	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:19.750540972 CET	192.168.2.23	8.8.8.8	0xebeb	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:20.876820087 CET	192.168.2.23	8.8.8.8	0xdb8e	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:21.000576973 CET	192.168.2.23	8.8.8.8	0xdb8e	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:21.124507904 CET	192.168.2.23	8.8.8.8	0xdb8e	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:21.248297930 CET	192.168.2.23	8.8.8.8	0xdb8e	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:21.372076988 CET	192.168.2.23	8.8.8.8	0xdb8e	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:24.509399891 CET	192.168.2.23	8.8.8.8	0xf93e	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:24.644831896 CET	192.168.2.23	8.8.8.8	0xf93e	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:24.787599087 CET	192.168.2.23	8.8.8.8	0xf93e	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:24.911303997 CET	192.168.2.23	8.8.8.8	0xf93e	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:25.046524048 CET	192.168.2.23	8.8.8.8	0xf93e	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:30.183358908 CET	192.168.2.23	8.8.8.8	0x28c4	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:30.320143938 CET	192.168.2.23	8.8.8.8	0x28c4	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:30.573467970 CET	192.168.2.23	8.8.8.8	0x28c4	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:30.697669029 CET	192.168.2.23	8.8.8.8	0x28c4	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:30.832923889 CET	192.168.2.23	8.8.8.8	0x28c4	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:35.958947897 CET	192.168.2.23	8.8.8.8	0x7d35	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:36.083550930 CET	192.168.2.23	8.8.8.8	0x7d35	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:36.219271898 CET	192.168.2.23	8.8.8.8	0x7d35	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:36.355218887 CET	192.168.2.23	8.8.8.8	0x7d35	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:36.479671001 CET	192.168.2.23	8.8.8.8	0x7d35	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:44.604276896 CET	192.168.2.23	8.8.8.8	0x5d29	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:44.747499943 CET	192.168.2.23	8.8.8.8	0x5d29	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:44.882865906 CET	192.168.2.23	8.8.8.8	0x5d29	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:45.006510973 CET	192.168.2.23	8.8.8.8	0x5d29	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:45.141993046 CET	192.168.2.23	8.8.8.8	0x5d29	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:55.277831078 CET	192.168.2.23	8.8.8.8	0x45ea	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:55.413084030 CET	192.168.2.23	8.8.8.8	0x45ea	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:55.537081957 CET	192.168.2.23	8.8.8.8	0x45ea	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:55.672862053 CET	192.168.2.23	8.8.8.8	0x45ea	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:55.797374964 CET	192.168.2.23	8.8.8.8	0x45ea	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:57.922523975 CET	192.168.2.23	8.8.8.8	0xc405	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:58.057145119 CET	192.168.2.23	8.8.8.8	0xc405	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:58.183125973 CET	192.168.2.23	8.8.8.8	0xc405	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:58.318552017 CET	192.168.2.23	8.8.8.8	0xc405	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:58.442828894 CET	192.168.2.23	8.8.8.8	0xc405	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:07.569103003 CET	192.168.2.23	8.8.8.8	0xf7cb	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:07.704269886 CET	192.168.2.23	8.8.8.8	0xf7cb	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:07.827685118 CET	192.168.2.23	8.8.8.8	0xf7cb	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:07.963176012 CET	192.168.2.23	8.8.8.8	0xf7cb	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:08.098119020 CET	192.168.2.23	8.8.8.8	0xf7cb	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:11.223282099 CET	192.168.2.23	8.8.8.8	0xea06	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:11.347120047 CET	192.168.2.23	8.8.8.8	0xea06	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:11.470594883 CET	192.168.2.23	8.8.8.8	0xea06	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:11.593957901 CET	192.168.2.23	8.8.8.8	0xea06	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:11.717431068 CET	192.168.2.23	8.8.8.8	0xea06	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:17.841974974 CET	192.168.2.23	8.8.8.8	0x18be	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:17.965924978 CET	192.168.2.23	8.8.8.8	0x18be	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:18.089680910 CET	192.168.2.23	8.8.8.8	0x18be	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:18.224925041 CET	192.168.2.23	8.8.8.8	0x18be	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:18.348566055 CET	192.168.2.23	8.8.8.8	0x18be	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:21.474050999 CET	192.168.2.23	8.8.8.8	0xfcef	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:21.597771883 CET	192.168.2.23	8.8.8.8	0xfcef	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:21.721599102 CET	192.168.2.23	8.8.8.8	0xfcef	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:21.845297098 CET	192.168.2.23	8.8.8.8	0xfcef	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:21.969008923 CET	192.168.2.23	8.8.8.8	0xfcef	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:28.095169067 CET	192.168.2.23	8.8.8.8	0x8f30	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:28.219139099 CET	192.168.2.23	8.8.8.8	0x8f30	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:28.344414949 CET	192.168.2.23	8.8.8.8	0x8f30	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:28.468044996 CET	192.168.2.23	8.8.8.8	0x8f30	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:28.591332912 CET	192.168.2.23	8.8.8.8	0x8f30	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:29.718497038 CET	192.168.2.23	8.8.8.8	0x20bf	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:29.842425108 CET	192.168.2.23	8.8.8.8	0x20bf	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:29.966063976 CET	192.168.2.23	8.8.8.8	0x20bf	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:30.089387894 CET	192.168.2.23	8.8.8.8	0x20bf	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:30.213135004 CET	192.168.2.23	8.8.8.8	0x20bf	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:34.337393045 CET	192.168.2.23	8.8.8.8	0x2918	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:34.472934961 CET	192.168.2.23	8.8.8.8	0x2918	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:34.596009970 CET	192.168.2.23	8.8.8.8	0x2918	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:34.719531059 CET	192.168.2.23	8.8.8.8	0x2918	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:34.843452930 CET	192.168.2.23	8.8.8.8	0x2918	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:37.967549086 CET	192.168.2.23	8.8.8.8	0x7e40	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:38.161925077 CET	192.168.2.23	8.8.8.8	0x7e40	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:38.287735939 CET	192.168.2.23	8.8.8.8	0x7e40	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:38.422277927 CET	192.168.2.23	8.8.8.8	0x7e40	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:38.545413971 CET	192.168.2.23	8.8.8.8	0x7e40	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:46.668638945 CET	192.168.2.23	8.8.8.8	0x5696	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:46.791987896 CET	192.168.2.23	8.8.8.8	0x5696	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:46.915487051 CET	192.168.2.23	8.8.8.8	0x5696	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:47.038873911 CET	192.168.2.23	8.8.8.8	0x5696	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:47.162832975 CET	192.168.2.23	8.8.8.8	0x5696	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:50.288310051 CET	192.168.2.23	8.8.8.8	0x3165	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:50.411963940 CET	192.168.2.23	8.8.8.8	0x3165	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:50.535119057 CET	192.168.2.23	8.8.8.8	0x3165	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:50.659120083 CET	192.168.2.23	8.8.8.8	0x3165	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:50.783380032 CET	192.168.2.23	8.8.8.8	0x3165	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:56.907644033 CET	192.168.2.23	8.8.8.8	0x8b29	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:57.030627966 CET	192.168.2.23	8.8.8.8	0x8b29	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:57.153763056 CET	192.168.2.23	8.8.8.8	0x8b29	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:57.276715994 CET	192.168.2.23	8.8.8.8	0x8b29	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:57.399816036 CET	192.168.2.23	8.8.8.8	0x8b29	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:48:05.524257898 CET	192.168.2.23	8.8.8.8	0x7af	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:48:05.647895098 CET	192.168.2.23	8.8.8.8	0x7af	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:48:05.771539927 CET	192.168.2.23	8.8.8.8	0x7af	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:48:05.895416021 CET	192.168.2.23	8.8.8.8	0x7af	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:48:06.018758059 CET	192.168.2.23	8.8.8.8	0x7af	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:48:09.144387960 CET	192.168.2.23	8.8.8.8	0xc810	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:48:09.267906904 CET	192.168.2.23	8.8.8.8	0xc810	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:48:09.391923904 CET	192.168.2.23	8.8.8.8	0xc810	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:48:09.516120911 CET	192.168.2.23	8.8.8.8	0xc810	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:48:09.639664888 CET	192.168.2.23	8.8.8.8	0xc810	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:48:17.763418913 CET	192.168.2.23	8.8.8.8	0xfd68	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:48:17.886924028 CET	192.168.2.23	8.8.8.8	0xfd68	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:48:18.010579109 CET	192.168.2.23	8.8.8.8	0xfd68	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:48:18.136022091 CET	192.168.2.23	8.8.8.8	0xfd68	Standard query (0)	chinagov.one	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 25, 2024 12:46:13.742928982 CET	8.8.8.8	192.168.2.23	0xdc31	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:13.867208004 CET	8.8.8.8	192.168.2.23	0xdc31	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:13.990875959 CET	8.8.8.8	192.168.2.23	0xdc31	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:14.114942074 CET	8.8.8.8	192.168.2.23	0xdc31	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:14.238544941 CET	8.8.8.8	192.168.2.23	0xdc31	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:19.364664078 CET	8.8.8.8	192.168.2.23	0xebeb	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:19.489032984 CET	8.8.8.8	192.168.2.23	0xebeb	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:19.625112057 CET	8.8.8.8	192.168.2.23	0xebeb	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:19.748909950 CET	8.8.8.8	192.168.2.23	0xebeb	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:19.873260021 CET	8.8.8.8	192.168.2.23	0xebeb	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:20.999319077 CET	8.8.8.8	192.168.2.23	0xdb8e	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:21.123198986 CET	8.8.8.8	192.168.2.23	0xdb8e	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:21.247047901 CET	8.8.8.8	192.168.2.23	0xdb8e	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:21.370728016 CET	8.8.8.8	192.168.2.23	0xdb8e	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:21.506477118 CET	8.8.8.8	192.168.2.23	0xdb8e	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:24.643420935 CET	8.8.8.8	192.168.2.23	0xf93e	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:24.767347097 CET	8.8.8.8	192.168.2.23	0xf93e	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:24.910151958 CET	8.8.8.8	192.168.2.23	0xf93e	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:25.045429945 CET	8.8.8.8	192.168.2.23	0xf93e	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:25.180937052 CET	8.8.8.8	192.168.2.23	0xf93e	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:30.318631887 CET	8.8.8.8	192.168.2.23	0x28c4	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:30.571970940 CET	8.8.8.8	192.168.2.23	0x28c4	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:30.696007967 CET	8.8.8.8	192.168.2.23	0x28c4	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:30.831908941 CET	8.8.8.8	192.168.2.23	0x28c4	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:30.955537081 CET	8.8.8.8	192.168.2.23	0x28c4	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:36.081768036 CET	8.8.8.8	192.168.2.23	0x7d35	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:36.217530012 CET	8.8.8.8	192.168.2.23	0x7d35	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:36.353571892 CET	8.8.8.8	192.168.2.23	0x7d35	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:36.477874041 CET	8.8.8.8	192.168.2.23	0x7d35	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:36.602262974 CET	8.8.8.8	192.168.2.23	0x7d35	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:44.746174097 CET	8.8.8.8	192.168.2.23	0x5d29	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:44.881572962 CET	8.8.8.8	192.168.2.23	0x5d29	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:45.005477905 CET	8.8.8.8	192.168.2.23	0x5d29	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:45.141006947 CET	8.8.8.8	192.168.2.23	0x5d29	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:45.276009083 CET	8.8.8.8	192.168.2.23	0x5d29	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:55.411847115 CET	8.8.8.8	192.168.2.23	0x45ea	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:55.535563946 CET	8.8.8.8	192.168.2.23	0x45ea	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:55.671566963 CET	8.8.8.8	192.168.2.23	0x45ea	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:55.796139956 CET	8.8.8.8	192.168.2.23	0x45ea	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:55.920340061 CET	8.8.8.8	192.168.2.23	0x45ea	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:58.056369066 CET	8.8.8.8	192.168.2.23	0xc405	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:58.182003021 CET	8.8.8.8	192.168.2.23	0xc405	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:58.317281961 CET	8.8.8.8	192.168.2.23	0xc405	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:58.441869974 CET	8.8.8.8	192.168.2.23	0xc405	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:46:58.567703009 CET	8.8.8.8	192.168.2.23	0xc405	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:07.703476906 CET	8.8.8.8	192.168.2.23	0xf7cb	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:07.826740026 CET	8.8.8.8	192.168.2.23	0xf7cb	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:07.962373018 CET	8.8.8.8	192.168.2.23	0xf7cb	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:08.097135067 CET	8.8.8.8	192.168.2.23	0xf7cb	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:08.221004963 CET	8.8.8.8	192.168.2.23	0xf7cb	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:11.346031904 CET	8.8.8.8	192.168.2.23	0xea06	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:11.469647884 CET	8.8.8.8	192.168.2.23	0xea06	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:11.593071938 CET	8.8.8.8	192.168.2.23	0xea06	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:11.716552973 CET	8.8.8.8	192.168.2.23	0xea06	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:11.839868069 CET	8.8.8.8	192.168.2.23	0xea06	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:17.964623928 CET	8.8.8.8	192.168.2.23	0x18be	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:18.088512897 CET	8.8.8.8	192.168.2.23	0x18be	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:18.223623991 CET	8.8.8.8	192.168.2.23	0x18be	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:18.347467899 CET	8.8.8.8	192.168.2.23	0x18be	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:18.471254110 CET	8.8.8.8	192.168.2.23	0x18be	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:21.596744061 CET	8.8.8.8	192.168.2.23	0xfcef	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:21.720370054 CET	8.8.8.8	192.168.2.23	0xfcef	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:21.844024897 CET	8.8.8.8	192.168.2.23	0xfcef	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:21.967911959 CET	8.8.8.8	192.168.2.23	0xfcef	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:22.092978954 CET	8.8.8.8	192.168.2.23	0xfcef	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:28.217732906 CET	8.8.8.8	192.168.2.23	0x8f30	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:28.343036890 CET	8.8.8.8	192.168.2.23	0x8f30	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:28.467051983 CET	8.8.8.8	192.168.2.23	0x8f30	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:28.590507984 CET	8.8.8.8	192.168.2.23	0x8f30	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:28.713879108 CET	8.8.8.8	192.168.2.23	0x8f30	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:29.841578007 CET	8.8.8.8	192.168.2.23	0x20bf	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:29.964834929 CET	8.8.8.8	192.168.2.23	0x20bf	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:30.088538885 CET	8.8.8.8	192.168.2.23	0x20bf	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:30.212186098 CET	8.8.8.8	192.168.2.23	0x20bf	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:30.335486889 CET	8.8.8.8	192.168.2.23	0x20bf	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:34.472309113 CET	8.8.8.8	192.168.2.23	0x2918	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:34.595381021 CET	8.8.8.8	192.168.2.23	0x2918	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:34.718652010 CET	8.8.8.8	192.168.2.23	0x2918	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:34.842196941 CET	8.8.8.8	192.168.2.23	0x2918	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:34.966008902 CET	8.8.8.8	192.168.2.23	0x2918	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:38.161206961 CET	8.8.8.8	192.168.2.23	0x7e40	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:38.286818027 CET	8.8.8.8	192.168.2.23	0x7e40	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:38.421686888 CET	8.8.8.8	192.168.2.23	0x7e40	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:38.544853926 CET	8.8.8.8	192.168.2.23	0x7e40	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:38.667859077 CET	8.8.8.8	192.168.2.23	0x7e40	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:46.791179895 CET	8.8.8.8	192.168.2.23	0x5696	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:46.914554119 CET	8.8.8.8	192.168.2.23	0x5696	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:47.037977934 CET	8.8.8.8	192.168.2.23	0x5696	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:47.161345959 CET	8.8.8.8	192.168.2.23	0x5696	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:47.285478115 CET	8.8.8.8	192.168.2.23	0x5696	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:50.411026001 CET	8.8.8.8	192.168.2.23	0x3165	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:50.534373045 CET	8.8.8.8	192.168.2.23	0x3165	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:50.657871962 CET	8.8.8.8	192.168.2.23	0x3165	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:50.781974077 CET	8.8.8.8	192.168.2.23	0x3165	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:50.905946016 CET	8.8.8.8	192.168.2.23	0x3165	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:57.029983997 CET	8.8.8.8	192.168.2.23	0x8b29	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:57.153137922 CET	8.8.8.8	192.168.2.23	0x8b29	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:57.276124001 CET	8.8.8.8	192.168.2.23	0x8b29	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:57.399117947 CET	8.8.8.8	192.168.2.23	0x8b29	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:47:57.522155046 CET	8.8.8.8	192.168.2.23	0x8b29	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:48:05.646836042 CET	8.8.8.8	192.168.2.23	0x7af	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:48:05.770673037 CET	8.8.8.8	192.168.2.23	0x7af	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:48:05.894424915 CET	8.8.8.8	192.168.2.23	0x7af	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:48:06.018105984 CET	8.8.8.8	192.168.2.23	0x7af	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:48:06.141427994 CET	8.8.8.8	192.168.2.23	0x7af	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:48:09.266921997 CET	8.8.8.8	192.168.2.23	0xc810	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:48:09.390551090 CET	8.8.8.8	192.168.2.23	0xc810	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:48:09.515223980 CET	8.8.8.8	192.168.2.23	0xc810	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:48:09.638712883 CET	8.8.8.8	192.168.2.23	0xc810	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:48:09.762156963 CET	8.8.8.8	192.168.2.23	0xc810	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:48:17.885906935 CET	8.8.8.8	192.168.2.23	0xfd68	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:48:18.009613037 CET	8.8.8.8	192.168.2.23	0xfd68	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 12:48:18.134867907 CET	8.8.8.8	192.168.2.23	0xfd68	Name error (3)	chinagov.one	none	none	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: spc.elf PID: 6268, Parent PID: 6194

General

Start time (UTC):	11:46:11
Start date (UTC):	25/12/2024
Path:	/tmp/spc.elf
Arguments:	/tmp/spc.elf
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Chronological Activities

Analysis Process: spc.elf PID: 6271, Parent PID: 6268

General

Start time (UTC):	11:46:12
Start date (UTC):	25/12/2024
Path:	/tmp/spc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Chronological Activities

Analysis Process: spc.elf PID: 6273, Parent PID: 6271

General

Start time (UTC):	11:46:12
Start date (UTC):	25/12/2024
Path:	/tmp/spc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Chronological Activities

Analysis Process: spc.elf PID: 6274, Parent PID: 6271

General

Start time (UTC):	11:46:12
Start date (UTC):	25/12/2024
Path:	/tmp/spc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Chronological Activities

Analysis Process: spc.elf PID: 6277, Parent PID: 6274

General

Start time (UTC):	11:46:12
Start date (UTC):	25/12/2024
Path:	/tmp/spc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Chronological Activities

Analysis Process: dash PID: 6284, Parent PID: 4331

General

Start time (UTC):	11:46:25
Start date (UTC):	25/12/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rm PID: 6284, Parent PID: 4331

General

Start time (UTC):	11:46:25
Start date (UTC):	25/12/2024
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.fgaJzem5r5 /tmp/tmp.pfvNyMqYUZ /tmp/tmp.t2q3EDGji5
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Chronological Activities

Analysis Process: dash PID: 6285, Parent PID: 4331

General

Start time (UTC):	11:46:25
Start date (UTC):	25/12/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rm PID: 6285, Parent PID: 4331

General

Start time (UTC):	11:46:25
Start date (UTC):	25/12/2024
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.fgaJzem5r5 /tmp/tmp.pfvNyMqYUZ /tmp/tmp.t2q3EDGji5
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report spc.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: spc.elf PID: 6268, Parent PID: 6194

General

Chronological Activities

Analysis Process: spc.elf PID: 6271, Parent PID: 6268

General

Chronological Activities

Analysis Process: spc.elf PID: 6273, Parent PID: 6271

General

Chronological Activities

Analysis Process: spc.elf PID: 6274, Parent PID: 6271

General

Chronological Activities

Analysis Process: spc.elf PID: 6277, Parent PID: 6274

General

Chronological Activities

Analysis Process: dash PID: 6284, Parent PID: 4331

Linux Analysis Report
spc.elf