Edit tour

Linux Analysis Report
kitsune.ppc.elf

Overview

General Information

Sample name:	kitsune.ppc.elf
Analysis ID:	1581076
MD5:	66d3a5620b9d444559248617f747a75e
SHA1:	72a86cf0025448e5e08eb30cc59eb79fc4fc2b04
SHA256:	01410acd4939a14877a58f268dc23185753e07ce64876c92f470973f9d4b0a47
Tags:	elfuser-abuse_ch
Infos:

Detection

Gafgyt, Mirai

Score:	92
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Gafgyt

Yara detected Mirai

Opens /proc/net/* files useful for finding connected devices and routers

Detected TCP or UDP traffic on non-standard ports

Sample contains strings that are user agent strings indicative of HTTP manipulation

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581076
Start date and time:	2024-12-26 22:14:53 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	kitsune.ppc.elf
Detection:	MAL
Classification:	mal92.spre.troj.linELF@0/1@0/0

Warnings

VT rate limit hit for: kitsune.ppc.elf

Runtime Messages

Command:	/tmp/kitsune.ppc.elf
PID:	6255
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

kitsune.ppc.elf (PID: 6255, Parent: 6181, MD5: ae65271c943d3451b7f026d1fadccea6) Arguments: /tmp/kitsune.ppc.elf

kitsune.ppc.elf New Fork (PID: 6258, Parent: 6255)

kitsune.ppc.elf New Fork (PID: 6260, Parent: 6258)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
kitsune.ppc.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
kitsune.ppc.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
kitsune.ppc.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x11788:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1179c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x117b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x117c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x117d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x117ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11800:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11814:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11828:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1183c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11850:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11864:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11878:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1188c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11904:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11918:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
kitsune.ppc.elf	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x11738:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64

Memory Dumps

Source	Rule	Description	Author	Strings
6255.1.00007f84f0001000.00007f84f0015000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
6255.1.00007f84f0001000.00007f84f0015000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6258.1.00007f84f0001000.00007f84f0015000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
6255.1.00007f84f0001000.00007f84f0015000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x11788:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1179c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x117b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x117c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x117d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x117ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11800:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11814:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11828:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1183c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11850:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11864:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11878:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1188c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11904:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11918:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6255.1.00007f84f0001000.00007f84f0015000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x11738:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
6258.1.00007f84f0001000.00007f84f0015000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6258.1.00007f84f0001000.00007f84f0015000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x11788:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1179c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x117b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x117c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x117d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x117ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11800:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11814:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11828:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1183c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11850:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11864:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11878:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1188c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11904:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11918:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6258.1.00007f84f0001000.00007f84f0015000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x11738:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: kitsune.ppc.elf PID: 6255	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: kitsune.ppc.elf PID: 6255	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x3df9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3e0d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3e21:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3e35:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3e49:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3e5d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3e71:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3e85:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3e99:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3ead:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3ec1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3ed5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3ee9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3efd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3f11:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3f25:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3f39:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3f4d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3f61:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3f75:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3f89:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: kitsune.ppc.elf PID: 6255	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x3dac:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x421e:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: kitsune.ppc.elf PID: 6258	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: kitsune.ppc.elf PID: 6258	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x3940:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3954:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3968:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x397c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3990:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x39a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x39b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x39cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x39e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x39f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3a08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3a1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3a30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3a44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3a58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3a6c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3a80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3a94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3aa8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3abc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3ad0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: kitsune.ppc.elf PID: 6258	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x38f3:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x3d65:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Click to see the 9 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: kitsune.ppc.elf

Avira: detected

Found malware configuration

Source: kitsune.ppc.elf

Malware Configuration Extractor: Gafgyt {"C2 url": "178.215.238.69:4258"}

Multi AV Scanner detection for submitted file

Source: kitsune.ppc.elf

ReversingLabs: Detection: 65%

Spreading

Opens /proc/net/* files useful for finding connected devices and routers

Source: /tmp/kitsune.ppc.elf (PID: 6255)

Opens: /proc/net/route

Jump to behavior

Source: global traffic

TCP traffic: 192.168.2.23:51522 -> 178.215.238.69:4258

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443

Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.69
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.69
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.69
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.69
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.69
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.69
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.69
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.69
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.69
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.69
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.69
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.69
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.69
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.69
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.69
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.69
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.69
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.69
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.69
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.69
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.69
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.69
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.69
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.69
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.69
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.69
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.69
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.69
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.69
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.69
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.69
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.69
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.69
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.69
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.69
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.69
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.69
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.69
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.69
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.69
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.69
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.69
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.69
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.69
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.69
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.69

Source: kitsune.ppc.elf	String found in binary or memory: http://fast.no/support/crawler.asp)
Source: kitsune.ppc.elf	String found in binary or memory: http://feedback.redkolibri.com/
Source: kitsune.ppc.elf	String found in binary or memory: http://www.baidu.com/search/spider.htm)
Source: kitsune.ppc.elf	String found in binary or memory: http://www.baidu.com/search/spider.html)
Source: kitsune.ppc.elf	String found in binary or memory: http://www.billybobbot.com/crawler/)

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: kitsune.ppc.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: kitsune.ppc.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6255.1.00007f84f0001000.00007f84f0015000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6255.1.00007f84f0001000.00007f84f0015000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6258.1.00007f84f0001000.00007f84f0015000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6258.1.00007f84f0001000.00007f84f0015000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: kitsune.ppc.elf PID: 6255, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: kitsune.ppc.elf PID: 6255, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: kitsune.ppc.elf PID: 6258, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: kitsune.ppc.elf PID: 6258, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown

Source: kitsune.ppc.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: kitsune.ppc.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6255.1.00007f84f0001000.00007f84f0015000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6255.1.00007f84f0001000.00007f84f0015000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6258.1.00007f84f0001000.00007f84f0015000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6258.1.00007f84f0001000.00007f84f0015000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: kitsune.ppc.elf PID: 6255, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: kitsune.ppc.elf PID: 6255, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: kitsune.ppc.elf PID: 6258, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: kitsune.ppc.elf PID: 6258, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16

Source: classification engine

Classification label: mal92.spre.troj.linELF@0/1@0/0

Source: /tmp/kitsune.ppc.elf (PID: 6255)

Queries kernel information via 'uname':

Jump to behavior

Source: kitsune.ppc.elf, 6255.1.00007ffd84854000.00007ffd84875000.rw-.sdmp, kitsune.ppc.elf, 6258.1.00007ffd84854000.00007ffd84875000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-ppc/tmp/kitsune.ppc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/kitsune.ppc.elf
Source: kitsune.ppc.elf, 6255.1.000055bce56de000.000055bce578e000.rw-.sdmp, kitsune.ppc.elf, 6258.1.000055bce56de000.000055bce578e000.rw-.sdmp	Binary or memory string: !/etc/qemu-binfmt/ppc11!hotpluggableq
Source: kitsune.ppc.elf, 6255.1.00007ffd84854000.00007ffd84875000.rw-.sdmp	Binary or memory string: U/tmp/qemu-open.6VlIqc\D
Source: kitsune.ppc.elf, 6255.1.000055bce56de000.000055bce578e000.rw-.sdmp, kitsune.ppc.elf, 6258.1.000055bce56de000.000055bce578e000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/ppc
Source: kitsune.ppc.elf, 6255.1.00007ffd84854000.00007ffd84875000.rw-.sdmp, kitsune.ppc.elf, 6258.1.00007ffd84854000.00007ffd84875000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-ppc
Source: kitsune.ppc.elf, 6255.1.00007ffd84854000.00007ffd84875000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.6VlIqc

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match	File source: kitsune.ppc.elf, type: SAMPLE
Source: Yara match	File source: 6255.1.00007f84f0001000.00007f84f0015000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6258.1.00007f84f0001000.00007f84f0015000.r-x.sdmp, type: MEMORY

Yara detected Mirai

Source: Yara match	File source: kitsune.ppc.elf, type: SAMPLE
Source: Yara match	File source: 6255.1.00007f84f0001000.00007f84f0015000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6258.1.00007f84f0001000.00007f84f0015000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: kitsune.ppc.elf PID: 6255, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: kitsune.ppc.elf PID: 6258, type: MEMORYSTR

Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36
Source: Initial sample	User agent string found: Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; rv:2.2) Gecko/20110201
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.2; U; ru) Presto/2.5.22 Version/10.51
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko
Source: Initial sample	User agent string found: Mozilla/5.0 (Android; Linux armv7l; rv:9.0) Gecko/20111216 Firefox/9.0 Fennec/9.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60
Source: Initial sample	User agent string found: Mozilla/5.0 (iPad; U; CPU OS 5_1 like Mac OS X) AppleWebKit/531.21.10 (KHTML, like Gecko) Version/4.0.4 Mobile/7B367 Safari/531.21.10 UCBrowser/3.4.3.532
Source: Initial sample	User agent string found: Mozilla/5.0 (Nintendo WiiU) AppleWebKit/536.30 (KHTML, like Gecko) NX/3.0.4.2.12 NintendoBrowser/4.3.1.11264.US
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:25.0) Gecko/20100101 Firefox/25.0
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; pl) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; en) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; ja) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; cn) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; fr) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20100101 Firefox/12.0
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; U; Linux x86_64; de; rv:1.9.2.8) Gecko/20100723 Ubuntu/10.04 (lucid) Firefox/3.6.8
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; rv:13.0) Gecko/20100101 Firefox/13.0.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:11.0) Gecko/20100101 Firefox/11.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:13.0) Gecko/20100101 Firefox/13.0.1
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.289 Version/12.01
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.02
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.0) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.112 Safari/535.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36

Remote Access Functionality

Yara detected Gafgyt

Source: Yara match	File source: kitsune.ppc.elf, type: SAMPLE
Source: Yara match	File source: 6255.1.00007f84f0001000.00007f84f0015000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6258.1.00007f84f0001000.00007f84f0015000.r-x.sdmp, type: MEMORY

Yara detected Mirai

Source: Yara match	File source: kitsune.ppc.elf, type: SAMPLE
Source: Yara match	File source: 6255.1.00007f84f0001000.00007f84f0015000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6258.1.00007f84f0001000.00007f84f0015000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: kitsune.ppc.elf PID: 6255, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: kitsune.ppc.elf PID: 6258, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	1 Remote System Discovery	Remote Desktop Protocol	Data from Removable Media	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

Threatname: Gafgyt

{"C2 url": "178.215.238.69:4258"}

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
kitsune.ppc.elf	66%	ReversingLabs	Linux.Trojan.Mirai
kitsune.ppc.elf	100%	Avira	EXP/ELF.Mirai.Z.A

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
178.215.238.69:4258	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
178.215.238.69:4258	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://www.baidu.com/search/spider.html)	kitsune.ppc.elf	false	high
http://www.billybobbot.com/crawler/)	kitsune.ppc.elf	false	high
http://fast.no/support/crawler.asp)	kitsune.ppc.elf	false	high
http://feedback.redkolibri.com/	kitsune.ppc.elf	false	high
http://www.baidu.com/search/spider.htm)	kitsune.ppc.elf	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
178.215.238.69	unknown	Germany	10753	LVLT-10753US	true
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.43	ub8ehJSePAfc9FYqZIT6.ppc.elf	Get hash	malicious	Unknown	Browse
	ub8ehJSePAfc9FYqZIT6.arm.elf	Get hash	malicious	Mirai	Browse
	win.elf	Get hash	malicious	Unknown	Browse
	.i.elf	Get hash	malicious	Unknown	Browse
	boatnet.mpsl.elf	Get hash	malicious	Mirai	Browse
	boatnet.arc.elf	Get hash	malicious	Mirai	Browse
	boatnet.sh4.elf	Get hash	malicious	Mirai	Browse
	most-m68k.elf	Get hash	malicious	Unknown	Browse
	sshd.elf	Get hash	malicious	Unknown	Browse
	bin.sh.elf	Get hash	malicious	Unknown	Browse
91.189.91.42	ub8ehJSePAfc9FYqZIT6.arm7.elf	Get hash	malicious	Mirai	Browse
	ub8ehJSePAfc9FYqZIT6.ppc.elf	Get hash	malicious	Unknown	Browse
	ub8ehJSePAfc9FYqZIT6.arm.elf	Get hash	malicious	Mirai	Browse
	win.elf	Get hash	malicious	Unknown	Browse
	.i.elf	Get hash	malicious	Unknown	Browse
	boatnet.mpsl.elf	Get hash	malicious	Mirai	Browse
	boatnet.arc.elf	Get hash	malicious	Mirai	Browse
	boatnet.sh4.elf	Get hash	malicious	Mirai	Browse
	most-m68k.elf	Get hash	malicious	Unknown	Browse
	sshd.elf	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	ub8ehJSePAfc9FYqZIT6.arm7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	ub8ehJSePAfc9FYqZIT6.ppc.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	ub8ehJSePAfc9FYqZIT6.arm.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	ub8ehJSePAfc9FYqZIT6.m68k.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	win.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	.i.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	boatnet.ppc.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	boatnet.mpsl.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	boatnet.arm7.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	boatnet.arc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
CANONICAL-ASGB	ub8ehJSePAfc9FYqZIT6.arm7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	ub8ehJSePAfc9FYqZIT6.ppc.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	ub8ehJSePAfc9FYqZIT6.arm.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	ub8ehJSePAfc9FYqZIT6.m68k.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	win.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	.i.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	boatnet.ppc.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	boatnet.mpsl.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	boatnet.arm7.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	boatnet.arc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
LVLT-10753US	ngwa5.elf	Get hash	malicious	Mirai	Browse	178.215.238.25
	fnkea7.elf	Get hash	malicious	Mirai	Browse	178.215.238.25
	wkb86.elf	Get hash	malicious	Mirai	Browse	178.215.238.25
	wlw68k.elf	Get hash	malicious	Mirai	Browse	178.215.238.25
	njvwa4.elf	Get hash	malicious	Mirai	Browse	178.215.238.25
	wrjkngh4.elf	Get hash	malicious	Mirai	Browse	178.215.238.25
	gnjqwpc.elf	Get hash	malicious	Mirai	Browse	178.215.238.25
	armv6l.elf	Get hash	malicious	Mirai	Browse	217.22.7.57
	m68k.elf	Get hash	malicious	Mirai, Moobot	Browse	94.154.174.150
	nshmpsl.elf	Get hash	malicious	Mirai	Browse	45.129.149.6
INIT7CH	ub8ehJSePAfc9FYqZIT6.arm7.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	ub8ehJSePAfc9FYqZIT6.ppc.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	ub8ehJSePAfc9FYqZIT6.arm.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	win.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	.i.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	boatnet.mpsl.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	boatnet.arc.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	boatnet.sh4.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	most-m68k.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	sshd.elf	Get hash	malicious	Unknown	Browse	109.202.202.202

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/tmp/qemu-open.6VlIqc (deleted)

Download File

Process:	/tmp/kitsune.ppc.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	230
Entropy (8bit):	3.709552666863289
Encrypted:	false
SSDEEP:	6:iekrEcvwAsE5KlwSd4pzKaV6Lpms/a/1VCxGF:ur+m5MwSdIKaV6L1adVRF
MD5:	2E667F43AE18CD1FE3C108641708A82C
SHA1:	12B90DE2DA0FBCFE66F3D6130905E56C8D6A68D3
SHA-256:	6F721492E7A337C5B498A8F55F5EB7AC745AFF716D0B5B08EFF2C1B6B250F983
SHA-512:	D2A0EE2509154EC1098994F38BE172F98F4150399C534A04D5C675D7C05630802225019F19344CC9070C576BC465A4FEB382AC7712DE6BF25E9244B54A9DB830
Malicious:	false
Reputation:	high, very likely benign file
Preview:	Iface.Destination.Gateway .Flags.RefCnt.Use.Metric.Mask..MTU.Window.IRTT .ens160.00000000.c0a80201.0003.0.0.0.00000000.0.0.0.ens160.c0a80200.00000000.0001.0.0.0.ffffff00.0.0.0.

Static File Info

General

File type:	ELF 32-bit MSB executable, PowerPC or cisco 4500, version 1 (SYSV), statically linked, not stripped
Entropy (8bit):	6.15246133366225
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	kitsune.ppc.elf
File size:	108'983 bytes
MD5:	66d3a5620b9d444559248617f747a75e
SHA1:	72a86cf0025448e5e08eb30cc59eb79fc4fc2b04
SHA256:	01410acd4939a14877a58f268dc23185753e07ce64876c92f470973f9d4b0a47
SHA512:	2e486439cb0c23c6b7f56b6047d00a2b52179a3ba4bcccae52eb4e4350882e2e59ddaba3f9e96fba6c727b6970da5c4eb9774f8bc472331e24abf11c5799cfae
SSDEEP:	3072:gQiBqcL95J6qEWLE3Sj5h7wLYm7ArEfT3n:gQiBClWLn5hkEm7ArEfT3n
TLSH:	27B34C03A3190F43D5CB49B02DEB27F143AAE9E112B36182A61EAF9457B37791153F86
File Content Preview:	.ELF...........................4..O......4. ...(......................>h..>h..............@...@...@.......t...............@T..@T..@T................dt.Q.............................!..\|......$H...H......$8!. \|...N.. .!..\|.......?.........D,..../...@..`= .

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	PowerPC
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x10000218
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	4
Section Header Offset:	85932
Section Header Size:	40
Number of Section Headers:	19
Header String Table Index:	16

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x100000b4	0xb4	0x24	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x100000d8	0xd8	0xfa1c	0x0	0x6	AX	0	0	4
.fini	PROGBITS	0x1000faf4	0xfaf4	0x20	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x1000fb18	0xfb18	0x4350	0x0	0x2	A	0	0	8
.eh_frame	PROGBITS	0x10024000	0x14000	0x54	0x0	0x3	WA	0	0	4
.tbss	NOBITS	0x10024054	0x14054	0x8	0x0	0x403	WAT	0	0	4
.ctors	PROGBITS	0x10024054	0x14054	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x1002405c	0x1405c	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x10024064	0x14064	0x4	0x0	0x3	WA	0	0	4
.data	PROGBITS	0x10024068	0x14068	0x2c2	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x1002432c	0x1432c	0x10	0x4	0x7	WAX	0	0	4
.sdata	PROGBITS	0x1002433c	0x1433c	0x56	0x0	0x3	WA	0	0	4
.sbss	NOBITS	0x10024398	0x14392	0x94	0x0	0x3	WA	0	0	8
.bss	NOBITS	0x1002442c	0x14392	0x708c	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x14392	0xb9a	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x14f2c	0x7e	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x152a4	0x30e0	0x10	0x0		18	281	4
.strtab	STRTAB	0x0	0x18384	0x2633	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x10000000	0x10000000	0x13e68	0x13e68	6.2418	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x14000	0x10024000	0x10024000	0x392	0x74b8	4.5409	0x7	RWE	0x10000	.eh_frame .tbss .ctors .dtors .jcr .data .got .sdata .sbss .bss
TLS	0x14054	0x10024054	0x10024054	0x0	0x8	0.0000	0x4	R	0x4	.tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x100000b4	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x100000d8	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x1000faf4	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x1000fb18	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x10024000	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x10024054	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x10024054	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x1002405c	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x10024064	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x10024068	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x1002432c	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x1002433c	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x10024398	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x1002442c	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
C.3.5322	.symtab	0x100139dc	12	OBJECT	<unknown>	DEFAULT	4
C.3.6030	.symtab	0x10012980	12	OBJECT	<unknown>	DEFAULT	4
C.3.6052	.symtab	0x10013d24	12	OBJECT	<unknown>	DEFAULT	4
C.3.6106	.symtab	0x10013d18	12	OBJECT	<unknown>	DEFAULT	4
C.4.5416	.symtab	0x10013d00	24	OBJECT	<unknown>	DEFAULT	4
C.4.6053	.symtab	0x10013d30	12	OBJECT	<unknown>	DEFAULT	4
C.6.6061	.symtab	0x10013d3c	12	OBJECT	<unknown>	DEFAULT	4
C.69.5522	.symtab	0x100111e0	104	OBJECT	<unknown>	DEFAULT	4
C.7.5462	.symtab	0x100139e8	12	OBJECT	<unknown>	DEFAULT	4
C.76.5621	.symtab	0x10011e74	1128	OBJECT	<unknown>	DEFAULT	4
Q	.symtab	0x10024448	16384	OBJECT	<unknown>	DEFAULT	14
Randhex	.symtab	0x100022a4	424	FUNC	<unknown>	DEFAULT	2
SendSTD	.symtab	0x10001e64	424	FUNC	<unknown>	DEFAULT	2
UDPRAW	.symtab	0x10002158	332	FUNC	<unknown>	DEFAULT	2
_Exit	.symtab	0x100047b8	92	FUNC	<unknown>	DEFAULT	2
_GLOBAL_OFFSET_TABLE_	.symtab	0x10024330	0	OBJECT	<unknown>	HIDDEN	11
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_SDA_BASE_	.symtab	0x1002c33c	0	NOTYPE	<unknown>	DEFAULT	12
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x10024058	0	OBJECT	<unknown>	DEFAULT	7
__CTOR_LIST__	.symtab	0x10024054	0	OBJECT	<unknown>	DEFAULT	7
__C_ctype_b	.symtab	0x10024348	4	OBJECT	<unknown>	DEFAULT	12
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x10012380	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x10024368	4	OBJECT	<unknown>	DEFAULT	12
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x100139fe	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x10024350	4	OBJECT	<unknown>	DEFAULT	12
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x10012680	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x10024060	0	OBJECT	<unknown>	DEFAULT	8
__DTOR_LIST__	.symtab	0x1002405c	0	OBJECT	<unknown>	DEFAULT	8
__EH_FRAME_BEGIN__	.symtab	0x10024000	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x10024050	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x10024348	4	OBJECT	<unknown>	HIDDEN	12
__GI___C_ctype_tolower	.symtab	0x10024368	4	OBJECT	<unknown>	HIDDEN	12
__GI___C_ctype_toupper	.symtab	0x10024350	4	OBJECT	<unknown>	HIDDEN	12
__GI___close	.symtab	0x10008da8	116	FUNC	<unknown>	HIDDEN	2
__GI___close_nocancel	.symtab	0x10008db4	16	FUNC	<unknown>	HIDDEN	2
__GI___ctype_b	.symtab	0x1002434c	4	OBJECT	<unknown>	HIDDEN	12
__GI___ctype_tolower	.symtab	0x1002436c	4	OBJECT	<unknown>	HIDDEN	12
__GI___ctype_toupper	.symtab	0x10024354	4	OBJECT	<unknown>	HIDDEN	12
__GI___errno_location	.symtab	0x100049b4	20	FUNC	<unknown>	HIDDEN	2
__GI___fcntl_nocancel	.symtab	0x10004658	116	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x1000bcc0	312	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x100062c4	48	FUNC	<unknown>	HIDDEN	2
__GI___libc_close	.symtab	0x10008da8	116	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x100046cc	236	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x10008e1c	132	FUNC	<unknown>	HIDDEN	2
__GI___libc_read	.symtab	0x10008f24	132	FUNC	<unknown>	HIDDEN	2
__GI___libc_waitpid	.symtab	0x10008fa8	132	FUNC	<unknown>	HIDDEN	2
__GI___libc_write	.symtab	0x10008ea0	132	FUNC	<unknown>	HIDDEN	2
__GI___open	.symtab	0x10008e1c	132	FUNC	<unknown>	HIDDEN	2
__GI___open_nocancel	.symtab	0x10008e28	16	FUNC	<unknown>	HIDDEN	2
__GI___read	.symtab	0x10008f24	132	FUNC	<unknown>	HIDDEN	2
__GI___read_nocancel	.symtab	0x10008f30	16	FUNC	<unknown>	HIDDEN	2
__GI___register_atfork	.symtab	0x100089dc	356	FUNC	<unknown>	HIDDEN	2
__GI___sigaddset	.symtab	0x10006bac	40	FUNC	<unknown>	HIDDEN	2
__GI___sigdelset	.symtab	0x10006bd4	40	FUNC	<unknown>	HIDDEN	2
__GI___sigismember	.symtab	0x10006b84	40	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x100091a8	144	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x10009298	100	FUNC	<unknown>	HIDDEN	2
__GI___waitpid	.symtab	0x10008fa8	132	FUNC	<unknown>	HIDDEN	2
__GI___write	.symtab	0x10008ea0	132	FUNC	<unknown>	HIDDEN	2
__GI___write_nocancel	.symtab	0x10008eac	16	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x100062f4	284	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x100047b8	92	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x10007a4c	248	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x10008064	12	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x1000d06c	52	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0x10004814	52	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x10008da8	116	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0x10009928	212	FUNC	<unknown>	HIDDEN	2
__GI_config_close	.symtab	0x1000a034	80	FUNC	<unknown>	HIDDEN	2
__GI_config_open	.symtab	0x1000a084	84	FUNC	<unknown>	HIDDEN	2
__GI_config_read	.symtab	0x10009d00	820	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x10006814	120	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x10008230	136	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x1000a200	640	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x100046cc	236	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x1000b9d8	744	FUNC	<unknown>	HIDDEN	2
__GI_fgetc	.symtab	0x1000b598	304	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x1000bcc0	312	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x1000b6c8	244	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x1000bdf8	196	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x1000a480	12	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x10008670	824	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x10005cac	92	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x1000d48c	16	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x1000d49c	404	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x1000d0d4	124	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x10005d08	192	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x1000bcc0	312	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x10009668	56	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x100096a0	16	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x100096b0	16	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x100096c0	16	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname	.symtab	0x10006790	8	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2	.symtab	0x10006798	72	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2_r	.symtab	0x1000c574	664	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x1000ef7c	748	FUNC	<unknown>	HIDDEN	2
__GI_gethostname	.symtab	0x1000f2c0	136	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x100096d0	28	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x10008b40	56	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x100096ec	52	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x1000688c	52	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x10009720	16	FUNC	<unknown>	HIDDEN	2
__GI_htonl	.symtab	0x100066a4	4	FUNC	<unknown>	HIDDEN	2
__GI_htons	.symtab	0x100066a8	4	FUNC	<unknown>	HIDDEN	2
__GI_inet_addr	.symtab	0x1000675c	52	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x1000c4a4	208	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa	.symtab	0x10006728	52	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa_r	.symtab	0x100066ac	124	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x1000df84	728	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x1000dc24	524	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x10007e98	236	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x10004574	228	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x1000c478	44	FUNC	<unknown>	HIDDEN	2
__GI_isspace	.symtab	0x1000497c	24	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x10004848	52	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x1000f4a4	112	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x1000bf60	264	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x10005dc8	156	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x1000bebc	164	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x1000c068	52	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x1000c09c	244	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x10005e64	144	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x10009730	52	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x1000d150	52	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x10009764	52	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x100097cc	112	FUNC	<unknown>	HIDDEN	2
__GI_ntohl	.symtab	0x1000669c	4	FUNC	<unknown>	HIDDEN	2
__GI_ntohs	.symtab	0x100066a0	4	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x10008e1c	132	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0x10009ab4	208	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x1000f37c	120	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x10008b78	148	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x10007b48	104	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x10007d18	140	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x1000d9d4	184	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x10008f24	132	FUNC	<unknown>	HIDDEN	2
__GI_readdir64	.symtab	0x10009c3c	196	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x10006928	128	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x1000983c	116	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x100048b0	136	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x100069dc	128	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x10004938	52	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x10006a5c	52	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x10007f84	224	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x1000c80c	36	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x10006ac4	192	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x100098b0	120	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x10008c0c	292	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x10006a90	52	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x100049c8	136	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x10007da4	244	FUNC	<unknown>	HIDDEN	2
__GI_stat	.symtab	0x1000f3f4	124	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x1000642c	80	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x10005ef4	256	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul	.symtab	0x1000c190	248	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x10005ff4	52	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x10005ff4	52	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x10006028	32	FUNC	<unknown>	HIDDEN	2
__GI_strcspn	.symtab	0x1000c288	96	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x1000f514	80	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x10006048	160	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x1000da8c	188	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x100060e8	236	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x1000c43c	60	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x1000c2e8	112	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x1000c358	72	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x100061d4	240	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x1000647c	12	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x1000c3a0	156	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x10008070	8	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x10008400	624	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x10006488	156	FUNC	<unknown>	HIDDEN	2
__GI_tcsetattr	.symtab	0x10006524	376	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x1000496c	16	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x10004994	32	FUNC	<unknown>	HIDDEN	2
__GI_uname	.symtab	0x1000f470	52	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x10004a50	224	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x10008fa8	132	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x1000a0d8	92	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x1000a144	188	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x1000a134	16	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x10008ea0	132	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x10024064	0	OBJECT	<unknown>	DEFAULT	9
__JCR_LIST__	.symtab	0x10024064	0	OBJECT	<unknown>	DEFAULT	9
__app_fini	.symtab	0x100243dc	4	OBJECT	<unknown>	HIDDEN	13
__atexit_lock	.symtab	0x10024244	24	OBJECT	<unknown>	DEFAULT	10
__bss_start	.symtab	0x10024392	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x10009238	96	FUNC	<unknown>	DEFAULT	2
__close	.symtab	0x10008da8	116	FUNC	<unknown>	DEFAULT	2
__close_nameservers	.symtab	0x1000ee94	144	FUNC	<unknown>	HIDDEN	2
__close_nocancel	.symtab	0x10008db4	16	FUNC	<unknown>	DEFAULT	2
__ctype_b	.symtab	0x1002434c	4	OBJECT	<unknown>	DEFAULT	12
__ctype_tolower	.symtab	0x1002436c	4	OBJECT	<unknown>	DEFAULT	12
__ctype_toupper	.symtab	0x10024354	4	OBJECT	<unknown>	DEFAULT	12
__curbrk	.symtab	0x10024414	4	OBJECT	<unknown>	DEFAULT	13
__data_start	.symtab	0x10024070	0	NOTYPE	<unknown>	DEFAULT	10
__decode_dotted	.symtab	0x1000e25c	280	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x1000f64c	188	FUNC	<unknown>	HIDDEN	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__dns_lookup	.symtab	0x1000e374	1672	FUNC	<unknown>	HIDDEN	2
__do_global_ctors_aux	.symtab	0x1000fa88	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x100000d8	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x10024068	0	OBJECT	<unknown>	HIDDEN	10
__encode_dotted	.symtab	0x1000f9bc	204	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x1000f564	232	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x1000f708	124	FUNC	<unknown>	HIDDEN	2
__environ	.symtab	0x100243d4	4	OBJECT	<unknown>	DEFAULT	13
__errno_location	.symtab	0x100049b4	20	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x100243c0	4	OBJECT	<unknown>	HIDDEN	13
__fcntl_nocancel	.symtab	0x10004658	116	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x1000bcc0	312	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x10024054	0	NOTYPE	<unknown>	HIDDEN	6
__fini_array_start	.symtab	0x10024054	0	NOTYPE	<unknown>	HIDDEN	6
__fork	.symtab	0x10008670	824	FUNC	<unknown>	DEFAULT	2
__fork_generation_pointer	.symtab	0x100243c4	4	OBJECT	<unknown>	HIDDEN	13
__fork_handlers	.symtab	0x100243c8	4	OBJECT	<unknown>	HIDDEN	13
__fork_lock	.symtab	0x100243cc	4	OBJECT	<unknown>	HIDDEN	13
__get_hosts_byname_r	.symtab	0x1000ef24	88	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x1000d334	344	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x100096d0	28	FUNC	<unknown>	DEFAULT	2
__getpid	.symtab	0x10008b40	56	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x100062c4	48	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__h_errno_location	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__init_array_end	.symtab	0x10024054	0	NOTYPE	<unknown>	HIDDEN	6
__init_array_start	.symtab	0x10024054	0	NOTYPE	<unknown>	HIDDEN	6
__libc_close	.symtab	0x10008da8	116	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x10006814	120	FUNC	<unknown>	DEFAULT	2
__libc_disable_asynccancel	.symtab	0x1000902c	124	FUNC	<unknown>	HIDDEN	2
__libc_enable_asynccancel	.symtab	0x100090a8	172	FUNC	<unknown>	HIDDEN	2
__libc_errno	.symtab	0x0	4	TLS	<unknown>	HIDDEN	6
__libc_fcntl	.symtab	0x100046cc	236	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x10008670	824	FUNC	<unknown>	DEFAULT	2
__libc_h_errno	.symtab	0x4	4	TLS	<unknown>	HIDDEN	6
__libc_nanosleep	.symtab	0x100097cc	112	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x10008e1c	132	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x10008f24	132	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x10006928	128	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x100048b0	136	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x100069dc	128	FUNC	<unknown>	DEFAULT	2
__libc_setup_tls	.symtab	0x1000cd5c	464	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x1000c80c	36	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x100243d0	4	OBJECT	<unknown>	DEFAULT	13
__libc_waitpid	.symtab	0x10008fa8	132	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x10008ea0	132	FUNC	<unknown>	DEFAULT	2
__linkin_atfork	.symtab	0x100089a8	52	FUNC	<unknown>	HIDDEN	2
__lll_lock_wait_private	.symtab	0x10008d30	120	FUNC	<unknown>	HIDDEN	2
__local_nameserver	.symtab	0x10013df0	16	OBJECT	<unknown>	HIDDEN	4
__malloc_consolidate	.symtab	0x10007634	460	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x10006bfc	112	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x10024168	24	OBJECT	<unknown>	DEFAULT	10
__malloc_state	.symtab	0x1002b140	888	OBJECT	<unknown>	DEFAULT	14
__malloc_trim	.symtab	0x1000757c	184	FUNC	<unknown>	DEFAULT	2
__nameserver	.symtab	0x10024420	4	OBJECT	<unknown>	HIDDEN	13
__nameservers	.symtab	0x10024424	4	OBJECT	<unknown>	HIDDEN	13
__nptl_deallocate_tsd	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__nptl_nthreads	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__open	.symtab	0x10008e1c	132	FUNC	<unknown>	DEFAULT	2
__open_etc_hosts	.symtab	0x1000f784	12	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x1000ea80	1044	FUNC	<unknown>	HIDDEN	2
__open_nocancel	.symtab	0x10008e28	16	FUNC	<unknown>	DEFAULT	2
__pagesize	.symtab	0x100243d8	4	OBJECT	<unknown>	DEFAULT	13
__preinit_array_end	.symtab	0x10024054	0	NOTYPE	<unknown>	HIDDEN	6
__preinit_array_start	.symtab	0x10024054	0	NOTYPE	<unknown>	HIDDEN	6
__progname	.symtab	0x10024360	4	OBJECT	<unknown>	DEFAULT	12
__progname_full	.symtab	0x10024364	4	OBJECT	<unknown>	DEFAULT	12
__pthread_initialize_minimal	.symtab	0x1000cf2c	12	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_init	.symtab	0x1000915c	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x10009154	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x10009154	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x10009154	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x10009154	8	FUNC	<unknown>	DEFAULT	2
__pthread_unwind	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__read	.symtab	0x10008f24	132	FUNC	<unknown>	DEFAULT	2
__read_etc_hosts_r	.symtab	0x1000f790	556	FUNC	<unknown>	HIDDEN	2
__read_nocancel	.symtab	0x10008f30	16	FUNC	<unknown>	DEFAULT	2
__register_atfork	.symtab	0x100089dc	356	FUNC	<unknown>	DEFAULT	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__res_sync	.symtab	0x10024418	4	OBJECT	<unknown>	HIDDEN	13
__resolv_attempts	.symtab	0x10024391	1	OBJECT	<unknown>	HIDDEN	12
__resolv_lock	.symtab	0x1002b0d8	24	OBJECT	<unknown>	DEFAULT	14
__resolv_timeout	.symtab	0x10024390	1	OBJECT	<unknown>	HIDDEN	12
__rtld_fini	.symtab	0x100243e0	4	OBJECT	<unknown>	HIDDEN	13
__searchdomain	.symtab	0x1002441c	4	OBJECT	<unknown>	HIDDEN	13
__searchdomains	.symtab	0x10024428	4	OBJECT	<unknown>	HIDDEN	13
__sigaddset	.symtab	0x10006bac	40	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x10006bd4	40	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x10006b84	40	FUNC	<unknown>	DEFAULT	2
__sigjmp_save	.symtab	0x1000f268	88	FUNC	<unknown>	HIDDEN	2
__sigsetjmp	.symtab	0x1000cfc0	172	FUNC	<unknown>	DEFAULT	2
__stdin	.symtab	0x1002437c	4	OBJECT	<unknown>	DEFAULT	12
__stdio_READ	.symtab	0x1000d630	120	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x1000d6a8	264	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x1000d7b0	212	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x1000a874	364	FUNC	<unknown>	HIDDEN	2
__stdio_rfill	.symtab	0x1000d884	72	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x1000d97c	88	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x1000d8cc	176	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x1000ab9c	260	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x1000aca0	76	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x10024380	4	OBJECT	<unknown>	DEFAULT	12
__sys_connect	.symtab	0x100067e0	52	FUNC	<unknown>	DEFAULT	2
__sys_recv	.symtab	0x100068f4	52	FUNC	<unknown>	DEFAULT	2
__sys_send	.symtab	0x100069a8	52	FUNC	<unknown>	DEFAULT	2
__syscall_error	.symtab	0x10009644	28	FUNC	<unknown>	HIDDEN	2
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_nanosleep	.symtab	0x10009798	52	FUNC	<unknown>	DEFAULT	2
__syscall_poll	.symtab	0x1000f348	52	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction	.symtab	0x1000d0a0	52	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_select	.symtab	0x1000487c	52	FUNC	<unknown>	DEFAULT	2
__uClibc_fini	.symtab	0x100091a8	144	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x10009298	100	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x100092fc	840	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x1002435c	4	OBJECT	<unknown>	HIDDEN	12
__waitpid	.symtab	0x10008fa8	132	FUNC	<unknown>	DEFAULT	2
__waitpid_nocancel	.symtab	0x10008fb4	16	FUNC	<unknown>	DEFAULT	2
__write	.symtab	0x10008ea0	132	FUNC	<unknown>	DEFAULT	2
__write_nocancel	.symtab	0x10008eac	16	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r	.symtab	0x100062f4	284	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__xstat32_conv	.symtab	0x1000d268	204	FUNC	<unknown>	HIDDEN	2
__xstat64_conv	.symtab	0x1000d184	228	FUNC	<unknown>	HIDDEN	2
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_bss_custom_printf_spec	.symtab	0x10028448	10	OBJECT	<unknown>	DEFAULT	14
_charpad	.symtab	0x10004b30	100	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_custom_printf_arginfo	.symtab	0x1002b0f0	40	OBJECT	<unknown>	HIDDEN	14
_custom_printf_handler	.symtab	0x1002b118	40	OBJECT	<unknown>	HIDDEN	14
_custom_printf_spec	.symtab	0x10024358	4	OBJECT	<unknown>	HIDDEN	12
_dl_aux_init	.symtab	0x1000cf38	28	FUNC	<unknown>	DEFAULT	2
_dl_init_static_tls	.symtab	0x1002438c	4	OBJECT	<unknown>	DEFAULT	12
_dl_nothread_init_static_tls	.symtab	0x1000cf54	108	FUNC	<unknown>	HIDDEN	2
_dl_phdr	.symtab	0x1002440c	4	OBJECT	<unknown>	DEFAULT	13
_dl_phnum	.symtab	0x10024410	4	OBJECT	<unknown>	DEFAULT	13
_dl_tls_dtv_gaps	.symtab	0x10024400	1	OBJECT	<unknown>	DEFAULT	13
_dl_tls_dtv_slotinfo_list	.symtab	0x100243fc	4	OBJECT	<unknown>	DEFAULT	13
_dl_tls_generation	.symtab	0x10024404	4	OBJECT	<unknown>	DEFAULT	13
_dl_tls_max_dtv_idx	.symtab	0x100243f4	4	OBJECT	<unknown>	DEFAULT	13
_dl_tls_setup	.symtab	0x1000cd0c	80	FUNC	<unknown>	DEFAULT	2
_dl_tls_static_align	.symtab	0x100243f0	4	OBJECT	<unknown>	DEFAULT	13
_dl_tls_static_nelem	.symtab	0x10024408	4	OBJECT	<unknown>	DEFAULT	13
_dl_tls_static_size	.symtab	0x100243f8	4	OBJECT	<unknown>	DEFAULT	13
_dl_tls_static_used	.symtab	0x100243ec	4	OBJECT	<unknown>	DEFAULT	13
_edata	.symtab	0x10024392	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x1002b4b8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_exit	.symtab	0x100047b8	92	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x1000faf4	0	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x10028b94	8192	OBJECT	<unknown>	DEFAULT	14
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x10004b94	152	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x1000aea0	1784	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_init	.symtab	0x100000b4	0	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x1000acec	128	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_init	.symtab	0x10005324	188	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x100056dc	1488	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x100053e0	92	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x1000543c	608	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x1000569c	64	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x10009170	56	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x10009164	12	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_setjmp	.symtab	0x10009660	8	FUNC	<unknown>	DEFAULT	2
_sigintr	.symtab	0x100243b8	8	OBJECT	<unknown>	HIDDEN	13
_start	.symtab	0x10000218	72	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x1000a48c	1000	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x1000a9e0	128	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x10024384	4	OBJECT	<unknown>	DEFAULT	12
_stdio_openlist_add_lock	.symtab	0x10028b7c	12	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_dec_use	.symtab	0x1000b7bc	540	FUNC	<unknown>	HIDDEN	2
_stdio_openlist_del_count	.symtab	0x100243e8	4	OBJECT	<unknown>	DEFAULT	13
_stdio_openlist_del_lock	.symtab	0x10028b88	12	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_use_count	.symtab	0x100243e4	4	OBJECT	<unknown>	DEFAULT	13
_stdio_streams	.symtab	0x1002425c	204	OBJECT	<unknown>	DEFAULT	10
_stdio_term	.symtab	0x1000aa60	316	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x10024388	4	OBJECT	<unknown>	DEFAULT	12
_stdlib_strto_l	.symtab	0x10008078	440	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x1000ad6c	60	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x10012a4c	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x1000ada8	248	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x10004c2c	1784	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x10007a4c	248	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
atoi	.symtab	0x10008064	12	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x10008064	12	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bcopy	.symtab	0x10006410	16	FUNC	<unknown>	DEFAULT	2
bcopy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
been_there_done_that	.symtab	0x10028634	4	OBJECT	<unknown>	DEFAULT	14
bot.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
brk	.symtab	0x1000d06c	52	FUNC	<unknown>	DEFAULT	2
bsd_signal	.symtab	0x10006ac4	192	FUNC	<unknown>	DEFAULT	2
buf.4826	.symtab	0x10028458	16	OBJECT	<unknown>	DEFAULT	14
buf.6501	.symtab	0x1002847c	440	OBJECT	<unknown>	DEFAULT	14
bzero	.symtab	0x10006420	12	FUNC	<unknown>	DEFAULT	2
bzero.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
c	.symtab	0x10024160	4	OBJECT	<unknown>	DEFAULT	10
call___do_global_ctors_aux	.symtab	0x1000fad8	0	FUNC	<unknown>	DEFAULT	2
call___do_global_dtors_aux	.symtab	0x10000170	0	FUNC	<unknown>	DEFAULT	2
call_frame_dummy	.symtab	0x100001fc	0	FUNC	<unknown>	DEFAULT	2
calloc	.symtab	0x1000c830	264	FUNC	<unknown>	DEFAULT	2
calloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
chdir	.symtab	0x10004814	52	FUNC	<unknown>	DEFAULT	2
chdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x10008da8	116	FUNC	<unknown>	DEFAULT	2
closedir	.symtab	0x10009928	212	FUNC	<unknown>	DEFAULT	2
closedir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
closenameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
commServer	.symtab	0x1002433c	4	OBJECT	<unknown>	DEFAULT	12
completed.5580	.symtab	0x1002442c	0	OBJECT	<unknown>	DEFAULT	14
connect	.symtab	0x10006814	120	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connectTimeout	.symtab	0x100018c0	656	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
currentServer	.symtab	0x10024344	4	OBJECT	<unknown>	DEFAULT	12
data_start	.symtab	0x10024070	0	NOTYPE	<unknown>	DEFAULT	10
decoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dns	.symtab	0x10024340	4	OBJECT	<unknown>	DEFAULT	12
dnslookup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ	.symtab	0x100243d4	4	OBJECT	<unknown>	DEFAULT	13
errno	.symtab	0x0	4	TLS	<unknown>	DEFAULT	6
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x10008230	136	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x10013d60	72	OBJECT	<unknown>	DEFAULT	4
fclose	.symtab	0x1000a200	640	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x100046cc	236	FUNC	<unknown>	DEFAULT	2
fd_to_DIR	.symtab	0x100099fc	184	FUNC	<unknown>	DEFAULT	2
fdgets	.symtab	0x10000510	232	FUNC	<unknown>	DEFAULT	2
fdopendir	.symtab	0x10009b84	184	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x1000b9d8	744	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc	.symtab	0x1000b598	304	FUNC	<unknown>	DEFAULT	2
fgetc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x1000bcc0	312	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x1000b6c8	244	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x1000bdf8	196	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fmt	.symtab	0x10013d48	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x1000a480	12	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0x10008670	824	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork_handler_pool	.symtab	0x10028638	1348	OBJECT	<unknown>	DEFAULT	14
fputs_unlocked	.symtab	0x10005cac	92	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x1000018c	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x10007800	524	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x1000d48c	16	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x1000d48c	16	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x1000d49c	404	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fstat	.symtab	0x1000d0d4	124	FUNC	<unknown>	DEFAULT	2
fstat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fwrite_unlocked	.symtab	0x10005d08	192	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getArch	.symtab	0x100031b8	40	FUNC	<unknown>	DEFAULT	2
getHost	.symtab	0x10001550	124	FUNC	<unknown>	DEFAULT	2
getOurIP	.symtab	0x100005f8	648	FUNC	<unknown>	DEFAULT	2
getRandomIP	.symtab	0x100004a0	112	FUNC	<unknown>	DEFAULT	2
get_hosts_byname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getc	.symtab	0x1000b598	304	FUNC	<unknown>	DEFAULT	2
getc_unlocked	.symtab	0x1000bcc0	312	FUNC	<unknown>	DEFAULT	2
getdents64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdtablesize	.symtab	0x10009668	56	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x100096a0	16	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x100096b0	16	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x100096c0	16	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname	.symtab	0x10006790	8	FUNC	<unknown>	DEFAULT	2
gethostbyname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname2	.symtab	0x10006798	72	FUNC	<unknown>	DEFAULT	2
gethostbyname2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname2_r	.symtab	0x1000c574	664	FUNC	<unknown>	DEFAULT	2
gethostbyname2_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r	.symtab	0x1000ef7c	748	FUNC	<unknown>	DEFAULT	2
gethostbyname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostname	.symtab	0x1000f2c0	136	FUNC	<unknown>	DEFAULT	2
gethostname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpagesize	.symtab	0x100096d0	28	FUNC	<unknown>	DEFAULT	2
getpagesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x10008b40	56	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x100096ec	52	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockname	.symtab	0x1000688c	52	FUNC	<unknown>	DEFAULT	2
getsockname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x100068c0	52	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x10009720	16	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
h_errno	.symtab	0x4	4	TLS	<unknown>	DEFAULT	6
hoste.6500	.symtab	0x10028468	20	OBJECT	<unknown>	DEFAULT	14
htonl	.symtab	0x100066a4	4	FUNC	<unknown>	DEFAULT	2
htons	.symtab	0x100066a8	4	FUNC	<unknown>	DEFAULT	2
i.4865	.symtab	0x10024164	4	OBJECT	<unknown>	DEFAULT	10
index	.symtab	0x10005ef4	256	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x1000675c	52	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x1000c4a4	208	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa	.symtab	0x10006728	52	FUNC	<unknown>	DEFAULT	2
inet_ntoa.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa_r	.symtab	0x100066ac	124	FUNC	<unknown>	DEFAULT	2
inet_ntop	.symtab	0x1000df84	728	FUNC	<unknown>	DEFAULT	2
inet_ntop4	.symtab	0x1000de30	340	FUNC	<unknown>	DEFAULT	2
inet_pton	.symtab	0x1000dc24	524	FUNC	<unknown>	DEFAULT	2
inet_pton4	.symtab	0x1000db48	220	FUNC	<unknown>	DEFAULT	2
initConnection	.symtab	0x10003bd0	412	FUNC	<unknown>	DEFAULT	2
init_rand	.symtab	0x10000260	232	FUNC	<unknown>	DEFAULT	2
init_static_tls	.symtab	0x1000ccd0	60	FUNC	<unknown>	DEFAULT	2
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initstate	.symtab	0x10007c2c	132	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x10007e98	236	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x10004574	228	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isatty	.symtab	0x1000c478	44	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isspace	.symtab	0x1000497c	24	FUNC	<unknown>	DEFAULT	2
isspace.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0x10004848	52	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
last_id.6558	.symtab	0x10024328	2	OBJECT	<unknown>	DEFAULT	10
last_ns_num.6557	.symtab	0x1002b0d0	4	OBJECT	<unknown>	DEFAULT	14
libc-cancellation.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc-lowlevellock.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc-tls.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
listFork	.symtab	0x10001b50	460	FUNC	<unknown>	DEFAULT	2
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x1000f4a4	112	FUNC	<unknown>	DEFAULT	2
macAddress	.symtab	0x100243a8	6	OBJECT	<unknown>	DEFAULT	13
main	.symtab	0x10003d6c	2056	FUNC	<unknown>	DEFAULT	2
mainCommSock	.symtab	0x10024398	4	OBJECT	<unknown>	DEFAULT	13
malloc	.symtab	0x10006c6c	2320	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
malloc_trim	.symtab	0x10007a0c	64	FUNC	<unknown>	DEFAULT	2
memchr	.symtab	0x1000bf60	264	FUNC	<unknown>	DEFAULT	2
memchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memcpy	.symtab	0x10005dc8	156	FUNC	<unknown>	DEFAULT	2
memcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memmove	.symtab	0x1000bebc	164	FUNC	<unknown>	DEFAULT	2
memmove.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mempcpy	.symtab	0x1000c068	52	FUNC	<unknown>	DEFAULT	2
mempcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memrchr	.symtab	0x1000c09c	244	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x10005e64	144	FUNC	<unknown>	DEFAULT	2
memset.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mmap	.symtab	0x10009730	52	FUNC	<unknown>	DEFAULT	2
mmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mremap	.symtab	0x1000d150	52	FUNC	<unknown>	DEFAULT	2
mremap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
munmap	.symtab	0x10009764	52	FUNC	<unknown>	DEFAULT	2
munmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mylock	.symtab	0x10024180	24	OBJECT	<unknown>	DEFAULT	10
mylock	.symtab	0x10024198	24	OBJECT	<unknown>	DEFAULT	10
nanosleep	.symtab	0x100097cc	112	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
next_start.1347	.symtab	0x10028454	4	OBJECT	<unknown>	DEFAULT	14
nprocessors_onln	.symtab	0x100082b8	328	FUNC	<unknown>	DEFAULT	2
ntohl	.symtab	0x1000669c	4	FUNC	<unknown>	DEFAULT	2
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0x100066a0	4	FUNC	<unknown>	DEFAULT	2
ntop.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
numpids	.symtab	0x100243a0	8	OBJECT	<unknown>	DEFAULT	13
object.5595	.symtab	0x10024430	0	OBJECT	<unknown>	DEFAULT	14
open	.symtab	0x10008e1c	132	FUNC	<unknown>	DEFAULT	2
opendir	.symtab	0x10009ab4	208	FUNC	<unknown>	DEFAULT	2
opendir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opennameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ourIP	.symtab	0x100243b0	4	OBJECT	<unknown>	DEFAULT	13
ovhl7	.symtab	0x1000244c	3436	FUNC	<unknown>	DEFAULT	2
p.5578	.symtab	0x1002406c	0	OBJECT	<unknown>	DEFAULT	10
parse_config.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pids	.symtab	0x100243b4	4	OBJECT	<unknown>	DEFAULT	13
poll	.symtab	0x1000f37c	120	FUNC	<unknown>	DEFAULT	2
poll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prefix.6256	.symtab	0x10012994	12	OBJECT	<unknown>	DEFAULT	4
print	.symtab	0x10000e00	1568	FUNC	<unknown>	DEFAULT	2
printchar	.symtab	0x100009dc	128	FUNC	<unknown>	DEFAULT	2
printi	.symtab	0x10000c00	512	FUNC	<unknown>	DEFAULT	2
prints	.symtab	0x10000a5c	420	FUNC	<unknown>	DEFAULT	2
processCmd	.symtab	0x100031e0	2544	FUNC	<unknown>	DEFAULT	2
program_invocation_name	.symtab	0x10024364	4	OBJECT	<unknown>	DEFAULT	12
program_invocation_short_name	.symtab	0x10024360	4	OBJECT	<unknown>	DEFAULT	12
qual_chars.6264	.symtab	0x100129dc	20	OBJECT	<unknown>	DEFAULT	4
raise	.symtab	0x10008b78	148	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x10007b44	4	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand_cmwc	.symtab	0x10000348	344	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x10007b48	104	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x100135a8	40	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x10007d18	140	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randtbl	.symtab	0x100241c4	128	OBJECT	<unknown>	DEFAULT	10
rawmemchr	.symtab	0x1000d9d4	184	FUNC	<unknown>	DEFAULT	2
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read	.symtab	0x10008f24	132	FUNC	<unknown>	DEFAULT	2
read_etc_hosts_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
readdir64	.symtab	0x10009c3c	196	FUNC	<unknown>	DEFAULT	2
readdir64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
realloc	.symtab	0x1000c938	920	FUNC	<unknown>	DEFAULT	2
realloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recv	.symtab	0x10006928	128	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recvLine	.symtab	0x100015cc	756	FUNC	<unknown>	DEFAULT	2
register-atfork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
resolv_conf_mtime.6540	.symtab	0x1002b0d4	4	OBJECT	<unknown>	DEFAULT	14
rindex	.symtab	0x1000c2e8	112	FUNC	<unknown>	DEFAULT	2
sbrk	.symtab	0x1000983c	116	FUNC	<unknown>	DEFAULT	2
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
select	.symtab	0x100048b0	136	FUNC	<unknown>	DEFAULT	2
select.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send	.symtab	0x100069dc	128	FUNC	<unknown>	DEFAULT	2
send.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsid	.symtab	0x10004938	52	FUNC	<unknown>	DEFAULT	2
setsid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsockopt	.symtab	0x10006a5c	52	FUNC	<unknown>	DEFAULT	2
setsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate	.symtab	0x10007bb0	124	FUNC	<unknown>	DEFAULT	2
setstate_r	.symtab	0x10007f84	224	FUNC	<unknown>	DEFAULT	2
sigaction	.symtab	0x1000c80c	36	FUNC	<unknown>	DEFAULT	2
sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigjmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
signal	.symtab	0x10006ac4	192	FUNC	<unknown>	DEFAULT	2
signal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigprocmask	.symtab	0x100098b0	120	FUNC	<unknown>	DEFAULT	2
sigprocmask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigsetops.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
skip_and_NUL_space	.symtab	0x1000ea3c	68	FUNC	<unknown>	DEFAULT	2
skip_nospace	.symtab	0x1000e9fc	64	FUNC	<unknown>	DEFAULT	2
sleep	.symtab	0x10008c0c	292	FUNC	<unknown>	DEFAULT	2
sleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket	.symtab	0x10006a90	52	FUNC	<unknown>	DEFAULT	2
socket.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket_connect	.symtab	0x10001d1c	328	FUNC	<unknown>	DEFAULT	2
sockprintf	.symtab	0x10001420	304	FUNC	<unknown>	DEFAULT	2
spec_and_mask.6263	.symtab	0x10012a0a	16	OBJECT	<unknown>	DEFAULT	4
spec_base.6255	.symtab	0x1001298c	7	OBJECT	<unknown>	DEFAULT	4
spec_chars.6260	.symtab	0x10012a1c	21	OBJECT	<unknown>	DEFAULT	4
spec_flags.6259	.symtab	0x10012a34	8	OBJECT	<unknown>	DEFAULT	4
spec_or_mask.6262	.symtab	0x100129fa	16	OBJECT	<unknown>	DEFAULT	4
spec_ranges.6261	.symtab	0x100129f0	9	OBJECT	<unknown>	DEFAULT	4
sprintf	.symtab	0x100049c8	136	FUNC	<unknown>	DEFAULT	2
sprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
srand	.symtab	0x10007cb0	104	FUNC	<unknown>	DEFAULT	2
srandom	.symtab	0x10007cb0	104	FUNC	<unknown>	DEFAULT	2
srandom_r	.symtab	0x10007da4	244	FUNC	<unknown>	DEFAULT	2
stat	.symtab	0x1000f3f4	124	FUNC	<unknown>	DEFAULT	2
stat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
static_dtv	.symtab	0x1002ae9c	512	OBJECT	<unknown>	DEFAULT	14
static_map	.symtab	0x1002b09c	52	OBJECT	<unknown>	DEFAULT	14
static_slotinfo	.symtab	0x1002ab94	776	OBJECT	<unknown>	DEFAULT	14
stderr	.symtab	0x10024378	4	OBJECT	<unknown>	DEFAULT	12
stdin	.symtab	0x10024370	4	OBJECT	<unknown>	DEFAULT	12
stdout	.symtab	0x10024374	4	OBJECT	<unknown>	DEFAULT	12
strcasecmp	.symtab	0x1000642c	80	FUNC	<unknown>	DEFAULT	2
strcasecmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchr	.symtab	0x10005ef4	256	FUNC	<unknown>	DEFAULT	2
strchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchrnul	.symtab	0x1000c190	248	FUNC	<unknown>	DEFAULT	2
strchrnul.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcmp	.symtab	0x10005ff4	52	FUNC	<unknown>	DEFAULT	2
strcmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcoll	.symtab	0x10005ff4	52	FUNC	<unknown>	DEFAULT	2
strcpy	.symtab	0x10006028	32	FUNC	<unknown>	DEFAULT	2
strcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcspn	.symtab	0x1000c288	96	FUNC	<unknown>	DEFAULT	2
strcspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strdup	.symtab	0x1000f514	80	FUNC	<unknown>	DEFAULT	2
strdup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strerror_r	.symtab	0x100062f4	284	FUNC	<unknown>	DEFAULT	2
strlen	.symtab	0x10006048	160	FUNC	<unknown>	DEFAULT	2
strlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncpy	.symtab	0x1000da8c	188	FUNC	<unknown>	DEFAULT	2
strncpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strnlen	.symtab	0x100060e8	236	FUNC	<unknown>	DEFAULT	2
strnlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strpbrk	.symtab	0x1000c43c	60	FUNC	<unknown>	DEFAULT	2
strpbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strrchr	.symtab	0x1000c2e8	112	FUNC	<unknown>	DEFAULT	2
strrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strspn	.symtab	0x1000c358	72	FUNC	<unknown>	DEFAULT	2
strspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strstr	.symtab	0x100061d4	240	FUNC	<unknown>	DEFAULT	2
strstr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok	.symtab	0x1000647c	12	FUNC	<unknown>	DEFAULT	2
strtok.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok_r	.symtab	0x1000c3a0	156	FUNC	<unknown>	DEFAULT	2
strtok_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtol	.symtab	0x10008070	8	FUNC	<unknown>	DEFAULT	2
strtol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sysconf	.symtab	0x10008400	624	FUNC	<unknown>	DEFAULT	2
sysconf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcgetattr	.symtab	0x10006488	156	FUNC	<unknown>	DEFAULT	2
tcgetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcsetattr	.symtab	0x10006524	376	FUNC	<unknown>	DEFAULT	2
tcsetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
time	.symtab	0x1000496c	16	FUNC	<unknown>	DEFAULT	2
time.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
toupper	.symtab	0x10004994	32	FUNC	<unknown>	DEFAULT	2
toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
trim	.symtab	0x10000880	348	FUNC	<unknown>	DEFAULT	2
type_codes	.symtab	0x100129b8	24	OBJECT	<unknown>	DEFAULT	4
type_sizes	.symtab	0x100129d0	12	OBJECT	<unknown>	DEFAULT	4
uname	.symtab	0x1000f470	52	FUNC	<unknown>	DEFAULT	2
uname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
unknown.1370	.symtab	0x10012a3c	14	OBJECT	<unknown>	DEFAULT	4
unsafe_state	.symtab	0x100241b0	20	OBJECT	<unknown>	DEFAULT	10
useragents	.symtab	0x10024074	236	OBJECT	<unknown>	DEFAULT	10
vsnprintf	.symtab	0x10004a50	224	FUNC	<unknown>	DEFAULT	2
vsnprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
waitpid	.symtab	0x10008fa8	132	FUNC	<unknown>	DEFAULT	2
wcrtomb	.symtab	0x1000a0d8	92	FUNC	<unknown>	DEFAULT	2
wcrtomb.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsnrtombs	.symtab	0x1000a144	188	FUNC	<unknown>	DEFAULT	2
wcsnrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsrtombs	.symtab	0x1000a134	16	FUNC	<unknown>	DEFAULT	2
wcsrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
write	.symtab	0x10008ea0	132	FUNC	<unknown>	DEFAULT	2
xdigits.5264	.symtab	0x10013dd4	17	OBJECT	<unknown>	DEFAULT	4
xstatconv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
xtdcustom	.symtab	0x1000200c	332	FUNC	<unknown>	DEFAULT	2

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 26, 2024 22:15:50.687355042 CET	51522	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:15:50.807179928 CET	4258	51522	178.215.238.69	192.168.2.23
Dec 26, 2024 22:15:50.807245016 CET	51522	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:15:50.808389902 CET	51522	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:15:50.928066015 CET	4258	51522	178.215.238.69	192.168.2.23
Dec 26, 2024 22:15:52.869096041 CET	43928	443	192.168.2.23	91.189.91.42
Dec 26, 2024 22:15:53.053308010 CET	4258	51522	178.215.238.69	192.168.2.23
Dec 26, 2024 22:15:53.053870916 CET	51522	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:15:53.054502010 CET	51524	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:15:53.173763990 CET	4258	51522	178.215.238.69	192.168.2.23
Dec 26, 2024 22:15:53.174057961 CET	4258	51524	178.215.238.69	192.168.2.23
Dec 26, 2024 22:15:53.174204111 CET	51524	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:15:53.174491882 CET	51524	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:15:53.293962002 CET	4258	51524	178.215.238.69	192.168.2.23
Dec 26, 2024 22:15:55.428745031 CET	42516	80	192.168.2.23	109.202.202.202
Dec 26, 2024 22:15:55.533895969 CET	4258	51524	178.215.238.69	192.168.2.23
Dec 26, 2024 22:15:55.534213066 CET	51524	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:15:55.534743071 CET	51526	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:15:55.653934002 CET	4258	51524	178.215.238.69	192.168.2.23
Dec 26, 2024 22:15:55.654308081 CET	4258	51526	178.215.238.69	192.168.2.23
Dec 26, 2024 22:15:55.654544115 CET	51526	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:15:55.654544115 CET	51526	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:15:55.774234056 CET	4258	51526	178.215.238.69	192.168.2.23
Dec 26, 2024 22:15:57.912488937 CET	4258	51526	178.215.238.69	192.168.2.23
Dec 26, 2024 22:15:57.912692070 CET	51526	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:15:57.913213968 CET	51528	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:15:58.032260895 CET	4258	51526	178.215.238.69	192.168.2.23
Dec 26, 2024 22:15:58.032656908 CET	4258	51528	178.215.238.69	192.168.2.23
Dec 26, 2024 22:15:58.032721996 CET	51528	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:15:58.032766104 CET	51528	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:15:58.152719021 CET	4258	51528	178.215.238.69	192.168.2.23
Dec 26, 2024 22:15:58.500256062 CET	42836	443	192.168.2.23	91.189.91.43
Dec 26, 2024 22:16:00.319005966 CET	4258	51528	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:00.319293022 CET	51528	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:00.320128918 CET	51530	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:00.438932896 CET	4258	51528	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:00.439588070 CET	4258	51530	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:00.439806938 CET	51530	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:00.439807892 CET	51530	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:00.559441090 CET	4258	51530	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:02.730601072 CET	4258	51530	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:02.731026888 CET	51530	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:02.731686115 CET	51532	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:02.850547075 CET	4258	51530	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:02.851161003 CET	4258	51532	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:02.851319075 CET	51532	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:02.851684093 CET	51532	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:02.971138954 CET	4258	51532	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:05.100471020 CET	4258	51532	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:05.100814104 CET	51532	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:05.101495981 CET	51534	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:05.220722914 CET	4258	51532	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:05.221024990 CET	4258	51534	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:05.221154928 CET	51534	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:05.221344948 CET	51534	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:05.340760946 CET	4258	51534	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:07.491247892 CET	4258	51534	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:07.491585970 CET	51534	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:07.492206097 CET	51536	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:07.611140966 CET	4258	51534	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:07.611651897 CET	4258	51536	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:07.611804962 CET	51536	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:07.611804962 CET	51536	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:07.731339931 CET	4258	51536	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:09.866141081 CET	4258	51536	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:09.866379023 CET	51536	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:09.866806030 CET	51538	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:09.986258984 CET	4258	51536	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:09.986587048 CET	4258	51538	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:09.986736059 CET	51538	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:09.986736059 CET	51538	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:10.106779099 CET	4258	51538	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:12.256999969 CET	4258	51538	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:12.257148027 CET	51538	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:12.257622004 CET	51540	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:12.376699924 CET	4258	51538	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:12.377228022 CET	4258	51540	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:12.377286911 CET	51540	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:12.377334118 CET	51540	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:12.496859074 CET	4258	51540	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:13.090260029 CET	43928	443	192.168.2.23	91.189.91.42
Dec 26, 2024 22:16:14.665194035 CET	4258	51540	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:14.665507078 CET	51540	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:14.666230917 CET	51542	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:14.785093069 CET	4258	51540	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:14.785739899 CET	4258	51542	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:14.785867929 CET	51542	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:14.785949945 CET	51542	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:14.907609940 CET	4258	51542	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:17.147340059 CET	4258	51542	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:17.147630930 CET	51542	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:17.148297071 CET	51544	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:17.267266035 CET	4258	51542	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:17.267741919 CET	4258	51544	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:17.267812967 CET	51544	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:17.267847061 CET	51544	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:17.387516975 CET	4258	51544	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:19.524477005 CET	4258	51544	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:19.524641991 CET	51544	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:19.525146961 CET	51546	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:19.644295931 CET	4258	51544	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:19.644757032 CET	4258	51546	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:19.644826889 CET	51546	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:19.644869089 CET	51546	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:19.764451027 CET	4258	51546	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:21.897712946 CET	4258	51546	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:21.897864103 CET	51546	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:21.898355961 CET	51548	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:22.017530918 CET	4258	51546	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:22.017990112 CET	4258	51548	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:22.018050909 CET	51548	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:22.018126965 CET	51548	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:22.137764931 CET	4258	51548	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:24.272650003 CET	4258	51548	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:24.272820950 CET	51548	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:24.273643017 CET	51550	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:24.393404961 CET	4258	51548	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:24.393991947 CET	4258	51550	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:24.394094944 CET	51550	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:24.394216061 CET	51550	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:24.513894081 CET	4258	51550	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:25.376573086 CET	42836	443	192.168.2.23	91.189.91.43
Dec 26, 2024 22:16:25.376594067 CET	42516	80	192.168.2.23	109.202.202.202
Dec 26, 2024 22:16:26.647875071 CET	4258	51550	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:26.648303986 CET	51550	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:26.649303913 CET	51552	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:26.768037081 CET	4258	51550	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:26.798954964 CET	4258	51552	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:26.799031019 CET	51552	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:26.799318075 CET	51552	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:26.918839931 CET	4258	51552	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:29.121524096 CET	4258	51552	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:29.121798992 CET	51552	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:29.122870922 CET	51554	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:29.241403103 CET	4258	51552	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:29.242325068 CET	4258	51554	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:29.242396116 CET	51554	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:29.242646933 CET	51554	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:29.362131119 CET	4258	51554	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:31.491328955 CET	4258	51554	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:31.491480112 CET	51554	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:31.492074013 CET	51556	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:31.611850023 CET	4258	51554	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:31.611962080 CET	4258	51556	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:31.612021923 CET	51556	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:31.612102985 CET	51556	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:31.732048988 CET	4258	51556	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:33.866671085 CET	4258	51556	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:33.866986036 CET	51556	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:33.867957115 CET	51558	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:33.987188101 CET	4258	51556	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:33.988063097 CET	4258	51558	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:33.988133907 CET	51558	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:33.988179922 CET	51558	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:34.107953072 CET	4258	51558	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:36.382877111 CET	4258	51558	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:36.383116007 CET	51558	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:36.383243084 CET	51558	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:36.383842945 CET	51560	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:36.502965927 CET	4258	51558	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:36.503339052 CET	4258	51560	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:36.503396988 CET	51560	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:36.503552914 CET	51560	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:36.623220921 CET	4258	51560	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:38.757270098 CET	4258	51560	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:38.757548094 CET	51560	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:38.758337975 CET	51562	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:38.877084970 CET	4258	51560	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:38.877808094 CET	4258	51562	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:38.877973080 CET	51562	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:38.878071070 CET	51562	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:38.997616053 CET	4258	51562	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:41.132868052 CET	4258	51562	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:41.133116007 CET	51562	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:41.133563995 CET	51564	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:41.252599955 CET	4258	51562	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:41.253065109 CET	4258	51564	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:41.253170013 CET	51564	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:41.253212929 CET	51564	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:41.372701883 CET	4258	51564	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:43.775543928 CET	4258	51564	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:43.775816917 CET	51564	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:43.776487112 CET	51566	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:43.895725012 CET	4258	51564	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:43.896620035 CET	4258	51566	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:43.896739006 CET	51566	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:43.896804094 CET	51566	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:44.016989946 CET	4258	51566	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:46.148117065 CET	4258	51566	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:46.148441076 CET	51566	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:46.148957968 CET	51568	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:46.267868042 CET	4258	51566	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:46.268428087 CET	4258	51568	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:46.268497944 CET	51568	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:46.268553019 CET	51568	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:46.388304949 CET	4258	51568	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:48.523071051 CET	4258	51568	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:48.523211956 CET	51568	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:48.523725033 CET	51570	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:48.642750025 CET	4258	51568	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:48.643151045 CET	4258	51570	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:48.643209934 CET	51570	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:48.643271923 CET	51570	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:48.762712002 CET	4258	51570	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:50.898353100 CET	4258	51570	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:50.898458004 CET	51570	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:50.898910046 CET	51572	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:51.018023968 CET	4258	51570	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:51.018315077 CET	4258	51572	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:51.018358946 CET	51572	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:51.018388033 CET	51572	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:51.138212919 CET	4258	51572	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:53.273417950 CET	4258	51572	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:53.273647070 CET	51572	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:53.274329901 CET	51574	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:53.393271923 CET	4258	51572	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:53.393735886 CET	4258	51574	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:53.393815041 CET	51574	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:53.393855095 CET	51574	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:53.513521910 CET	4258	51574	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:54.044775009 CET	43928	443	192.168.2.23	91.189.91.42
Dec 26, 2024 22:16:55.664047956 CET	4258	51574	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:55.664311886 CET	51574	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:55.665052891 CET	51576	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:55.783870935 CET	4258	51574	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:55.784516096 CET	4258	51576	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:55.784604073 CET	51576	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:55.784694910 CET	51576	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:55.905481100 CET	4258	51576	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:58.038690090 CET	4258	51576	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:58.039063931 CET	51576	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:58.039809942 CET	51578	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:58.158605099 CET	4258	51576	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:58.159358025 CET	4258	51578	178.215.238.69	192.168.2.23
Dec 26, 2024 22:16:58.159478903 CET	51578	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:58.159595966 CET	51578	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:16:58.279006958 CET	4258	51578	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:00.523658037 CET	4258	51578	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:00.523981094 CET	51578	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:00.524744034 CET	51580	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:00.643512011 CET	4258	51578	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:00.644263983 CET	4258	51580	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:00.644366026 CET	51580	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:00.644479990 CET	51580	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:00.763860941 CET	4258	51580	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:02.898488045 CET	4258	51580	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:02.898649931 CET	51580	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:02.899243116 CET	51582	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:03.018115997 CET	4258	51580	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:03.018731117 CET	4258	51582	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:03.018934011 CET	51582	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:03.019068956 CET	51582	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:03.138525963 CET	4258	51582	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:05.273714066 CET	4258	51582	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:05.274014950 CET	51582	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:05.274753094 CET	51584	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:05.393496037 CET	4258	51582	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:05.394258976 CET	4258	51584	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:05.394347906 CET	51584	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:05.394476891 CET	51584	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:05.513902903 CET	4258	51584	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:07.648370981 CET	4258	51584	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:07.648639917 CET	51584	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:07.649471998 CET	51586	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:07.768347025 CET	4258	51584	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:07.768903971 CET	4258	51586	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:07.769016027 CET	51586	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:07.769121885 CET	51586	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:07.888516903 CET	4258	51586	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:10.023762941 CET	4258	51586	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:10.024040937 CET	51586	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:10.024718046 CET	51588	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:10.143668890 CET	4258	51586	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:10.144212961 CET	4258	51588	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:10.144299030 CET	51588	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:10.144392014 CET	51588	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:10.263827085 CET	4258	51588	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:12.398710012 CET	4258	51588	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:12.399085999 CET	51588	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:12.399722099 CET	51590	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:12.518587112 CET	4258	51588	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:12.519133091 CET	4258	51590	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:12.519221067 CET	51590	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:12.519236088 CET	51590	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:12.639081001 CET	4258	51590	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:14.789799929 CET	4258	51590	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:14.789968014 CET	51590	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:14.790410995 CET	51592	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:14.909467936 CET	4258	51590	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:14.910024881 CET	4258	51592	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:14.910114050 CET	51592	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:14.910234928 CET	51592	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:15.029742956 CET	4258	51592	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:17.436279058 CET	4258	51592	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:17.436646938 CET	51592	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:17.437354088 CET	51594	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:17.556315899 CET	4258	51592	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:17.556775093 CET	4258	51594	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:17.556865931 CET	51594	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:17.556960106 CET	51594	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:17.676491022 CET	4258	51594	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:20.141580105 CET	4258	51594	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:20.141736984 CET	51594	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:20.142285109 CET	51596	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:20.261461973 CET	4258	51594	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:20.261701107 CET	4258	51596	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:20.261761904 CET	51596	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:20.261789083 CET	51596	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:20.381320000 CET	4258	51596	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:22.664685965 CET	4258	51596	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:22.664942026 CET	51596	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:22.665687084 CET	51598	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:22.784524918 CET	4258	51596	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:22.785172939 CET	4258	51598	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:22.785268068 CET	51598	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:22.785371065 CET	51598	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:22.904978991 CET	4258	51598	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:25.024466038 CET	4258	51598	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:25.024703979 CET	51598	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:25.025537968 CET	51600	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:25.144323111 CET	4258	51598	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:25.145021915 CET	4258	51600	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:25.145164013 CET	51600	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:25.145282030 CET	51600	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:25.264718056 CET	4258	51600	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:27.399379015 CET	4258	51600	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:27.399714947 CET	51600	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:27.400404930 CET	51602	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:27.519392967 CET	4258	51600	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:27.519896984 CET	4258	51602	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:27.520085096 CET	51602	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:27.520200014 CET	51602	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:27.639636993 CET	4258	51602	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:29.774158001 CET	4258	51602	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:29.774321079 CET	51602	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:29.774908066 CET	51604	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:29.893965960 CET	4258	51602	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:29.894445896 CET	4258	51604	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:29.894546032 CET	51604	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:29.894594908 CET	51604	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:30.014157057 CET	4258	51604	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:32.138184071 CET	4258	51604	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:32.138518095 CET	51604	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:32.139087915 CET	51606	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:32.258362055 CET	4258	51604	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:32.258734941 CET	4258	51606	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:32.258919001 CET	51606	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:32.258919954 CET	51606	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:32.378496885 CET	4258	51606	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:34.512798071 CET	4258	51606	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:34.513206959 CET	51606	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:34.513933897 CET	51608	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:34.632802963 CET	4258	51606	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:34.633460999 CET	4258	51608	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:34.633557081 CET	51608	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:34.633651018 CET	51608	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:34.753088951 CET	4258	51608	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:36.888226032 CET	4258	51608	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:36.888494015 CET	51608	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:36.889081001 CET	51610	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:37.008248091 CET	4258	51608	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:37.008826971 CET	4258	51610	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:37.008908033 CET	51610	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:37.008966923 CET	51610	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:37.129136086 CET	4258	51610	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:39.411024094 CET	4258	51610	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:39.411276102 CET	51610	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:39.412101030 CET	51612	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:39.530977011 CET	4258	51610	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:39.531698942 CET	4258	51612	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:39.531771898 CET	51612	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:39.531929970 CET	51612	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:39.651479006 CET	4258	51612	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:41.778628111 CET	4258	51612	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:41.778846979 CET	51612	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:41.779537916 CET	51614	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:41.898402929 CET	4258	51612	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:41.899048090 CET	4258	51614	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:41.899101973 CET	51614	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:41.899162054 CET	51614	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:42.018853903 CET	4258	51614	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:44.154356003 CET	4258	51614	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:44.154742002 CET	51614	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:44.155488014 CET	51616	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:44.274305105 CET	4258	51614	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:44.274924994 CET	4258	51616	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:44.275063038 CET	51616	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:44.275161982 CET	51616	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:44.394975901 CET	4258	51616	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:46.544478893 CET	4258	51616	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:46.544853926 CET	51616	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:46.545561075 CET	51618	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:46.664514065 CET	4258	51616	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:46.665121078 CET	4258	51618	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:46.665240049 CET	51618	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:46.665327072 CET	51618	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:46.787622929 CET	4258	51618	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:48.919750929 CET	4258	51618	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:48.919991016 CET	51618	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:48.920711994 CET	51620	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:49.039490938 CET	4258	51618	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:49.040143967 CET	4258	51620	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:49.040215015 CET	51620	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:49.040265083 CET	51620	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:49.159786940 CET	4258	51620	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:51.544754028 CET	4258	51620	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:51.544996023 CET	51620	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:51.545690060 CET	51622	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:51.664602995 CET	4258	51620	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:51.665169954 CET	4258	51622	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:51.665266991 CET	51622	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:51.665389061 CET	51622	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:51.784910917 CET	4258	51622	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:54.232204914 CET	4258	51622	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:54.232599974 CET	51622	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:54.233339071 CET	51624	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:54.344834089 CET	4258	51622	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:54.344960928 CET	51622	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:54.352336884 CET	4258	51622	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:54.418457031 CET	4258	51624	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:54.418689013 CET	51624	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:54.418833017 CET	51624	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:54.538295031 CET	4258	51624	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:56.673573971 CET	4258	51624	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:56.673830032 CET	51624	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:56.674577951 CET	51626	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:56.793669939 CET	4258	51624	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:56.794337988 CET	4258	51626	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:56.794435978 CET	51626	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:56.794568062 CET	51626	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:56.914084911 CET	4258	51626	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:59.060983896 CET	4258	51626	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:59.061248064 CET	51626	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:59.062055111 CET	51628	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:59.180843115 CET	4258	51626	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:59.181545973 CET	4258	51628	178.215.238.69	192.168.2.23
Dec 26, 2024 22:17:59.181643009 CET	51628	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:59.181761026 CET	51628	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:17:59.301294088 CET	4258	51628	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:01.420541048 CET	4258	51628	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:01.420938969 CET	51628	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:01.421690941 CET	51630	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:01.540477991 CET	4258	51628	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:01.541135073 CET	4258	51630	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:01.541291952 CET	51630	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:01.541387081 CET	51630	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:01.660798073 CET	4258	51630	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:03.827946901 CET	4258	51630	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:03.828222990 CET	51630	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:03.828912973 CET	51632	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:03.947711945 CET	4258	51630	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:03.948364019 CET	4258	51632	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:03.948451996 CET	51632	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:03.948590994 CET	51632	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:04.068095922 CET	4258	51632	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:06.217458963 CET	4258	51632	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:06.217811108 CET	51632	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:06.218540907 CET	51634	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:06.337544918 CET	4258	51632	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:06.337949038 CET	4258	51634	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:06.338020086 CET	51634	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:06.338180065 CET	51634	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:06.457649946 CET	4258	51634	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:08.577222109 CET	4258	51634	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:08.577438116 CET	51634	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:08.578046083 CET	51636	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:08.696969986 CET	4258	51634	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:08.697580099 CET	4258	51636	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:08.697747946 CET	51636	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:08.697747946 CET	51636	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:08.817384005 CET	4258	51636	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:10.952313900 CET	4258	51636	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:10.952652931 CET	51636	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:10.953130960 CET	51638	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:11.072386026 CET	4258	51636	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:11.072557926 CET	4258	51638	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:11.072716951 CET	51638	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:11.072716951 CET	51638	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:11.192385912 CET	4258	51638	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:13.327388048 CET	4258	51638	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:13.327650070 CET	51638	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:13.328063011 CET	51640	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:13.447376966 CET	4258	51638	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:13.447587967 CET	4258	51640	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:13.447647095 CET	51640	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:13.447808981 CET	51640	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:13.567296028 CET	4258	51640	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:15.702244997 CET	4258	51640	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:15.702723980 CET	51640	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:15.703656912 CET	51642	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:15.822329044 CET	4258	51640	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:15.823226929 CET	4258	51642	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:15.823329926 CET	51642	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:15.823559999 CET	51642	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:15.943034887 CET	4258	51642	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:18.077066898 CET	4258	51642	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:18.077332973 CET	51642	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:18.078068972 CET	51644	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:18.196824074 CET	4258	51642	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:18.197571993 CET	4258	51644	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:18.197669983 CET	51644	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:18.197848082 CET	51644	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:18.317322016 CET	4258	51644	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:20.499536991 CET	4258	51644	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:20.499944925 CET	51644	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:20.500700951 CET	51646	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:20.619599104 CET	4258	51644	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:20.620202065 CET	4258	51646	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:20.620297909 CET	51646	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:20.620376110 CET	51646	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:20.739892960 CET	4258	51646	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:22.969775915 CET	4258	51646	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:22.970088959 CET	51646	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:22.970639944 CET	51648	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:23.089739084 CET	4258	51646	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:23.090226889 CET	4258	51648	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:23.090284109 CET	51648	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:23.090325117 CET	51648	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:23.209950924 CET	4258	51648	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:25.421191931 CET	4258	51648	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:25.421360016 CET	51648	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:25.422039986 CET	51650	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:25.541021109 CET	4258	51648	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:25.541583061 CET	4258	51650	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:25.541660070 CET	51650	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:25.541692972 CET	51650	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:25.661302090 CET	4258	51650	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:27.797982931 CET	4258	51650	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:27.798284054 CET	51650	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:27.799046993 CET	51652	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:27.917923927 CET	4258	51650	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:27.918575048 CET	4258	51652	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:27.918651104 CET	51652	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:27.918695927 CET	51652	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:28.199457884 CET	4258	51652	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:30.327352047 CET	4258	51652	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:30.327495098 CET	51652	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:30.327518940 CET	51652	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:30.328162909 CET	51654	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:30.447113991 CET	4258	51652	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:30.447638035 CET	4258	51654	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:30.447690964 CET	51654	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:30.447727919 CET	51654	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:30.567257881 CET	4258	51654	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:32.702584982 CET	4258	51654	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:32.702951908 CET	51654	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:32.703629017 CET	51656	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:32.822791100 CET	4258	51654	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:32.823158026 CET	4258	51656	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:32.823232889 CET	51656	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:32.823276043 CET	51656	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:32.942734003 CET	4258	51656	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:35.077893972 CET	4258	51656	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:35.078166962 CET	51656	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:35.078893900 CET	51658	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:35.211343050 CET	4258	51656	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:35.211391926 CET	4258	51658	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:35.211615086 CET	51658	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:35.211719990 CET	51658	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:35.332021952 CET	4258	51658	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:37.453136921 CET	4258	51658	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:37.453234911 CET	51658	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:37.453521967 CET	51660	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:37.573091030 CET	4258	51658	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:37.573252916 CET	4258	51660	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:37.573302984 CET	51660	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:37.573355913 CET	51660	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:37.693017960 CET	4258	51660	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:39.874557018 CET	4258	51660	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:39.874869108 CET	51660	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:39.875437975 CET	51662	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:39.994440079 CET	4258	51660	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:40.002151012 CET	4258	51662	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:40.002202034 CET	51662	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:40.002274036 CET	51662	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:40.121718884 CET	4258	51662	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:42.250344038 CET	4258	51662	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:42.250725031 CET	51662	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:42.251199961 CET	51664	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:42.370364904 CET	4258	51662	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:42.370667934 CET	4258	51664	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:42.370867968 CET	51664	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:42.370868921 CET	51664	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:42.490448952 CET	4258	51664	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:44.702672005 CET	4258	51664	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:44.702920914 CET	51664	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:44.703309059 CET	51666	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:44.822618961 CET	4258	51664	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:44.822844982 CET	4258	51666	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:44.822906017 CET	51666	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:44.823131084 CET	51666	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:44.942646980 CET	4258	51666	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:47.078108072 CET	4258	51666	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:47.078469038 CET	51666	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:47.079200029 CET	51668	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:47.198055983 CET	4258	51666	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:47.198657036 CET	4258	51668	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:47.198754072 CET	51668	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:47.198992014 CET	51668	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:47.318551064 CET	4258	51668	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:49.468583107 CET	4258	51668	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:49.468836069 CET	51668	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:49.469396114 CET	51670	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:49.588486910 CET	4258	51668	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:49.589009047 CET	4258	51670	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:49.589178085 CET	51670	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:49.589195967 CET	51670	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:49.709192991 CET	4258	51670	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:51.874485970 CET	4258	51670	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:51.874861002 CET	51670	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:51.875444889 CET	51672	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:51.994801044 CET	4258	51670	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:51.994929075 CET	4258	51672	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:51.995021105 CET	51672	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:51.995081902 CET	51672	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:52.114551067 CET	4258	51672	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:54.249788046 CET	4258	51672	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:54.250354052 CET	51672	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:54.250963926 CET	51674	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:54.410129070 CET	4258	51672	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:54.410166025 CET	4258	51674	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:54.410468102 CET	51674	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:54.410630941 CET	51674	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:54.530236959 CET	4258	51674	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:56.671762943 CET	4258	51674	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:56.672002077 CET	51674	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:56.672642946 CET	51676	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:56.791594028 CET	4258	51674	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:56.792089939 CET	4258	51676	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:56.792233944 CET	51676	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:56.792526960 CET	51676	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:56.911988974 CET	4258	51676	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:59.154313087 CET	4258	51676	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:59.154772043 CET	51676	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:59.156443119 CET	51678	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:59.274478912 CET	4258	51676	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:59.275898933 CET	4258	51678	178.215.238.69	192.168.2.23
Dec 26, 2024 22:18:59.276010990 CET	51678	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:59.276127100 CET	51678	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:18:59.396584988 CET	4258	51678	178.215.238.69	192.168.2.23
Dec 26, 2024 22:19:01.515826941 CET	4258	51678	178.215.238.69	192.168.2.23
Dec 26, 2024 22:19:01.516002893 CET	51678	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:19:01.516805887 CET	51680	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:19:01.635678053 CET	4258	51678	178.215.238.69	192.168.2.23
Dec 26, 2024 22:19:01.636346102 CET	4258	51680	178.215.238.69	192.168.2.23
Dec 26, 2024 22:19:01.636425018 CET	51680	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:19:01.636455059 CET	51680	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:19:01.756215096 CET	4258	51680	178.215.238.69	192.168.2.23
Dec 26, 2024 22:19:04.231348991 CET	4258	51680	178.215.238.69	192.168.2.23
Dec 26, 2024 22:19:04.231882095 CET	51680	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:19:04.232808113 CET	51682	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:19:04.298016071 CET	4258	51680	178.215.238.69	192.168.2.23
Dec 26, 2024 22:19:04.298230886 CET	51680	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:19:04.351404905 CET	4258	51680	178.215.238.69	192.168.2.23
Dec 26, 2024 22:19:04.352411032 CET	4258	51682	178.215.238.69	192.168.2.23
Dec 26, 2024 22:19:04.352601051 CET	51682	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:19:04.352660894 CET	51682	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:19:04.472042084 CET	4258	51682	178.215.238.69	192.168.2.23
Dec 26, 2024 22:19:06.593961000 CET	4258	51682	178.215.238.69	192.168.2.23
Dec 26, 2024 22:19:06.594425917 CET	51682	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:19:06.595431089 CET	51684	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:19:06.713823080 CET	4258	51682	178.215.238.69	192.168.2.23
Dec 26, 2024 22:19:06.714925051 CET	4258	51684	178.215.238.69	192.168.2.23
Dec 26, 2024 22:19:06.715054989 CET	51684	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:19:06.715233088 CET	51684	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:19:06.835683107 CET	4258	51684	178.215.238.69	192.168.2.23
Dec 26, 2024 22:19:08.970815897 CET	4258	51684	178.215.238.69	192.168.2.23
Dec 26, 2024 22:19:08.971004963 CET	51684	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:19:08.971601963 CET	51686	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:19:09.092607021 CET	4258	51684	178.215.238.69	192.168.2.23
Dec 26, 2024 22:19:09.093069077 CET	4258	51686	178.215.238.69	192.168.2.23
Dec 26, 2024 22:19:09.093139887 CET	51686	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:19:09.093168974 CET	51686	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:19:09.215043068 CET	4258	51686	178.215.238.69	192.168.2.23
Dec 26, 2024 22:19:11.344099998 CET	4258	51686	178.215.238.69	192.168.2.23
Dec 26, 2024 22:19:11.344261885 CET	51686	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:19:11.344839096 CET	51688	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:19:11.464483976 CET	4258	51686	178.215.238.69	192.168.2.23
Dec 26, 2024 22:19:11.464900017 CET	4258	51688	178.215.238.69	192.168.2.23
Dec 26, 2024 22:19:11.464953899 CET	51688	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:19:11.465107918 CET	51688	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:19:11.584642887 CET	4258	51688	178.215.238.69	192.168.2.23
Dec 26, 2024 22:19:13.719363928 CET	4258	51688	178.215.238.69	192.168.2.23
Dec 26, 2024 22:19:13.719697952 CET	51688	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:19:13.720427036 CET	51690	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:19:13.839355946 CET	4258	51688	178.215.238.69	192.168.2.23
Dec 26, 2024 22:19:13.839867115 CET	4258	51690	178.215.238.69	192.168.2.23
Dec 26, 2024 22:19:13.839926958 CET	51690	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:19:13.840262890 CET	51690	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:19:13.959760904 CET	4258	51690	178.215.238.69	192.168.2.23
Dec 26, 2024 22:19:16.109967947 CET	4258	51690	178.215.238.69	192.168.2.23
Dec 26, 2024 22:19:16.110352039 CET	51690	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:19:16.111093044 CET	51692	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:19:16.229841948 CET	4258	51690	178.215.238.69	192.168.2.23
Dec 26, 2024 22:19:16.230710030 CET	4258	51692	178.215.238.69	192.168.2.23
Dec 26, 2024 22:19:16.230843067 CET	51692	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:19:16.231004953 CET	51692	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:19:16.350545883 CET	4258	51692	178.215.238.69	192.168.2.23
Dec 26, 2024 22:19:18.588737965 CET	4258	51692	178.215.238.69	192.168.2.23
Dec 26, 2024 22:19:18.589114904 CET	51692	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:19:18.589942932 CET	51694	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:19:18.708998919 CET	4258	51692	178.215.238.69	192.168.2.23
Dec 26, 2024 22:19:18.709393978 CET	4258	51694	178.215.238.69	192.168.2.23
Dec 26, 2024 22:19:18.709522009 CET	51694	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:19:18.709631920 CET	51694	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:19:18.830461979 CET	4258	51694	178.215.238.69	192.168.2.23
Dec 26, 2024 22:19:21.047276974 CET	4258	51694	178.215.238.69	192.168.2.23
Dec 26, 2024 22:19:21.047539949 CET	51694	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:19:21.048365116 CET	51696	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:19:21.167148113 CET	4258	51694	178.215.238.69	192.168.2.23
Dec 26, 2024 22:19:21.167988062 CET	4258	51696	178.215.238.69	192.168.2.23
Dec 26, 2024 22:19:21.168086052 CET	51696	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:19:21.168205023 CET	51696	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:19:21.287659883 CET	4258	51696	178.215.238.69	192.168.2.23
Dec 26, 2024 22:19:23.456052065 CET	4258	51696	178.215.238.69	192.168.2.23
Dec 26, 2024 22:19:23.456353903 CET	51696	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:19:23.457238913 CET	51698	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:19:23.575901985 CET	4258	51696	178.215.238.69	192.168.2.23
Dec 26, 2024 22:19:23.576754093 CET	4258	51698	178.215.238.69	192.168.2.23
Dec 26, 2024 22:19:23.576843977 CET	51698	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:19:23.576982975 CET	51698	4258	192.168.2.23	178.215.238.69
Dec 26, 2024 22:19:23.696444035 CET	4258	51698	178.215.238.69	192.168.2.23

System Behavior

Analysis Process: kitsune.ppc.elf PID: 6255, Parent PID: 6181

General

Start time (UTC):	21:15:50
Start date (UTC):	26/12/2024
Path:	/tmp/kitsune.ppc.elf
Arguments:	/tmp/kitsune.ppc.elf
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: kitsune.ppc.elf PID: 6258, Parent PID: 6255

General

Start time (UTC):	21:15:50
Start date (UTC):	26/12/2024
Path:	/tmp/kitsune.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: kitsune.ppc.elf PID: 6260, Parent PID: 6258

General

Start time (UTC):	21:15:50
Start date (UTC):	26/12/2024
Path:	/tmp/kitsune.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping or `net view` using Net .
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report kitsune.ppc.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Threatname: Gafgyt

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.6VlIqc (deleted)

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: kitsune.ppc.elf PID: 6255, Parent PID: 6181

General

Chronological Activities

Analysis Process: kitsune.ppc.elf PID: 6258, Parent PID: 6255

General

Chronological Activities

Analysis Process: kitsune.ppc.elf PID: 6260, Parent PID: 6258

General

Chronological Activities

Linux Analysis Report
kitsune.ppc.elf