Edit tour

Linux Analysis Report
gigops.x86.elf

Overview

General Information

Sample name:	gigops.x86.elf
Analysis ID:	1585609
MD5:	9a448f36d365af48793fb990dd3887ba
SHA1:	9cc785b11c52d7f303f7b68fd2df56acf4e98631
SHA256:	5a6d6fb1cc8d68b3eab81c15dcc9469544039a986641cb7012e5ea7e3a5ac00d
Tags:	elfuser-abuse_ch
Infos:

Detection

Gafgyt

Score:	88
Range:	0 - 100
Whitelisted:	false

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Gafgyt

Machine Learning detection for sample

Opens /proc/net/* files useful for finding connected devices and routers

Sample and/or dropped files contains symbols with suspicious names

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1585609
Start date and time:	2025-01-07 22:21:00 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	gigops.x86.elf
Detection:	MAL
Classification:	mal88.spre.troj.linELF@0/0@2/0

Warnings

VT rate limit hit for: gigops.x86.elf

Runtime Messages

Command:	/tmp/gigops.x86.elf
PID:	5575
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	BUILD DONGS buBUILD DONGS f: BUILD DONGS buf: BUILD DONGS buf: BUILD DONGS buf: BUILD DONGS buf: BUILD DONGS buf: BUILD DONGS buf: BUILD DONGS buf: BUILD DONGS buf: BUILD DONGS buf: BUILD DONGS buf: BUILD DONGS buf: BUILD DONGS buf: BUILD DONGS buf: BUILD DONGS buf: BUILD DONGS buf: BUILD DONGS buf: BUILD DONGS buf: BUILD DONGS buf: BUILD DONGS buf: BUILD DONGS buf: BUILD DONGS buf: BUILD DONGS buf: BUILD DONGS buf: BUILD DONGS buf: BUILD DONGS buf: BUILD DONGS buf: BUILD DONGS buf: BUILD DONGS buf: BUILD DONGS buf: BUILD DONGS buf: BUILD DONGS buf: BUILD DONGS buf: BUILD DONGS buf: BUILD DONGS buf: BUILD DONGS buf: BUILD DONGS buf: BUILD DONGS buf: BUILD DONGS buf: BUILD DONGS buf: BUILD DONGS buf: BUILD DONGS buf: BUILD DONGS buf: BUILD DONGS buf: BUILD DONGS buf: BUILD DONGS buf: BUILD DONGS buf: BUILD DONGS buf: BUILD DONGS buf: BUILD DONGS buf: BUILD DONGS buf: BUILD DONGS
Standard Error:

Process Tree

system is lnxubuntu20

gigops.x86.elf (PID: 5575, Parent: 5495, MD5: 9a448f36d365af48793fb990dd3887ba) Arguments: /tmp/gigops.x86.elf

gigops.x86.elf New Fork (PID: 5577, Parent: 5575)

gigops.x86.elf New Fork (PID: 5578, Parent: 5577)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
gigops.x86.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
gigops.x86.elf	Linux_Trojan_Gafgyt_a6a2adb9	unknown	unknown	0x612:$a: CC 01 C2 89 55 B4 8B 45 B4 C9 C3 55 48 89 E5 48 81 EC 90 00
gigops.x86.elf	Linux_Trojan_Gafgyt_a10161ce	unknown	unknown	0x4ea9:$a: 45 B0 8B 45 BC 48 63 D0 48 89 D0 48 C1 E0 02 48 8D 14 10 48 8B
gigops.x86.elf	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x9798:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
gigops.x86.elf	Linux_Trojan_Gafgyt_f3d83a74	unknown	unknown	0x538:$a: DC 00 74 1B 83 7D E0 0A 75 15 83 7D E4 00 79 0F C7 45 C8 01 00
gigops.x86.elf	Linux_Trojan_Gafgyt_a0a4de11	unknown	unknown	0x4096:$a: 42 0D 83 C8 10 88 42 0D 48 8B 55 D8 0F B6 42 0D 83 C8 08 88
gigops.x86.elf	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0x6d0e:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x6d72:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x6f01:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
gigops.x86.elf	Linux_Trojan_Gafgyt_09c3070e	unknown	unknown	0x15fa:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 0x16c4:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 0x1905:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83
gigops.x86.elf	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0xd2e2:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
gigops.x86.elf	Linux_Trojan_Gafgyt_148b91a2	unknown	unknown	0x1bb8:$a: C6 45 DB FC EB 04 C6 45 DB FE 0F B6 45 DB 88 45 FF 48 8D 75 FF 8B
gigops.x86.elf	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0x9b79:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
gigops.x86.elf	Linux_Trojan_Gafgyt_dd0d6173	unknown	unknown	0x2514:$a: 55 F8 8B 45 F0 89 42 0C 48 8B 55 F8 8B 45 F4 89 42 10 C9 C3 55 48
gigops.x86.elf	Linux_Trojan_Gafgyt_779e142f	unknown	unknown	0x45a:$a: EC 8B 45 E8 83 E0 02 85 C0 74 07 C7 45 D8 30 00 00 00 8B 45 E8 83
gigops.x86.elf	Linux_Trojan_Gafgyt_cf84c9f2	unknown	unknown	0x105d:$a: 55 48 89 E5 48 83 EC 30 48 89 7D E8 89 75 E4 89 55 E0 C7 45 F8 01 00
gigops.x86.elf	Linux_Trojan_Gafgyt_859042a0	unknown	unknown	0x69d3:$a: 45 A8 48 83 C0 01 48 89 45 C0 EB 05 48 83 45 C0 01 48 8B 45 C0 0F
gigops.x86.elf	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0x9e6f:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
gigops.x86.elf	Linux_Trojan_Gafgyt_fb14e81f	unknown	unknown	0xefa2:$a: 4E 45 52 00 53 43 41 4E 4E 45 52 20 4F 4E 20 7C 20 4F 46 46 00
Click to see the 12 entries

Memory Dumps

Source	Rule	Description	Author	Strings
5577.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_a6a2adb9	unknown	unknown	0x612:$a: CC 01 C2 89 55 B4 8B 45 B4 C9 C3 55 48 89 E5 48 81 EC 90 00
5577.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_a10161ce	unknown	unknown	0x4ea9:$a: 45 B0 8B 45 BC 48 63 D0 48 89 D0 48 C1 E0 02 48 8D 14 10 48 8B
5577.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x9798:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
5577.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_f3d83a74	unknown	unknown	0x538:$a: DC 00 74 1B 83 7D E0 0A 75 15 83 7D E4 00 79 0F C7 45 C8 01 00
5577.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_a0a4de11	unknown	unknown	0x4096:$a: 42 0D 83 C8 10 88 42 0D 48 8B 55 D8 0F B6 42 0D 83 C8 08 88
5577.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0x6d0e:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x6d72:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x6f01:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
5577.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_09c3070e	unknown	unknown	0x15fa:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 0x16c4:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 0x1905:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83
5577.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0xd2e2:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
5577.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_148b91a2	unknown	unknown	0x1bb8:$a: C6 45 DB FC EB 04 C6 45 DB FE 0F B6 45 DB 88 45 FF 48 8D 75 FF 8B
5577.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0x9b79:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
5577.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_dd0d6173	unknown	unknown	0x2514:$a: 55 F8 8B 45 F0 89 42 0C 48 8B 55 F8 8B 45 F4 89 42 10 C9 C3 55 48
5577.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_779e142f	unknown	unknown	0x45a:$a: EC 8B 45 E8 83 E0 02 85 C0 74 07 C7 45 D8 30 00 00 00 8B 45 E8 83
5577.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_cf84c9f2	unknown	unknown	0x105d:$a: 55 48 89 E5 48 83 EC 30 48 89 7D E8 89 75 E4 89 55 E0 C7 45 F8 01 00
5577.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_859042a0	unknown	unknown	0x69d3:$a: 45 A8 48 83 C0 01 48 89 45 C0 EB 05 48 83 45 C0 01 48 8B 45 C0 0F
5577.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0x9e6f:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
5577.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_fb14e81f	unknown	unknown	0xefa2:$a: 4E 45 52 00 53 43 41 4E 4E 45 52 20 4F 4E 20 7C 20 4F 46 46 00
5575.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_a6a2adb9	unknown	unknown	0x612:$a: CC 01 C2 89 55 B4 8B 45 B4 C9 C3 55 48 89 E5 48 81 EC 90 00
5575.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_a10161ce	unknown	unknown	0x4ea9:$a: 45 B0 8B 45 BC 48 63 D0 48 89 D0 48 C1 E0 02 48 8D 14 10 48 8B
5575.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x9798:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
5575.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_f3d83a74	unknown	unknown	0x538:$a: DC 00 74 1B 83 7D E0 0A 75 15 83 7D E4 00 79 0F C7 45 C8 01 00
5575.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_a0a4de11	unknown	unknown	0x4096:$a: 42 0D 83 C8 10 88 42 0D 48 8B 55 D8 0F B6 42 0D 83 C8 08 88
5575.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0x6d0e:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x6d72:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x6f01:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
5575.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_09c3070e	unknown	unknown	0x15fa:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 0x16c4:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 0x1905:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83
5575.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0xd2e2:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
5575.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_148b91a2	unknown	unknown	0x1bb8:$a: C6 45 DB FC EB 04 C6 45 DB FE 0F B6 45 DB 88 45 FF 48 8D 75 FF 8B
5575.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0x9b79:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
5575.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_dd0d6173	unknown	unknown	0x2514:$a: 55 F8 8B 45 F0 89 42 0C 48 8B 55 F8 8B 45 F4 89 42 10 C9 C3 55 48
5575.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_779e142f	unknown	unknown	0x45a:$a: EC 8B 45 E8 83 E0 02 85 C0 74 07 C7 45 D8 30 00 00 00 8B 45 E8 83
5575.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_cf84c9f2	unknown	unknown	0x105d:$a: 55 48 89 E5 48 83 EC 30 48 89 7D E8 89 75 E4 89 55 E0 C7 45 F8 01 00
5575.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_859042a0	unknown	unknown	0x69d3:$a: 45 A8 48 83 C0 01 48 89 45 C0 EB 05 48 83 45 C0 01 48 8B 45 C0 0F
5575.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0x9e6f:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
5575.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_fb14e81f	unknown	unknown	0xefa2:$a: 4E 45 52 00 53 43 41 4E 4E 45 52 20 4F 4E 20 7C 20 4F 46 46 00
Click to see the 27 entries

Suricata Signatures

ETPRO MALWARE ELF/BASHLITE Variant CnC Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-07T22:21:57.474787+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53310	45.128.233.186	23	TCP
2025-01-07T22:21:59.256063+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53312	45.128.233.186	23	TCP
2025-01-07T22:22:01.000780+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53314	45.128.233.186	23	TCP
2025-01-07T22:22:02.789782+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53316	45.128.233.186	23	TCP
2025-01-07T22:22:04.534631+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53318	45.128.233.186	23	TCP
2025-01-07T22:22:06.299876+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53320	45.128.233.186	23	TCP
2025-01-07T22:22:08.120686+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53322	45.128.233.186	23	TCP
2025-01-07T22:22:09.881724+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53324	45.128.233.186	23	TCP
2025-01-07T22:22:11.692312+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53326	45.128.233.186	23	TCP
2025-01-07T22:22:13.463449+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53328	45.128.233.186	23	TCP
2025-01-07T22:22:15.199071+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53330	45.128.233.186	23	TCP
2025-01-07T22:22:16.992986+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53332	45.128.233.186	23	TCP
2025-01-07T22:22:18.790871+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53334	45.128.233.186	23	TCP
2025-01-07T22:22:20.584853+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53336	45.128.233.186	23	TCP
2025-01-07T22:22:22.366852+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53338	45.128.233.186	23	TCP
2025-01-07T22:22:24.092681+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53340	45.128.233.186	23	TCP
2025-01-07T22:22:25.855114+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53342	45.128.233.186	23	TCP
2025-01-07T22:22:27.930410+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53344	45.128.233.186	23	TCP
2025-01-07T22:22:29.711403+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53346	45.128.233.186	23	TCP
2025-01-07T22:22:31.469146+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53348	45.128.233.186	23	TCP
2025-01-07T22:22:33.216192+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53350	45.128.233.186	23	TCP
2025-01-07T22:22:35.824416+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53352	45.128.233.186	23	TCP
2025-01-07T22:22:37.576186+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53354	45.128.233.186	23	TCP
2025-01-07T22:22:39.330110+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53356	45.128.233.186	23	TCP
2025-01-07T22:22:41.115516+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53358	45.128.233.186	23	TCP
2025-01-07T22:22:42.919106+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53360	45.128.233.186	23	TCP
2025-01-07T22:22:44.718533+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53362	45.128.233.186	23	TCP
2025-01-07T22:22:46.537624+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53364	45.128.233.186	23	TCP
2025-01-07T22:22:48.336321+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53366	45.128.233.186	23	TCP
2025-01-07T22:22:50.098069+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53368	45.128.233.186	23	TCP
2025-01-07T22:22:51.858865+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53370	45.128.233.186	23	TCP
2025-01-07T22:22:53.632585+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53372	45.128.233.186	23	TCP
2025-01-07T22:22:55.417115+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53374	45.128.233.186	23	TCP
2025-01-07T22:22:57.187900+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53376	45.128.233.186	23	TCP
2025-01-07T22:22:58.933494+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53378	45.128.233.186	23	TCP
2025-01-07T22:23:00.702803+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53380	45.128.233.186	23	TCP
2025-01-07T22:23:02.452545+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53382	45.128.233.186	23	TCP
2025-01-07T22:23:04.233417+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53384	45.128.233.186	23	TCP
2025-01-07T22:23:05.964032+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53386	45.128.233.186	23	TCP
2025-01-07T22:23:07.752280+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53388	45.128.233.186	23	TCP
2025-01-07T22:23:09.538971+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53390	45.128.233.186	23	TCP
2025-01-07T22:23:11.304076+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53392	45.128.233.186	23	TCP
2025-01-07T22:23:13.069319+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53394	45.128.233.186	23	TCP
2025-01-07T22:23:14.862337+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53396	45.128.233.186	23	TCP
2025-01-07T22:23:16.613835+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53398	45.128.233.186	23	TCP
2025-01-07T22:23:18.381325+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53400	45.128.233.186	23	TCP
2025-01-07T22:23:20.163172+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53402	45.128.233.186	23	TCP
2025-01-07T22:23:21.921903+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53404	45.128.233.186	23	TCP
2025-01-07T22:23:23.704706+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53406	45.128.233.186	23	TCP
2025-01-07T22:23:25.472788+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53408	45.128.233.186	23	TCP
2025-01-07T22:23:27.238945+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53410	45.128.233.186	23	TCP
2025-01-07T22:23:29.035226+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53412	45.128.233.186	23	TCP
2025-01-07T22:23:30.847257+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53414	45.128.233.186	23	TCP
2025-01-07T22:23:32.607627+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53416	45.128.233.186	23	TCP
2025-01-07T22:23:34.408847+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53418	45.128.233.186	23	TCP
2025-01-07T22:23:36.213542+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53420	45.128.233.186	23	TCP
2025-01-07T22:23:37.948897+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53422	45.128.233.186	23	TCP
2025-01-07T22:23:39.746725+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53424	45.128.233.186	23	TCP
2025-01-07T22:23:41.604145+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53426	45.128.233.186	23	TCP
2025-01-07T22:23:43.400571+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53428	45.128.233.186	23	TCP
2025-01-07T22:23:45.155978+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53430	45.128.233.186	23	TCP
2025-01-07T22:23:46.941239+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53432	45.128.233.186	23	TCP
2025-01-07T22:23:48.724373+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53434	45.128.233.186	23	TCP
2025-01-07T22:23:50.518932+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53436	45.128.233.186	23	TCP
2025-01-07T22:23:52.298867+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53438	45.128.233.186	23	TCP
2025-01-07T22:23:54.090156+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53440	45.128.233.186	23	TCP
2025-01-07T22:23:55.919424+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53442	45.128.233.186	23	TCP
2025-01-07T22:23:57.728845+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53444	45.128.233.186	23	TCP
2025-01-07T22:23:59.529737+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53446	45.128.233.186	23	TCP
2025-01-07T22:24:01.318977+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53448	45.128.233.186	23	TCP
2025-01-07T22:24:03.098187+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53450	45.128.233.186	23	TCP
2025-01-07T22:24:04.919462+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53452	45.128.233.186	23	TCP
2025-01-07T22:24:06.654995+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53454	45.128.233.186	23	TCP
2025-01-07T22:24:08.576211+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53456	45.128.233.186	23	TCP
2025-01-07T22:24:10.351637+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53458	45.128.233.186	23	TCP
2025-01-07T22:24:12.138451+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53460	45.128.233.186	23	TCP
2025-01-07T22:24:13.900718+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53462	45.128.233.186	23	TCP
2025-01-07T22:24:15.668854+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53464	45.128.233.186	23	TCP
2025-01-07T22:24:17.418344+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53466	45.128.233.186	23	TCP
2025-01-07T22:24:19.202331+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53468	45.128.233.186	23	TCP
2025-01-07T22:24:20.948140+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53470	45.128.233.186	23	TCP
2025-01-07T22:24:22.702494+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53472	45.128.233.186	23	TCP
2025-01-07T22:24:24.460996+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53474	45.128.233.186	23	TCP
2025-01-07T22:24:26.213874+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53476	45.128.233.186	23	TCP
2025-01-07T22:24:27.963875+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53478	45.128.233.186	23	TCP
2025-01-07T22:24:29.740866+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53480	45.128.233.186	23	TCP
2025-01-07T22:24:31.539069+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53482	45.128.233.186	23	TCP
2025-01-07T22:24:33.319237+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53484	45.128.233.186	23	TCP
2025-01-07T22:24:35.205082+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53486	45.128.233.186	23	TCP
2025-01-07T22:24:36.995769+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53488	45.128.233.186	23	TCP
2025-01-07T22:24:38.730115+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53490	45.128.233.186	23	TCP
2025-01-07T22:24:40.518435+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53492	45.128.233.186	23	TCP
2025-01-07T22:24:42.279015+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53494	45.128.233.186	23	TCP
2025-01-07T22:24:44.051225+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53496	45.128.233.186	23	TCP
2025-01-07T22:24:45.822841+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53500	45.128.233.186	23	TCP
2025-01-07T22:24:47.612295+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53502	45.128.233.186	23	TCP
2025-01-07T22:24:49.382917+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53504	45.128.233.186	23	TCP
2025-01-07T22:24:51.171630+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53506	45.128.233.186	23	TCP
2025-01-07T22:24:52.916473+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53508	45.128.233.186	23	TCP
2025-01-07T22:24:54.682327+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53510	45.128.233.186	23	TCP
2025-01-07T22:24:56.458295+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53512	45.128.233.186	23	TCP
2025-01-07T22:24:58.244120+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53514	45.128.233.186	23	TCP
2025-01-07T22:25:00.049619+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53516	45.128.233.186	23	TCP
2025-01-07T22:25:01.787728+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53518	45.128.233.186	23	TCP
2025-01-07T22:25:03.580701+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53520	45.128.233.186	23	TCP
2025-01-07T22:25:05.342640+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53522	45.128.233.186	23	TCP
2025-01-07T22:25:07.128958+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53524	45.128.233.186	23	TCP
2025-01-07T22:25:08.914693+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53526	45.128.233.186	23	TCP
2025-01-07T22:25:10.744055+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53528	45.128.233.186	23	TCP
2025-01-07T22:25:12.491887+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53530	45.128.233.186	23	TCP
2025-01-07T22:25:14.292200+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53532	45.128.233.186	23	TCP
2025-01-07T22:25:16.051385+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53534	45.128.233.186	23	TCP
2025-01-07T22:25:17.824088+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53536	45.128.233.186	23	TCP
2025-01-07T22:25:19.561483+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53538	45.128.233.186	23	TCP
2025-01-07T22:25:21.563475+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53540	45.128.233.186	23	TCP
2025-01-07T22:25:23.824245+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53542	45.128.233.186	23	TCP
2025-01-07T22:25:26.011927+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53544	45.128.233.186	23	TCP
2025-01-07T22:25:28.114608+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53546	45.128.233.186	23	TCP
2025-01-07T22:25:29.988503+0100	2840333	1	Malware Command and Control Activity Detected	192.168.2.14	53548	45.128.233.186	23	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: gigops.x86.elf

Malware Configuration Extractor: Gafgyt {"C2 url": "45.128.233.186:23"}

Multi AV Scanner detection for submitted file

Source: gigops.x86.elf

ReversingLabs: Detection: 71%

Machine Learning detection for sample

Source: gigops.x86.elf

Joe Sandbox ML: detected

Spreading

Opens /proc/net/* files useful for finding connected devices and routers

Source: /tmp/gigops.x86.elf (PID: 5575)

Opens: /proc/net/route

Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53314 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53316 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53312 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53318 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53330 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53328 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53336 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53322 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53332 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53340 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53334 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53320 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53342 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53384 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53338 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53364 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53350 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53378 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53376 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53372 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53394 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53346 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53390 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53398 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53348 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53392 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53344 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53400 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53426 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53354 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53432 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53366 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53404 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53418 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53406 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53438 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53444 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53374 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53416 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53428 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53448 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53476 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53454 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53486 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53446 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53414 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53368 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53464 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53482 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53484 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53474 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53386 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53472 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53442 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53410 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53440 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53458 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53434 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53456 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53516 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53500 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53530 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53490 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53480 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53494 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53528 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53548 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53522 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53532 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53468 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53492 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53544 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53420 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53512 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53324 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53470 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53506 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53450 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53520 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53510 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53508 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53360 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53380 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53408 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53538 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53540 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53518 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53496 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53310 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53422 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53466 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53534 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53546 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53460 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53502 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53542 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53388 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53504 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53326 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53430 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53358 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53362 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53452 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53396 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53412 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53424 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53478 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53402 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53352 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53514 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53370 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53524 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53436 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53526 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53462 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53488 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53356 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53382 -> 45.128.233.186:23
Source: Network traffic	Suricata IDS: 2840333 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.14:53536 -> 45.128.233.186:23

Source: unknown	TCP traffic detected without corresponding DNS query: 45.128.233.186
Source: unknown	TCP traffic detected without corresponding DNS query: 45.128.233.186
Source: unknown	TCP traffic detected without corresponding DNS query: 45.128.233.186
Source: unknown	TCP traffic detected without corresponding DNS query: 45.128.233.186
Source: unknown	TCP traffic detected without corresponding DNS query: 45.128.233.186
Source: unknown	TCP traffic detected without corresponding DNS query: 45.128.233.186
Source: unknown	TCP traffic detected without corresponding DNS query: 45.128.233.186
Source: unknown	TCP traffic detected without corresponding DNS query: 45.128.233.186
Source: unknown	TCP traffic detected without corresponding DNS query: 45.128.233.186
Source: unknown	TCP traffic detected without corresponding DNS query: 45.128.233.186
Source: unknown	TCP traffic detected without corresponding DNS query: 45.128.233.186
Source: unknown	TCP traffic detected without corresponding DNS query: 45.128.233.186
Source: unknown	TCP traffic detected without corresponding DNS query: 45.128.233.186
Source: unknown	TCP traffic detected without corresponding DNS query: 45.128.233.186
Source: unknown	TCP traffic detected without corresponding DNS query: 45.128.233.186
Source: unknown	TCP traffic detected without corresponding DNS query: 45.128.233.186
Source: unknown	TCP traffic detected without corresponding DNS query: 45.128.233.186
Source: unknown	TCP traffic detected without corresponding DNS query: 45.128.233.186
Source: unknown	TCP traffic detected without corresponding DNS query: 45.128.233.186
Source: unknown	TCP traffic detected without corresponding DNS query: 45.128.233.186
Source: unknown	TCP traffic detected without corresponding DNS query: 45.128.233.186
Source: unknown	TCP traffic detected without corresponding DNS query: 45.128.233.186
Source: unknown	TCP traffic detected without corresponding DNS query: 45.128.233.186
Source: unknown	TCP traffic detected without corresponding DNS query: 45.128.233.186
Source: unknown	TCP traffic detected without corresponding DNS query: 45.128.233.186
Source: unknown	TCP traffic detected without corresponding DNS query: 45.128.233.186
Source: unknown	TCP traffic detected without corresponding DNS query: 45.128.233.186
Source: unknown	TCP traffic detected without corresponding DNS query: 45.128.233.186
Source: unknown	TCP traffic detected without corresponding DNS query: 45.128.233.186
Source: unknown	TCP traffic detected without corresponding DNS query: 45.128.233.186
Source: unknown	TCP traffic detected without corresponding DNS query: 45.128.233.186
Source: unknown	TCP traffic detected without corresponding DNS query: 45.128.233.186
Source: unknown	TCP traffic detected without corresponding DNS query: 45.128.233.186
Source: unknown	TCP traffic detected without corresponding DNS query: 45.128.233.186
Source: unknown	TCP traffic detected without corresponding DNS query: 45.128.233.186
Source: unknown	TCP traffic detected without corresponding DNS query: 45.128.233.186
Source: unknown	TCP traffic detected without corresponding DNS query: 45.128.233.186
Source: unknown	TCP traffic detected without corresponding DNS query: 45.128.233.186
Source: unknown	TCP traffic detected without corresponding DNS query: 45.128.233.186
Source: unknown	TCP traffic detected without corresponding DNS query: 45.128.233.186
Source: unknown	TCP traffic detected without corresponding DNS query: 45.128.233.186
Source: unknown	TCP traffic detected without corresponding DNS query: 45.128.233.186
Source: unknown	TCP traffic detected without corresponding DNS query: 45.128.233.186
Source: unknown	TCP traffic detected without corresponding DNS query: 45.128.233.186
Source: unknown	TCP traffic detected without corresponding DNS query: 45.128.233.186
Source: unknown	TCP traffic detected without corresponding DNS query: 45.128.233.186
Source: unknown	TCP traffic detected without corresponding DNS query: 45.128.233.186
Source: unknown	TCP traffic detected without corresponding DNS query: 45.128.233.186
Source: unknown	TCP traffic detected without corresponding DNS query: 45.128.233.186
Source: unknown	TCP traffic detected without corresponding DNS query: 45.128.233.186

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

Source: gigops.x86.elf

String found in binary or memory: http://5.206.225.136/bins.sh;

System Summary

Malicious sample detected (through community Yara rule)

Source: gigops.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 Author: unknown
Source: gigops.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a10161ce Author: unknown
Source: gigops.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: gigops.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 Author: unknown
Source: gigops.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a0a4de11 Author: unknown
Source: gigops.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: gigops.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_09c3070e Author: unknown
Source: gigops.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: gigops.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_148b91a2 Author: unknown
Source: gigops.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: gigops.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_dd0d6173 Author: unknown
Source: gigops.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_779e142f Author: unknown
Source: gigops.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_cf84c9f2 Author: unknown
Source: gigops.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_859042a0 Author: unknown
Source: gigops.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: gigops.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_fb14e81f Author: unknown
Source: 5577.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 Author: unknown
Source: 5577.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a10161ce Author: unknown
Source: 5577.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 5577.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 Author: unknown
Source: 5577.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a0a4de11 Author: unknown
Source: 5577.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 5577.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_09c3070e Author: unknown
Source: 5577.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 5577.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_148b91a2 Author: unknown
Source: 5577.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 5577.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_dd0d6173 Author: unknown
Source: 5577.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_779e142f Author: unknown
Source: 5577.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_cf84c9f2 Author: unknown
Source: 5577.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_859042a0 Author: unknown
Source: 5577.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 5577.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_fb14e81f Author: unknown
Source: 5575.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 Author: unknown
Source: 5575.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a10161ce Author: unknown
Source: 5575.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 5575.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 Author: unknown
Source: 5575.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a0a4de11 Author: unknown
Source: 5575.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 5575.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_09c3070e Author: unknown
Source: 5575.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 5575.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_148b91a2 Author: unknown
Source: 5575.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 5575.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_dd0d6173 Author: unknown
Source: 5575.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_779e142f Author: unknown
Source: 5575.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_cf84c9f2 Author: unknown
Source: 5575.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_859042a0 Author: unknown
Source: 5575.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 5575.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_fb14e81f Author: unknown

Source: gigops.x86.elf	ELF static info symbol of initial sample: passwords
Source: gigops.x86.elf	ELF static info symbol of initial sample: usernames

Source: gigops.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = cdd0bb9ce40a000bb86b0c76616fe71fb7dbb87a044ddd778b7a07fdf804b877, id = a6a2adb9-9d54-42d4-abed-5b30d8062e97, last_modified = 2021-09-16
Source: gigops.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a10161ce os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 77e89011a67a539954358118d41ad3dabde0e69bac2bbb2b2da18eaad427d935, id = a10161ce-62e0-4f60-9de7-bd8caf8618be, last_modified = 2021-09-16
Source: gigops.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: gigops.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 1c5df68501b688905484ed47dc588306828aa7c114644428e22e5021bb39bd4a, id = f3d83a74-2888-435a-9a3c-b7de25084e9a, last_modified = 2021-09-16
Source: gigops.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a0a4de11 reference_sample = cf1ca1d824c8687e87a5b0275a0e39fa101442b4bbf470859ddda9982f9b3417, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 891cfc6a4c38fb257ada29050e0047bd1301e8f0a6a1a919685b1fcc2960b047, id = a0a4de11-fe65-449f-a990-ad5f18ac66f0, last_modified = 2021-09-16
Source: gigops.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: gigops.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_09c3070e reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 84fad96b60b297736c149e14de12671ff778bff427ab7684df2c541a6f6d7e7d, id = 09c3070e-4b71-45a0-aa62-0cc6e496644a, last_modified = 2021-09-16
Source: gigops.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: gigops.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_148b91a2 reference_sample = d5b2bde0749ff482dc2389971e2ac76c4b1e7b887208a538d5555f0fe6984825, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 0f75090ed840f4601df4e43a2f49f2b32585213f3d86d19fb255d79c21086ba3, id = 148b91a2-ed51-4c2d-9d15-6a48d9ea3e0a, last_modified = 2021-09-16
Source: gigops.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: gigops.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_dd0d6173 reference_sample = c5a317d0d8470814ff343ce78ad2428ebb3f036763fcf703a589b6c4d33a3ec6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 5e2cb111c2b712951b71166111d339724b4f52b93f90cb474f1e67598212605f, id = dd0d6173-b863-45cf-9348-3375a4e624cf, last_modified = 2021-09-16
Source: gigops.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_779e142f reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 83377b6fa77fda4544c409487d2d2c1ddcef8f7d4120f49a18888c7536f3969f, id = 779e142f-b867-46e6-b1fb-9105976f42fd, last_modified = 2021-09-16
Source: gigops.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_cf84c9f2 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = bb766b356c3e8706740e3bb9b4a7171d8eb5137e09fc7ab6952412fa55e2dcfc, id = cf84c9f2-7435-4faf-8c5f-d14945ffad7a, last_modified = 2021-09-16
Source: gigops.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_859042a0 reference_sample = 41615d3f3f27f04669166fdee3996d77890016304ee87851a5f90804d6d4a0b0, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a27bcaa16edceda3dc5a80803372c907a7efd00736c7859c5a9d6a2cf56a8eec, id = 859042a0-a424-4c83-944b-ed182b342998, last_modified = 2021-09-16
Source: gigops.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: gigops.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_fb14e81f severity = 100, os = linux, arch_context = x86, creation_date = 2022-01-05, scan_context = file, memory, reference = 0fd07e6068a721774716eb4940e2c19faef02d5bdacf3b018bf5995fa98a3a27, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 12b430108256bd0f57f48b9dbbea12eba7405c0b3b66a1c4b882647051f1ec52, id = fb14e81f-be2a-4428-9877-958e394a7ae2, last_modified = 2022-01-26
Source: 5577.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = cdd0bb9ce40a000bb86b0c76616fe71fb7dbb87a044ddd778b7a07fdf804b877, id = a6a2adb9-9d54-42d4-abed-5b30d8062e97, last_modified = 2021-09-16
Source: 5577.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a10161ce os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 77e89011a67a539954358118d41ad3dabde0e69bac2bbb2b2da18eaad427d935, id = a10161ce-62e0-4f60-9de7-bd8caf8618be, last_modified = 2021-09-16
Source: 5577.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 5577.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 1c5df68501b688905484ed47dc588306828aa7c114644428e22e5021bb39bd4a, id = f3d83a74-2888-435a-9a3c-b7de25084e9a, last_modified = 2021-09-16
Source: 5577.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a0a4de11 reference_sample = cf1ca1d824c8687e87a5b0275a0e39fa101442b4bbf470859ddda9982f9b3417, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 891cfc6a4c38fb257ada29050e0047bd1301e8f0a6a1a919685b1fcc2960b047, id = a0a4de11-fe65-449f-a990-ad5f18ac66f0, last_modified = 2021-09-16
Source: 5577.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 5577.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_09c3070e reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 84fad96b60b297736c149e14de12671ff778bff427ab7684df2c541a6f6d7e7d, id = 09c3070e-4b71-45a0-aa62-0cc6e496644a, last_modified = 2021-09-16
Source: 5577.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 5577.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_148b91a2 reference_sample = d5b2bde0749ff482dc2389971e2ac76c4b1e7b887208a538d5555f0fe6984825, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 0f75090ed840f4601df4e43a2f49f2b32585213f3d86d19fb255d79c21086ba3, id = 148b91a2-ed51-4c2d-9d15-6a48d9ea3e0a, last_modified = 2021-09-16
Source: 5577.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 5577.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_dd0d6173 reference_sample = c5a317d0d8470814ff343ce78ad2428ebb3f036763fcf703a589b6c4d33a3ec6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 5e2cb111c2b712951b71166111d339724b4f52b93f90cb474f1e67598212605f, id = dd0d6173-b863-45cf-9348-3375a4e624cf, last_modified = 2021-09-16
Source: 5577.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_779e142f reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 83377b6fa77fda4544c409487d2d2c1ddcef8f7d4120f49a18888c7536f3969f, id = 779e142f-b867-46e6-b1fb-9105976f42fd, last_modified = 2021-09-16
Source: 5577.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_cf84c9f2 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = bb766b356c3e8706740e3bb9b4a7171d8eb5137e09fc7ab6952412fa55e2dcfc, id = cf84c9f2-7435-4faf-8c5f-d14945ffad7a, last_modified = 2021-09-16
Source: 5577.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_859042a0 reference_sample = 41615d3f3f27f04669166fdee3996d77890016304ee87851a5f90804d6d4a0b0, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a27bcaa16edceda3dc5a80803372c907a7efd00736c7859c5a9d6a2cf56a8eec, id = 859042a0-a424-4c83-944b-ed182b342998, last_modified = 2021-09-16
Source: 5577.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 5577.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_fb14e81f severity = 100, os = linux, arch_context = x86, creation_date = 2022-01-05, scan_context = file, memory, reference = 0fd07e6068a721774716eb4940e2c19faef02d5bdacf3b018bf5995fa98a3a27, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 12b430108256bd0f57f48b9dbbea12eba7405c0b3b66a1c4b882647051f1ec52, id = fb14e81f-be2a-4428-9877-958e394a7ae2, last_modified = 2022-01-26
Source: 5575.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = cdd0bb9ce40a000bb86b0c76616fe71fb7dbb87a044ddd778b7a07fdf804b877, id = a6a2adb9-9d54-42d4-abed-5b30d8062e97, last_modified = 2021-09-16
Source: 5575.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a10161ce os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 77e89011a67a539954358118d41ad3dabde0e69bac2bbb2b2da18eaad427d935, id = a10161ce-62e0-4f60-9de7-bd8caf8618be, last_modified = 2021-09-16
Source: 5575.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 5575.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 1c5df68501b688905484ed47dc588306828aa7c114644428e22e5021bb39bd4a, id = f3d83a74-2888-435a-9a3c-b7de25084e9a, last_modified = 2021-09-16
Source: 5575.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a0a4de11 reference_sample = cf1ca1d824c8687e87a5b0275a0e39fa101442b4bbf470859ddda9982f9b3417, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 891cfc6a4c38fb257ada29050e0047bd1301e8f0a6a1a919685b1fcc2960b047, id = a0a4de11-fe65-449f-a990-ad5f18ac66f0, last_modified = 2021-09-16
Source: 5575.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 5575.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_09c3070e reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 84fad96b60b297736c149e14de12671ff778bff427ab7684df2c541a6f6d7e7d, id = 09c3070e-4b71-45a0-aa62-0cc6e496644a, last_modified = 2021-09-16
Source: 5575.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 5575.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_148b91a2 reference_sample = d5b2bde0749ff482dc2389971e2ac76c4b1e7b887208a538d5555f0fe6984825, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 0f75090ed840f4601df4e43a2f49f2b32585213f3d86d19fb255d79c21086ba3, id = 148b91a2-ed51-4c2d-9d15-6a48d9ea3e0a, last_modified = 2021-09-16
Source: 5575.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 5575.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_dd0d6173 reference_sample = c5a317d0d8470814ff343ce78ad2428ebb3f036763fcf703a589b6c4d33a3ec6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 5e2cb111c2b712951b71166111d339724b4f52b93f90cb474f1e67598212605f, id = dd0d6173-b863-45cf-9348-3375a4e624cf, last_modified = 2021-09-16
Source: 5575.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_779e142f reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 83377b6fa77fda4544c409487d2d2c1ddcef8f7d4120f49a18888c7536f3969f, id = 779e142f-b867-46e6-b1fb-9105976f42fd, last_modified = 2021-09-16
Source: 5575.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_cf84c9f2 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = bb766b356c3e8706740e3bb9b4a7171d8eb5137e09fc7ab6952412fa55e2dcfc, id = cf84c9f2-7435-4faf-8c5f-d14945ffad7a, last_modified = 2021-09-16
Source: 5575.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_859042a0 reference_sample = 41615d3f3f27f04669166fdee3996d77890016304ee87851a5f90804d6d4a0b0, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a27bcaa16edceda3dc5a80803372c907a7efd00736c7859c5a9d6a2cf56a8eec, id = 859042a0-a424-4c83-944b-ed182b342998, last_modified = 2021-09-16
Source: 5575.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 5575.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_fb14e81f severity = 100, os = linux, arch_context = x86, creation_date = 2022-01-05, scan_context = file, memory, reference = 0fd07e6068a721774716eb4940e2c19faef02d5bdacf3b018bf5995fa98a3a27, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 12b430108256bd0f57f48b9dbbea12eba7405c0b3b66a1c4b882647051f1ec52, id = fb14e81f-be2a-4428-9877-958e394a7ae2, last_modified = 2022-01-26

Source: classification engine

Classification label: mal88.spre.troj.linELF@0/0@2/0

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match

File source: gigops.x86.elf, type: SAMPLE

Remote Access Functionality

Yara detected Gafgyt

Source: Yara match

File source: gigops.x86.elf, type: SAMPLE

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Masquerading	OS Credential Dumping	1 Remote System Discovery	Remote Services	Data from Local System	1 Non-Application Layer Protocol	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service

Malware Configuration

Threatname: Gafgyt

{"C2 url": "45.128.233.186:23"}

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
gigops.x86.elf	71%	ReversingLabs	Linux.Backdoor.Gafgyt
gigops.x86.elf	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
45.128.233.186:23	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://5.206.225.136/bins.sh;	gigops.x86.elf	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
45.128.233.186	unknown	United Kingdom		208861	RACKTECHRU	true

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
45.128.233.186	gigops.arm6.elf	Get hash	malicious	Gafgyt	Browse
45.128.233.186	gigops.mips.elf	Get hash	malicious	Gafgyt	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
RACKTECHRU	gigops.arm6.elf	Get hash	malicious	Gafgyt	Browse	45.128.233.186
	gigops.mips.elf	Get hash	malicious	Gafgyt	Browse	45.128.233.186
	lEwK4xROgV.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	86.110.194.28
	zZ1Y43bxxV.exe	Get hash	malicious	DCRat	Browse	86.110.194.28
	updIMdPUj8.exe	Get hash	malicious	DCRat	Browse	86.110.194.28
	jew.sh4.elf	Get hash	malicious	Unknown	Browse	91.223.144.119
	la.bot.mipsel.elf	Get hash	malicious	Unknown	Browse	193.38.236.134
	oyCvLcfl3R.exe	Get hash	malicious	XenoRAT	Browse	194.113.106.81
	qsKo.ps1	Get hash	malicious	RHADAMANTHYS	Browse	194.113.106.180
	GsrDwm0DJG.ps1	Get hash	malicious	RHADAMANTHYS	Browse	194.113.106.180

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, not stripped
Entropy (8bit):	5.8089385713036314
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	gigops.x86.elf
File size:	108'206 bytes
MD5:	9a448f36d365af48793fb990dd3887ba
SHA1:	9cc785b11c52d7f303f7b68fd2df56acf4e98631
SHA256:	5a6d6fb1cc8d68b3eab81c15dcc9469544039a986641cb7012e5ea7e3a5ac00d
SHA512:	bda7f84ed9e941cbc3220225cd4034bd57839ce13881212e3e48ab09bb91379d7e14c74b4ab9f5a1a67f79ac470d56a0ef79c52d8e66c9a6c1363a05ffb841c5
SSDEEP:	3072:fPjb2cSEJNpdYmQ+70iRuC7GhfVeVOwGC8Qnv:PHYMIyGDeD8Qv
TLSH:	9AB32A1BC62080BEC08753752BDF9921E973BC750735620A6385BF682F3A99CDE593D2
File Content Preview:	.ELF..............>.......@.....@........@..........@.8...@.......................@.......@.....x.......x......... .............x.......x.a.....x.a......(................ .....Q.td....................................................H...._....*...H........

Static ELF Info

ELF header
Class:	ELF64
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Advanced Micro Devices X86-64
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x400194
Flags:	0x0
ELF Header Size:	64
Program Header Offset:	64
Program Header Size:	56
Number of Program Headers:	3
Section Header Offset:	81920
Section Header Size:	64
Number of Section Headers:	15
Header String Table Index:	12

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x4000e8	0xe8	0x13	0x0	0x6	AX	0	0	1
.text	PROGBITS	0x400100	0x100	0xe254	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x40e354	0xe354	0xe	0x0	0x6	AX	0	0	1
.rodata	PROGBITS	0x40e380	0xe380	0x28f8	0x0	0x2	A	0	0	32
.eh_frame	PROGBITS	0x610c78	0x10c78	0x23a4	0x0	0x3	WA	0	0	8
.ctors	PROGBITS	0x613020	0x13020	0x10	0x0	0x3	WA	0	0	8
.dtors	PROGBITS	0x613030	0x13030	0x10	0x0	0x3	WA	0	0	8
.jcr	PROGBITS	0x613040	0x13040	0x8	0x0	0x3	WA	0	0	8
.data	PROGBITS	0x613060	0x13060	0x4c0	0x0	0x3	WA	0	0	32
.bss	NOBITS	0x613520	0x13520	0x68f8	0x0	0x3	WA	0	0	32
.comment	PROGBITS	0x0	0x13520	0xa7a	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x13f9a	0x66	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x143c0	0x42a8	0x18	0x0		14	235	8
.strtab	STRTAB	0x0	0x18668	0x2046	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x10c78	0x10c78	6.2033	0x5	R E	0x200000	.init .text .fini .rodata
LOAD	0x10c78	0x610c78	0x610c78	0x28a8	0x91a0	3.5511	0x6	RW	0x200000	.eh_frame .ctors .dtors .jcr .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x8

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x4000e8	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x400100	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x40e354	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x40e380	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x610c78	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x613020	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x613030	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x613040	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x613060	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x613520	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	11
C.1.3849	.symtab	0x410b40	40	OBJECT	<unknown>	DEFAULT	4
Q	.symtab	0x6135a0	16384	OBJECT	<unknown>	DEFAULT	10
StartTheLelz	.symtab	0x402556	4858	FUNC	<unknown>	DEFAULT	2
_Exit	.symtab	0x406dd0	43	FUNC	<unknown>	DEFAULT	2
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x613028	0	OBJECT	<unknown>	DEFAULT	6
__CTOR_LIST__	.symtab	0x613020	0	OBJECT	<unknown>	DEFAULT	6
__C_ctype_b	.symtab	0x613158	8	OBJECT	<unknown>	DEFAULT	9
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x40f090	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x613168	8	OBJECT	<unknown>	DEFAULT	9
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x40f390	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x613038	0	OBJECT	<unknown>	DEFAULT	7
__DTOR_LIST__	.symtab	0x613030	0	OBJECT	<unknown>	DEFAULT	7
__EH_FRAME_BEGIN__	.symtab	0x610c78	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x613018	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x613158	8	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_toupper	.symtab	0x613168	8	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_b	.symtab	0x613160	8	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_toupper	.symtab	0x613170	8	OBJECT	<unknown>	HIDDEN	9
__GI___errno_location	.symtab	0x407168	6	FUNC	<unknown>	HIDDEN	2
__GI___fcntl_nocancel	.symtab	0x406d6c	100	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x40d010	222	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x408f18	14	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x406d08	100	FUNC	<unknown>	HIDDEN	2
__GI___sigaddset	.symtab	0x4098cc	28	FUNC	<unknown>	HIDDEN	2
__GI___sigdelset	.symtab	0x4098e8	30	FUNC	<unknown>	HIDDEN	2
__GI___sigismember	.symtab	0x4098ac	32	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x40b168	70	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x40b1e3	58	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x408f28	196	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x406dd0	43	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x40a610	200	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x40aab4	18	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x40db78	43	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0x406dfc	38	FUNC	<unknown>	HIDDEN	2
__GI_clock_getres	.symtab	0x40b658	41	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x406e24	41	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0x40b7ac	147	FUNC	<unknown>	HIDDEN	2
__GI_config_close	.symtab	0x40bd3a	43	FUNC	<unknown>	HIDDEN	2
__GI_config_open	.symtab	0x40bd65	46	FUNC	<unknown>	HIDDEN	2
__GI_config_read	.symtab	0x40ba78	706	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x409688	43	FUNC	<unknown>	HIDDEN	2
__GI_dup2	.symtab	0x406e50	44	FUNC	<unknown>	HIDDEN	2
__GI_errno	.symtab	0x619658	4	OBJECT	<unknown>	HIDDEN	10
__GI_execl	.symtab	0x40ac88	287	FUNC	<unknown>	HIDDEN	2
__GI_execve	.symtab	0x40b684	38	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x40ac28	95	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x40be64	269	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x406d08	100	FUNC	<unknown>	HIDDEN	2
__GI_fdopen	.symtab	0x40bf74	53	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x40cecc	322	FUNC	<unknown>	HIDDEN	2
__GI_fgetc	.symtab	0x40cd00	128	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x40d010	222	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x40cd80	116	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x40d0f0	116	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x40bfac	10	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x406e7c	38	FUNC	<unknown>	HIDDEN	2
__GI_fprintf	.symtab	0x407240	142	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x4085ac	56	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x40df48	5	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x40df50	225	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x40dba4	82	FUNC	<unknown>	HIDDEN	2
__GI_fstat64	.symtab	0x40dba4	82	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x4085e4	128	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x40d010	222	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x406ea4	36	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x40b6ac	8	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x40b6b4	8	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x40b6bc	8	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x40b6c4	19	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x406ec8	8	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x406ed0	40	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x4096b4	41	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x40b6d8	8	FUNC	<unknown>	HIDDEN	2
__GI_h_errno	.symtab	0x61965c	4	OBJECT	<unknown>	HIDDEN	10
__GI_htonl	.symtab	0x40908c	5	FUNC	<unknown>	HIDDEN	2
__GI_htons	.symtab	0x409084	8	FUNC	<unknown>	HIDDEN	2
__GI_inet_addr	.symtab	0x409668	29	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x40d65c	135	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa	.symtab	0x40965d	10	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa_r	.symtab	0x409610	77	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x409407	518	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x409127	493	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x40a9f8	185	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x406ef8	101	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x408ff8	25	FUNC	<unknown>	HIDDEN	2
__GI_isspace	.symtab	0x407134	18	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x406f60	44	FUNC	<unknown>	HIDDEN	2
__GI_lseek	.symtab	0x40e2ec	45	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x40e2e4	5	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x40d2e0	236	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x408670	102	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x40d170	90	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x40d3cc	233	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x4086e0	210	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x40b628	48	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x40dbf8	42	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x40b6e0	38	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x40b708	38	FUNC	<unknown>	HIDDEN	2
__GI_ntohl	.symtab	0x409099	5	FUNC	<unknown>	HIDDEN	2
__GI_ntohs	.symtab	0x409091	8	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x406f8c	106	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0x40b8d5	157	FUNC	<unknown>	HIDDEN	2
__GI_perror	.symtab	0x407170	45	FUNC	<unknown>	HIDDEN	2
__GI_pipe	.symtab	0x406ff8	38	FUNC	<unknown>	HIDDEN	2
__GI_printf	.symtab	0x4071a0	157	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x40d6e4	18	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x40a6e4	72	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x40a8e7	90	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x40e224	189	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x40704c	39	FUNC	<unknown>	HIDDEN	2
__GI_readdir64	.symtab	0x40b9e8	143	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x409714	11	FUNC	<unknown>	HIDDEN	2
__GI_recvfrom	.symtab	0x409720	45	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x40b730	74	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x407074	44	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x409750	11	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x40975c	48	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x4070a0	38	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x40978c	53	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x40a83c	171	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x40b5b5	114	FUNC	<unknown>	HIDDEN	2
__GI_sigaddset	.symtab	0x4097f4	35	FUNC	<unknown>	HIDDEN	2
__GI_sigemptyset	.symtab	0x409818	10	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x409824	133	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x4070c8	47	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x40ada8	142	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x4097c4	47	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x40bfb8	149	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x40a941	183	FUNC	<unknown>	HIDDEN	2
__GI_strcat	.symtab	0x4087c0	428	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x408970	417	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul	.symtab	0x40d4b8	268	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x408b14	33	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x408b14	33	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x408b40	213	FUNC	<unknown>	HIDDEN	2
__GI_strcspn	.symtab	0x40d1d0	135	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x408c20	225	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x408d04	131	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x408d88	201	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x40e198	140	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x40d5c4	53	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x40d258	135	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x408e54	193	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x408fec	10	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x40d5fc	94	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x40aac8	10	FUNC	<unknown>	HIDDEN	2
__GI_strtoll	.symtab	0x40aac8	10	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x40af17	560	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x409014	110	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x4070f8	8	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x407148	30	FUNC	<unknown>	HIDDEN	2
__GI_vfork	.symtab	0x406cf0	21	FUNC	<unknown>	HIDDEN	2
__GI_vfprintf	.symtab	0x407698	150	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x40c050	189	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x40b77c	47	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x407100	7	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x40bd94	68	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x40bde8	123	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x40bdd8	15	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x407108	42	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x613040	0	OBJECT	<unknown>	DEFAULT	8
__JCR_LIST__	.symtab	0x613040	0	OBJECT	<unknown>	DEFAULT	8
__app_fini	.symtab	0x619648	8	OBJECT	<unknown>	HIDDEN	10
__atexit_lock	.symtab	0x6134e0	40	OBJECT	<unknown>	DEFAULT	9
__bss_start	.symtab	0x613520	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x40b1ae	53	FUNC	<unknown>	DEFAULT	2
__ctype_b	.symtab	0x613160	8	OBJECT	<unknown>	DEFAULT	9
__ctype_toupper	.symtab	0x613170	8	OBJECT	<unknown>	DEFAULT	9
__curbrk	.symtab	0x619660	8	OBJECT	<unknown>	HIDDEN	10
__data_start	.symtab	0x613070	0	NOTYPE	<unknown>	DEFAULT	9
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__do_global_ctors_aux	.symtab	0x40e320	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x400100	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x613060	0	OBJECT	<unknown>	HIDDEN	9
__environ	.symtab	0x619638	8	OBJECT	<unknown>	DEFAULT	10
__errno_location	.symtab	0x407168	6	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x619628	8	OBJECT	<unknown>	HIDDEN	10
__fcntl_nocancel	.symtab	0x406d6c	100	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x40d010	222	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x61301c	0	NOTYPE	<unknown>	HIDDEN	5
__fini_array_start	.symtab	0x61301c	0	NOTYPE	<unknown>	HIDDEN	5
__getdents	.symtab	0x40de28	288	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x40de28	288	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x40b6c4	19	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x408f18	14	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__h_errno_location	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__init_array_end	.symtab	0x61301c	0	NOTYPE	<unknown>	HIDDEN	5
__init_array_start	.symtab	0x61301c	0	NOTYPE	<unknown>	HIDDEN	5
__libc_close	.symtab	0x406e24	41	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x409688	43	FUNC	<unknown>	DEFAULT	2
__libc_fcntl	.symtab	0x406d08	100	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x406e7c	38	FUNC	<unknown>	DEFAULT	2
__libc_lseek	.symtab	0x40e2ec	45	FUNC	<unknown>	DEFAULT	2
__libc_lseek64	.symtab	0x40e2e4	5	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0x40b708	38	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x406f8c	106	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x40704c	39	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x409714	11	FUNC	<unknown>	DEFAULT	2
__libc_recvfrom	.symtab	0x409720	45	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x407074	44	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x409750	11	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x40975c	48	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x40b5b5	114	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x619630	8	OBJECT	<unknown>	DEFAULT	10
__libc_system	.symtab	0x40b458	316	FUNC	<unknown>	DEFAULT	2
__libc_waitpid	.symtab	0x407100	7	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x407108	42	FUNC	<unknown>	DEFAULT	2
__malloc_consolidate	.symtab	0x40a29a	407	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x409908	110	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x6133a0	40	OBJECT	<unknown>	DEFAULT	9
__malloc_state	.symtab	0x619730	1752	OBJECT	<unknown>	DEFAULT	10
__malloc_trim	.symtab	0x40a204	150	FUNC	<unknown>	DEFAULT	2
__pagesize	.symtab	0x619640	8	OBJECT	<unknown>	DEFAULT	10
__preinit_array_end	.symtab	0x61301c	0	NOTYPE	<unknown>	HIDDEN	5
__preinit_array_start	.symtab	0x61301c	0	NOTYPE	<unknown>	HIDDEN	5
__progname	.symtab	0x613510	8	OBJECT	<unknown>	DEFAULT	9
__progname_full	.symtab	0x613518	8	OBJECT	<unknown>	DEFAULT	9
__pthread_initialize_minimal	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0x40b14b	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x40b148	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x40b148	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x40b148	3	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x40b148	3	FUNC	<unknown>	DEFAULT	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__restore_rt	.symtab	0x40b5ac	0	NOTYPE	<unknown>	DEFAULT	2
__rtld_fini	.symtab	0x619650	8	OBJECT	<unknown>	HIDDEN	10
__sigaddset	.symtab	0x4098cc	28	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x4098e8	30	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x4098ac	32	FUNC	<unknown>	DEFAULT	2
__stdin	.symtab	0x613198	8	OBJECT	<unknown>	DEFAULT	9
__stdio_READ	.symtab	0x40e034	58	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x40c110	171	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x40e070	131	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x40c3f0	259	FUNC	<unknown>	HIDDEN	2
__stdio_init_mutex	.symtab	0x4075d7	15	FUNC	<unknown>	HIDDEN	2
__stdio_mutex_initializer.4920	.symtab	0x40f6b0	40	OBJECT	<unknown>	DEFAULT	4
__stdio_rfill	.symtab	0x40e0f4	37	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x40e178	31	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x40e11c	90	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x40c4f4	149	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x407670	39	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x6131a0	8	OBJECT	<unknown>	DEFAULT	9
__syscall_error	.symtab	0x40b594	22	FUNC	<unknown>	HIDDEN	2
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uClibc_fini	.symtab	0x40b168	70	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x40b1e3	58	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x40b21d	570	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x613508	8	OBJECT	<unknown>	HIDDEN	9
__vfork	.symtab	0x406cf0	21	FUNC	<unknown>	HIDDEN	2
__xpg_strerror_r	.symtab	0x408f28	196	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__xstat32_conv	.symtab	0x40dcd0	172	FUNC	<unknown>	HIDDEN	2
__xstat64_conv	.symtab	0x40dc24	172	FUNC	<unknown>	HIDDEN	2
__xstat_conv	.symtab	0x40dd7c	172	FUNC	<unknown>	HIDDEN	2
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_bss_custom_printf_spec	.symtab	0x6195f0	10	OBJECT	<unknown>	DEFAULT	10
_charpad	.symtab	0x407730	77	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_custom_printf_arginfo	.symtab	0x619680	80	OBJECT	<unknown>	HIDDEN	10
_custom_printf_handler	.symtab	0x6196d0	80	OBJECT	<unknown>	HIDDEN	10
_custom_printf_spec	.symtab	0x613390	8	OBJECT	<unknown>	HIDDEN	9
_dl_aux_init	.symtab	0x40db60	23	FUNC	<unknown>	DEFAULT	2
_dl_phdr	.symtab	0x619e08	8	OBJECT	<unknown>	DEFAULT	10
_dl_phnum	.symtab	0x619e10	8	OBJECT	<unknown>	DEFAULT	10
_edata	.symtab	0x613520	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x619e18	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_errno	.symtab	0x619658	4	OBJECT	<unknown>	DEFAULT	10
_exit	.symtab	0x406dd0	43	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x40e354	0	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x6175f0	8192	OBJECT	<unknown>	DEFAULT	10
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x40777d	120	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x40c6e0	1565	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_h_errno	.symtab	0x61965c	4	OBJECT	<unknown>	DEFAULT	10
_init	.symtab	0x4000e8	0	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x40c58c	85	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_init	.symtab	0x407eac	114	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x408146	1126	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x407f20	67	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x407f64	436	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x408118	46	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x40b156	18	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x40b14e	8	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_sigintr	.symtab	0x619720	8	OBJECT	<unknown>	HIDDEN	10
_start	.symtab	0x400194	42	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x40c1bc	563	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x407578	95	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x6131a8	8	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_add_lock	.symtab	0x6131b0	40	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_dec_use	.symtab	0x40cdf4	216	FUNC	<unknown>	HIDDEN	2
_stdio_openlist_del_count	.symtab	0x6175e4	4	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_del_lock	.symtab	0x6131e0	40	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_use_count	.symtab	0x6175e0	4	OBJECT	<unknown>	DEFAULT	10
_stdio_streams	.symtab	0x613210	384	OBJECT	<unknown>	DEFAULT	9
_stdio_term	.symtab	0x4075e6	135	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x613208	4	OBJECT	<unknown>	DEFAULT	9
_stdlib_strto_l	.symtab	0x40aad4	339	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x40c5e4	46	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x40f7b0	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x40c614	201	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x4077f5	1716	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x40a610	200	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
adaptiveHOLD	.symtab	0x404771	1642	FUNC	<unknown>	DEFAULT	2
atoi	.symtab	0x40aab4	18	FUNC	<unknown>	DEFAULT	2
atoi.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
been_there_done_that	.symtab	0x619620	4	OBJECT	<unknown>	DEFAULT	10
brk	.symtab	0x40db78	43	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x409824	133	FUNC	<unknown>	DEFAULT	2
buf.3312	.symtab	0x619610	16	OBJECT	<unknown>	DEFAULT	10
c	.symtab	0x613150	4	OBJECT	<unknown>	DEFAULT	9
calloc	.symtab	0x40d6f8	248	FUNC	<unknown>	DEFAULT	2
calloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
chdir	.symtab	0x406dfc	38	FUNC	<unknown>	DEFAULT	2
chdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
clock_getres	.symtab	0x40b658	41	FUNC	<unknown>	DEFAULT	2
clock_getres.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x406e24	41	FUNC	<unknown>	DEFAULT	2
close.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
closedir	.symtab	0x40b7ac	147	FUNC	<unknown>	DEFAULT	2
closedir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
commServer	.symtab	0x613088	8	OBJECT	<unknown>	DEFAULT	9
completed.5156	.symtab	0x613520	1	OBJECT	<unknown>	DEFAULT	10
connect	.symtab	0x409688	43	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connectTimeout	.symtab	0x4017c8	582	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
csum	.symtab	0x402372	116	FUNC	<unknown>	DEFAULT	2
currentServer	.symtab	0x613090	4	OBJECT	<unknown>	DEFAULT	9
data_start	.symtab	0x613070	0	NOTYPE	<unknown>	DEFAULT	9
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dup2	.symtab	0x406e50	44	FUNC	<unknown>	DEFAULT	2
dup2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ	.symtab	0x619638	8	OBJECT	<unknown>	DEFAULT	10
errno	.symtab	0x619658	4	OBJECT	<unknown>	DEFAULT	10
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execl	.symtab	0x40ac88	287	FUNC	<unknown>	DEFAULT	2
execl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execve	.symtab	0x40b684	38	FUNC	<unknown>	DEFAULT	2
execve.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x40ac28	95	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x410b90	208	OBJECT	<unknown>	DEFAULT	4
fclose	.symtab	0x40be64	269	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x406d08	100	FUNC	<unknown>	DEFAULT	2
fd_to_DIR	.symtab	0x40b840	149	FUNC	<unknown>	DEFAULT	2
fdgets	.symtab	0x40105d	130	FUNC	<unknown>	DEFAULT	2
fdopen	.symtab	0x40bf74	53	FUNC	<unknown>	DEFAULT	2
fdopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fdopen_pids	.symtab	0x6175a0	8	OBJECT	<unknown>	DEFAULT	10
fdopendir	.symtab	0x40b972	115	FUNC	<unknown>	DEFAULT	2
fdpclose	.symtab	0x400f35	296	FUNC	<unknown>	DEFAULT	2
fdpopen	.symtab	0x400d5c	473	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x40cecc	322	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc	.symtab	0x40cd00	128	FUNC	<unknown>	DEFAULT	2
fgetc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x40d010	222	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x40cd80	116	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x40d0f0	116	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fmt	.symtab	0x410b70	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x40bfac	10	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0x406e7c	38	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fprintf	.symtab	0x407240	142	FUNC	<unknown>	DEFAULT	2
fprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs_unlocked	.symtab	0x4085ac	56	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x400150	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x40a431	451	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x40df48	5	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x40df48	5	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x40df50	225	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fstat	.symtab	0x40dba4	82	FUNC	<unknown>	DEFAULT	2
fstat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fstat64	.symtab	0x40dba4	82	FUNC	<unknown>	DEFAULT	2
fuckit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fwrite_unlocked	.symtab	0x4085e4	128	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getBogos	.symtab	0x4012eb	389	FUNC	<unknown>	DEFAULT	2
getBuild	.symtab	0x40664e	11	FUNC	<unknown>	DEFAULT	2
getCores	.symtab	0x401470	151	FUNC	<unknown>	DEFAULT	2
getHost	.symtab	0x40126e	65	FUNC	<unknown>	DEFAULT	2
getOurIP	.symtab	0x40646b	483	FUNC	<unknown>	DEFAULT	2
getRandomIP	.symtab	0x402343	47	FUNC	<unknown>	DEFAULT	2
getRandomPublicIP	.symtab	0x401f81	962	FUNC	<unknown>	DEFAULT	2
getc	.symtab	0x40cd00	128	FUNC	<unknown>	DEFAULT	2
getc_unlocked	.symtab	0x40d010	222	FUNC	<unknown>	DEFAULT	2
getdents64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdtablesize	.symtab	0x406ea4	36	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x40b6ac	8	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x40b6b4	8	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x40b6bc	8	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpagesize	.symtab	0x40b6c4	19	FUNC	<unknown>	DEFAULT	2
getpagesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x406ec8	8	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x406ed0	40	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit64	.symtab	0x406ed0	40	FUNC	<unknown>	DEFAULT	2
getsockname	.symtab	0x4096b4	41	FUNC	<unknown>	DEFAULT	2
getsockname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x4096e0	50	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x40b6d8	8	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gotIP	.symtab	0x613584	4	OBJECT	<unknown>	DEFAULT	10
h_errno	.symtab	0x61965c	4	OBJECT	<unknown>	DEFAULT	10
hextable	.symtab	0x40e5c0	2048	OBJECT	<unknown>	DEFAULT	4
htonl	.symtab	0x40908c	5	FUNC	<unknown>	DEFAULT	2
htons	.symtab	0x409084	8	FUNC	<unknown>	DEFAULT	2
i.4987	.symtab	0x613154	4	OBJECT	<unknown>	DEFAULT	9
index	.symtab	0x408970	417	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x409668	29	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x40d65c	135	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa	.symtab	0x40965d	10	FUNC	<unknown>	DEFAULT	2
inet_ntoa.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa_r	.symtab	0x409610	77	FUNC	<unknown>	DEFAULT	2
inet_ntop	.symtab	0x409407	518	FUNC	<unknown>	DEFAULT	2
inet_ntop4	.symtab	0x409314	243	FUNC	<unknown>	DEFAULT	2
inet_pton	.symtab	0x409127	493	FUNC	<unknown>	DEFAULT	2
inet_pton4	.symtab	0x4090a0	135	FUNC	<unknown>	DEFAULT	2
infectline	.symtab	0x613080	8	OBJECT	<unknown>	DEFAULT	9
initConnection	.symtab	0x406343	296	FUNC	<unknown>	DEFAULT	2
init_rand	.symtab	0x4001c0	126	FUNC	<unknown>	DEFAULT	2
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initstate	.symtab	0x40a786	110	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x40a9f8	185	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x406ef8	101	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ipState	.symtab	0x6175a8	5	OBJECT	<unknown>	DEFAULT	10
isatty	.symtab	0x408ff8	25	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isspace	.symtab	0x407134	18	FUNC	<unknown>	DEFAULT	2
isspace.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0x406f60	44	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
listFork	.symtab	0x401a0e	211	FUNC	<unknown>	DEFAULT	2
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek	.symtab	0x40e2ec	45	FUNC	<unknown>	DEFAULT	2
lseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x40e2e4	5	FUNC	<unknown>	DEFAULT	2
macAddress	.symtab	0x613590	6	OBJECT	<unknown>	DEFAULT	10
main	.symtab	0x406659	1684	FUNC	<unknown>	DEFAULT	2
mainCommSock	.symtab	0x613580	4	OBJECT	<unknown>	DEFAULT	10
makeIPPacket	.symtab	0x40248f	153	FUNC	<unknown>	DEFAULT	2
makeRandomStr	.symtab	0x401507	110	FUNC	<unknown>	DEFAULT	2
malloc	.symtab	0x409976	2187	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
malloc_trim	.symtab	0x40a5f4	28	FUNC	<unknown>	DEFAULT	2
matchPrompt	.symtab	0x401c05	303	FUNC	<unknown>	DEFAULT	2
memchr	.symtab	0x40d2e0	236	FUNC	<unknown>	DEFAULT	2
memchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memcpy	.symtab	0x408670	102	FUNC	<unknown>	DEFAULT	2
mempcpy	.symtab	0x40d170	90	FUNC	<unknown>	DEFAULT	2
memrchr	.symtab	0x40d3cc	233	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x4086e0	210	FUNC	<unknown>	DEFAULT	2
mmap	.symtab	0x40b628	48	FUNC	<unknown>	DEFAULT	2
mmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mremap	.symtab	0x40dbf8	42	FUNC	<unknown>	DEFAULT	2
mremap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
munmap	.symtab	0x40b6e0	38	FUNC	<unknown>	DEFAULT	2
munmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mylock	.symtab	0x6175b0	40	OBJECT	<unknown>	DEFAULT	10
mylock	.symtab	0x6133d0	40	OBJECT	<unknown>	DEFAULT	9
mylock	.symtab	0x613400	40	OBJECT	<unknown>	DEFAULT	9
nanosleep	.symtab	0x40b708	38	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
negotiate	.symtab	0x401ae1	292	FUNC	<unknown>	DEFAULT	2
next_start.1699	.symtab	0x619600	8	OBJECT	<unknown>	DEFAULT	10
nprocessors_onln	.symtab	0x40ae38	223	FUNC	<unknown>	DEFAULT	2
ntohl	.symtab	0x409099	5	FUNC	<unknown>	DEFAULT	2
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0x409091	8	FUNC	<unknown>	DEFAULT	2
ntop.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
numpids	.symtab	0x613588	8	OBJECT	<unknown>	DEFAULT	10
object.5168	.symtab	0x613540	48	OBJECT	<unknown>	DEFAULT	10
open	.symtab	0x406f8c	106	FUNC	<unknown>	DEFAULT	2
open.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opendir	.symtab	0x40b8d5	157	FUNC	<unknown>	DEFAULT	2
opendir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ourIP	.symtab	0x619668	4	OBJECT	<unknown>	DEFAULT	10
p.5154	.symtab	0x613068	0	OBJECT	<unknown>	DEFAULT	9
parseHex	.symtab	0x4010df	85	FUNC	<unknown>	DEFAULT	2
parse_config.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
passwords	.symtab	0x6130e0	112	OBJECT	<unknown>	DEFAULT	9
pclose	.symtab	0x4072d0	193	FUNC	<unknown>	DEFAULT	2
perror	.symtab	0x407170	45	FUNC	<unknown>	DEFAULT	2
perror.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pids	.symtab	0x619670	8	OBJECT	<unknown>	DEFAULT	10
pipe	.symtab	0x406ff8	38	FUNC	<unknown>	DEFAULT	2
pipe.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
popen	.symtab	0x407391	485	FUNC	<unknown>	DEFAULT	2
popen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
popen_list	.symtab	0x6175d8	8	OBJECT	<unknown>	DEFAULT	10
prctl	.symtab	0x407020	44	FUNC	<unknown>	DEFAULT	2
prctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prefix.5143	.symtab	0x40f6e8	12	OBJECT	<unknown>	DEFAULT	4
print	.symtab	0x40061d	1084	FUNC	<unknown>	DEFAULT	2
printchar	.symtab	0x4003aa	75	FUNC	<unknown>	DEFAULT	2
printf	.symtab	0x4071a0	157	FUNC	<unknown>	DEFAULT	2
printf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
printi	.symtab	0x4004dc	321	FUNC	<unknown>	DEFAULT	2
prints	.symtab	0x4003f5	231	FUNC	<unknown>	DEFAULT	2
processCmd	.symtab	0x405282	4289	FUNC	<unknown>	DEFAULT	2
program_invocation_name	.symtab	0x613518	8	OBJECT	<unknown>	DEFAULT	9
program_invocation_short_name	.symtab	0x613510	8	OBJECT	<unknown>	DEFAULT	9
qual_chars.5150	.symtab	0x40f700	20	OBJECT	<unknown>	DEFAULT	4
raise	.symtab	0x40d6e4	18	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x40a6d8	11	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand_cmwc	.symtab	0x40023e	182	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x40a6e4	72	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x410330	40	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x40a8e7	90	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randtbl	.symtab	0x613460	128	OBJECT	<unknown>	DEFAULT	9
rawmemchr	.symtab	0x40e224	189	FUNC	<unknown>	DEFAULT	2
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read	.symtab	0x40704c	39	FUNC	<unknown>	DEFAULT	2
read.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
readUntil	.symtab	0x401d34	589	FUNC	<unknown>	DEFAULT	2
readdir64	.symtab	0x40b9e8	143	FUNC	<unknown>	DEFAULT	2
readdir64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
realloc	.symtab	0x40d7f0	878	FUNC	<unknown>	DEFAULT	2
realloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recv	.symtab	0x409714	11	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recvLine	.symtab	0x401575	595	FUNC	<unknown>	DEFAULT	2
recvfrom	.symtab	0x409720	45	FUNC	<unknown>	DEFAULT	2
recvfrom.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rindex	.symtab	0x40d5c4	53	FUNC	<unknown>	DEFAULT	2
sbrk	.symtab	0x40b730	74	FUNC	<unknown>	DEFAULT	2
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
scanPid	.symtab	0x61966c	4	OBJECT	<unknown>	DEFAULT	10
sclose	.symtab	0x402528	46	FUNC	<unknown>	DEFAULT	2
select	.symtab	0x407074	44	FUNC	<unknown>	DEFAULT	2
select.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send	.symtab	0x409750	11	FUNC	<unknown>	DEFAULT	2
send.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sendCNC	.symtab	0x403d35	161	FUNC	<unknown>	DEFAULT	2
sendHOLD	.symtab	0x404ddb	1191	FUNC	<unknown>	DEFAULT	2
sendHTTP	.symtab	0x403dd6	126	FUNC	<unknown>	DEFAULT	2
sendJUNK	.symtab	0x404350	1057	FUNC	<unknown>	DEFAULT	2
sendTCP	.symtab	0x403e54	1276	FUNC	<unknown>	DEFAULT	2
sendUDP	.symtab	0x403850	1253	FUNC	<unknown>	DEFAULT	2
sendto	.symtab	0x40975c	48	FUNC	<unknown>	DEFAULT	2
sendto.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsid	.symtab	0x4070a0	38	FUNC	<unknown>	DEFAULT	2
setsid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsockopt	.symtab	0x40978c	53	FUNC	<unknown>	DEFAULT	2
setsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate	.symtab	0x40a72c	90	FUNC	<unknown>	DEFAULT	2
setstate_r	.symtab	0x40a83c	171	FUNC	<unknown>	DEFAULT	2
sigaction	.symtab	0x40b5b5	114	FUNC	<unknown>	DEFAULT	2
sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigaddset	.symtab	0x4097f4	35	FUNC	<unknown>	DEFAULT	2
sigaddset.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigempty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigemptyset	.symtab	0x409818	10	FUNC	<unknown>	DEFAULT	2
signal	.symtab	0x409824	133	FUNC	<unknown>	DEFAULT	2
signal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigprocmask	.symtab	0x4070c8	47	FUNC	<unknown>	DEFAULT	2
sigprocmask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigsetops.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sleep	.symtab	0x40ada8	142	FUNC	<unknown>	DEFAULT	2
sleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket	.symtab	0x4097c4	47	FUNC	<unknown>	DEFAULT	2
socket.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sockprintf	.symtab	0x400bf1	363	FUNC	<unknown>	DEFAULT	2
spec_and_mask.5149	.symtab	0x40f720	16	OBJECT	<unknown>	DEFAULT	4
spec_base.5142	.symtab	0x40f6f4	7	OBJECT	<unknown>	DEFAULT	4
spec_chars.5146	.symtab	0x40f780	21	OBJECT	<unknown>	DEFAULT	4
spec_flags.5145	.symtab	0x40f798	8	OBJECT	<unknown>	DEFAULT	4
spec_or_mask.5148	.symtab	0x40f730	16	OBJECT	<unknown>	DEFAULT	4
spec_ranges.5147	.symtab	0x40f740	9	OBJECT	<unknown>	DEFAULT	4
sprintf	.symtab	0x40bfb8	149	FUNC	<unknown>	DEFAULT	2
sprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
srand	.symtab	0x40a7f4	72	FUNC	<unknown>	DEFAULT	2
srandom	.symtab	0x40a7f4	72	FUNC	<unknown>	DEFAULT	2
srandom_r	.symtab	0x40a941	183	FUNC	<unknown>	DEFAULT	2
stderr	.symtab	0x613190	8	OBJECT	<unknown>	DEFAULT	9
stdin	.symtab	0x613180	8	OBJECT	<unknown>	DEFAULT	9
stdout	.symtab	0x613188	8	OBJECT	<unknown>	DEFAULT	9
strcat	.symtab	0x4087c0	428	FUNC	<unknown>	DEFAULT	2
strchr	.symtab	0x408970	417	FUNC	<unknown>	DEFAULT	2
strchrnul	.symtab	0x40d4b8	268	FUNC	<unknown>	DEFAULT	2
strchrnul.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcmp	.symtab	0x408b14	33	FUNC	<unknown>	DEFAULT	2
strcoll	.symtab	0x408b14	33	FUNC	<unknown>	DEFAULT	2
strcpy	.symtab	0x408b40	213	FUNC	<unknown>	DEFAULT	2
strcspn	.symtab	0x40d1d0	135	FUNC	<unknown>	DEFAULT	2
strerror_r	.symtab	0x408f28	196	FUNC	<unknown>	DEFAULT	2
strlen	.symtab	0x408c20	225	FUNC	<unknown>	DEFAULT	2
strncpy	.symtab	0x408d04	131	FUNC	<unknown>	DEFAULT	2
strncpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strnlen	.symtab	0x408d88	201	FUNC	<unknown>	DEFAULT	2
strnlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strpbrk	.symtab	0x40e198	140	FUNC	<unknown>	DEFAULT	2
strrchr	.symtab	0x40d5c4	53	FUNC	<unknown>	DEFAULT	2
strrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strspn	.symtab	0x40d258	135	FUNC	<unknown>	DEFAULT	2
strstr	.symtab	0x408e54	193	FUNC	<unknown>	DEFAULT	2
strstr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtoimax	.symtab	0x40aac8	10	FUNC	<unknown>	DEFAULT	2
strtok	.symtab	0x408fec	10	FUNC	<unknown>	DEFAULT	2
strtok.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok_r	.symtab	0x40d5fc	94	FUNC	<unknown>	DEFAULT	2
strtok_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtol	.symtab	0x40aac8	10	FUNC	<unknown>	DEFAULT	2
strtol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtoll	.symtab	0x40aac8	10	FUNC	<unknown>	DEFAULT	2
strtoq	.symtab	0x40aac8	10	FUNC	<unknown>	DEFAULT	2
sysconf	.symtab	0x40af17	560	FUNC	<unknown>	DEFAULT	2
sysconf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
system	.symtab	0x40b458	316	FUNC	<unknown>	DEFAULT	2
system.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
szprintf	.symtab	0x400b24	205	FUNC	<unknown>	DEFAULT	2
tcgetattr	.symtab	0x409014	110	FUNC	<unknown>	DEFAULT	2
tcgetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcpcsum	.symtab	0x4023e6	169	FUNC	<unknown>	DEFAULT	2
time	.symtab	0x4070f8	8	FUNC	<unknown>	DEFAULT	2
time.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
toupper	.symtab	0x407148	30	FUNC	<unknown>	DEFAULT	2
toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
trim	.symtab	0x4002f4	182	FUNC	<unknown>	DEFAULT	2
type_codes	.symtab	0x40f750	24	OBJECT	<unknown>	DEFAULT	4
type_sizes	.symtab	0x40f768	12	OBJECT	<unknown>	DEFAULT	4
unknown.1721	.symtab	0x40f7a0	14	OBJECT	<unknown>	DEFAULT	4
unsafe_state	.symtab	0x613430	40	OBJECT	<unknown>	DEFAULT	9
uppercase	.symtab	0x4012af	60	FUNC	<unknown>	DEFAULT	2
usernames	.symtab	0x6130a0	48	OBJECT	<unknown>	DEFAULT	9
vfork	.symtab	0x406cf0	21	FUNC	<unknown>	DEFAULT	2
vfprintf	.symtab	0x407698	150	FUNC	<unknown>	DEFAULT	2
vfprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
vsnprintf	.symtab	0x40c050	189	FUNC	<unknown>	DEFAULT	2
vsnprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wait4	.symtab	0x40b77c	47	FUNC	<unknown>	DEFAULT	2
wait4.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
waitpid	.symtab	0x407100	7	FUNC	<unknown>	DEFAULT	2
waitpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcrtomb	.symtab	0x40bd94	68	FUNC	<unknown>	DEFAULT	2
wcrtomb.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsnrtombs	.symtab	0x40bde8	123	FUNC	<unknown>	DEFAULT	2
wcsnrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsrtombs	.symtab	0x40bdd8	15	FUNC	<unknown>	DEFAULT	2
wcsrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wildString	.symtab	0x401134	314	FUNC	<unknown>	DEFAULT	2
write	.symtab	0x407108	42	FUNC	<unknown>	DEFAULT	2
write.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
xdigits.3743	.symtab	0x410310	17	OBJECT	<unknown>	DEFAULT	4
xstatconv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
zprintf	.symtab	0x400a59	203	FUNC	<unknown>	DEFAULT	2

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-07T22:21:57.474787+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53310	45.128.233.186	23	TCP
2025-01-07T22:21:59.256063+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53312	45.128.233.186	23	TCP
2025-01-07T22:22:01.000780+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53314	45.128.233.186	23	TCP
2025-01-07T22:22:02.789782+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53316	45.128.233.186	23	TCP
2025-01-07T22:22:04.534631+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53318	45.128.233.186	23	TCP
2025-01-07T22:22:06.299876+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53320	45.128.233.186	23	TCP
2025-01-07T22:22:08.120686+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53322	45.128.233.186	23	TCP
2025-01-07T22:22:09.881724+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53324	45.128.233.186	23	TCP
2025-01-07T22:22:11.692312+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53326	45.128.233.186	23	TCP
2025-01-07T22:22:13.463449+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53328	45.128.233.186	23	TCP
2025-01-07T22:22:15.199071+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53330	45.128.233.186	23	TCP
2025-01-07T22:22:16.992986+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53332	45.128.233.186	23	TCP
2025-01-07T22:22:18.790871+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53334	45.128.233.186	23	TCP
2025-01-07T22:22:20.584853+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53336	45.128.233.186	23	TCP
2025-01-07T22:22:22.366852+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53338	45.128.233.186	23	TCP
2025-01-07T22:22:24.092681+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53340	45.128.233.186	23	TCP
2025-01-07T22:22:25.855114+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53342	45.128.233.186	23	TCP
2025-01-07T22:22:27.930410+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53344	45.128.233.186	23	TCP
2025-01-07T22:22:29.711403+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53346	45.128.233.186	23	TCP
2025-01-07T22:22:31.469146+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53348	45.128.233.186	23	TCP
2025-01-07T22:22:33.216192+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53350	45.128.233.186	23	TCP
2025-01-07T22:22:35.824416+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53352	45.128.233.186	23	TCP
2025-01-07T22:22:37.576186+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53354	45.128.233.186	23	TCP
2025-01-07T22:22:39.330110+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53356	45.128.233.186	23	TCP
2025-01-07T22:22:41.115516+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53358	45.128.233.186	23	TCP
2025-01-07T22:22:42.919106+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53360	45.128.233.186	23	TCP
2025-01-07T22:22:44.718533+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53362	45.128.233.186	23	TCP
2025-01-07T22:22:46.537624+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53364	45.128.233.186	23	TCP
2025-01-07T22:22:48.336321+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53366	45.128.233.186	23	TCP
2025-01-07T22:22:50.098069+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53368	45.128.233.186	23	TCP
2025-01-07T22:22:51.858865+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53370	45.128.233.186	23	TCP
2025-01-07T22:22:53.632585+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53372	45.128.233.186	23	TCP
2025-01-07T22:22:55.417115+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53374	45.128.233.186	23	TCP
2025-01-07T22:22:57.187900+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53376	45.128.233.186	23	TCP
2025-01-07T22:22:58.933494+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53378	45.128.233.186	23	TCP
2025-01-07T22:23:00.702803+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53380	45.128.233.186	23	TCP
2025-01-07T22:23:02.452545+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53382	45.128.233.186	23	TCP
2025-01-07T22:23:04.233417+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53384	45.128.233.186	23	TCP
2025-01-07T22:23:05.964032+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53386	45.128.233.186	23	TCP
2025-01-07T22:23:07.752280+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53388	45.128.233.186	23	TCP
2025-01-07T22:23:09.538971+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53390	45.128.233.186	23	TCP
2025-01-07T22:23:11.304076+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53392	45.128.233.186	23	TCP
2025-01-07T22:23:13.069319+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53394	45.128.233.186	23	TCP
2025-01-07T22:23:14.862337+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53396	45.128.233.186	23	TCP
2025-01-07T22:23:16.613835+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53398	45.128.233.186	23	TCP
2025-01-07T22:23:18.381325+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53400	45.128.233.186	23	TCP
2025-01-07T22:23:20.163172+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53402	45.128.233.186	23	TCP
2025-01-07T22:23:21.921903+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53404	45.128.233.186	23	TCP
2025-01-07T22:23:23.704706+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53406	45.128.233.186	23	TCP
2025-01-07T22:23:25.472788+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53408	45.128.233.186	23	TCP
2025-01-07T22:23:27.238945+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53410	45.128.233.186	23	TCP
2025-01-07T22:23:29.035226+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53412	45.128.233.186	23	TCP
2025-01-07T22:23:30.847257+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53414	45.128.233.186	23	TCP
2025-01-07T22:23:32.607627+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53416	45.128.233.186	23	TCP
2025-01-07T22:23:34.408847+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53418	45.128.233.186	23	TCP
2025-01-07T22:23:36.213542+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53420	45.128.233.186	23	TCP
2025-01-07T22:23:37.948897+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53422	45.128.233.186	23	TCP
2025-01-07T22:23:39.746725+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53424	45.128.233.186	23	TCP
2025-01-07T22:23:41.604145+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53426	45.128.233.186	23	TCP
2025-01-07T22:23:43.400571+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53428	45.128.233.186	23	TCP
2025-01-07T22:23:45.155978+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53430	45.128.233.186	23	TCP
2025-01-07T22:23:46.941239+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53432	45.128.233.186	23	TCP
2025-01-07T22:23:48.724373+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53434	45.128.233.186	23	TCP
2025-01-07T22:23:50.518932+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53436	45.128.233.186	23	TCP
2025-01-07T22:23:52.298867+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53438	45.128.233.186	23	TCP
2025-01-07T22:23:54.090156+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53440	45.128.233.186	23	TCP
2025-01-07T22:23:55.919424+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53442	45.128.233.186	23	TCP
2025-01-07T22:23:57.728845+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53444	45.128.233.186	23	TCP
2025-01-07T22:23:59.529737+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53446	45.128.233.186	23	TCP
2025-01-07T22:24:01.318977+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53448	45.128.233.186	23	TCP
2025-01-07T22:24:03.098187+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53450	45.128.233.186	23	TCP
2025-01-07T22:24:04.919462+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53452	45.128.233.186	23	TCP
2025-01-07T22:24:06.654995+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53454	45.128.233.186	23	TCP
2025-01-07T22:24:08.576211+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53456	45.128.233.186	23	TCP
2025-01-07T22:24:10.351637+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53458	45.128.233.186	23	TCP
2025-01-07T22:24:12.138451+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53460	45.128.233.186	23	TCP
2025-01-07T22:24:13.900718+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53462	45.128.233.186	23	TCP
2025-01-07T22:24:15.668854+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53464	45.128.233.186	23	TCP
2025-01-07T22:24:17.418344+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53466	45.128.233.186	23	TCP
2025-01-07T22:24:19.202331+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53468	45.128.233.186	23	TCP
2025-01-07T22:24:20.948140+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53470	45.128.233.186	23	TCP
2025-01-07T22:24:22.702494+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53472	45.128.233.186	23	TCP
2025-01-07T22:24:24.460996+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53474	45.128.233.186	23	TCP
2025-01-07T22:24:26.213874+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53476	45.128.233.186	23	TCP
2025-01-07T22:24:27.963875+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53478	45.128.233.186	23	TCP
2025-01-07T22:24:29.740866+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53480	45.128.233.186	23	TCP
2025-01-07T22:24:31.539069+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53482	45.128.233.186	23	TCP
2025-01-07T22:24:33.319237+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53484	45.128.233.186	23	TCP
2025-01-07T22:24:35.205082+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53486	45.128.233.186	23	TCP
2025-01-07T22:24:36.995769+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53488	45.128.233.186	23	TCP
2025-01-07T22:24:38.730115+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53490	45.128.233.186	23	TCP
2025-01-07T22:24:40.518435+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53492	45.128.233.186	23	TCP
2025-01-07T22:24:42.279015+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53494	45.128.233.186	23	TCP
2025-01-07T22:24:44.051225+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53496	45.128.233.186	23	TCP
2025-01-07T22:24:45.822841+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53500	45.128.233.186	23	TCP
2025-01-07T22:24:47.612295+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53502	45.128.233.186	23	TCP
2025-01-07T22:24:49.382917+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53504	45.128.233.186	23	TCP
2025-01-07T22:24:51.171630+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53506	45.128.233.186	23	TCP
2025-01-07T22:24:52.916473+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53508	45.128.233.186	23	TCP
2025-01-07T22:24:54.682327+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53510	45.128.233.186	23	TCP
2025-01-07T22:24:56.458295+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53512	45.128.233.186	23	TCP
2025-01-07T22:24:58.244120+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53514	45.128.233.186	23	TCP
2025-01-07T22:25:00.049619+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53516	45.128.233.186	23	TCP
2025-01-07T22:25:01.787728+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53518	45.128.233.186	23	TCP
2025-01-07T22:25:03.580701+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53520	45.128.233.186	23	TCP
2025-01-07T22:25:05.342640+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53522	45.128.233.186	23	TCP
2025-01-07T22:25:07.128958+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53524	45.128.233.186	23	TCP
2025-01-07T22:25:08.914693+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53526	45.128.233.186	23	TCP
2025-01-07T22:25:10.744055+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53528	45.128.233.186	23	TCP
2025-01-07T22:25:12.491887+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53530	45.128.233.186	23	TCP
2025-01-07T22:25:14.292200+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53532	45.128.233.186	23	TCP
2025-01-07T22:25:16.051385+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53534	45.128.233.186	23	TCP
2025-01-07T22:25:17.824088+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53536	45.128.233.186	23	TCP
2025-01-07T22:25:19.561483+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53538	45.128.233.186	23	TCP
2025-01-07T22:25:21.563475+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53540	45.128.233.186	23	TCP
2025-01-07T22:25:23.824245+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53542	45.128.233.186	23	TCP
2025-01-07T22:25:26.011927+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53544	45.128.233.186	23	TCP
2025-01-07T22:25:28.114608+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53546	45.128.233.186	23	TCP
2025-01-07T22:25:29.988503+0100	2840333	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.14	53548	45.128.233.186	23	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 7, 2025 22:21:57.437036037 CET	53310	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:21:57.441941023 CET	23	53310	45.128.233.186	192.168.2.14
Jan 7, 2025 22:21:57.442012072 CET	53310	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:21:57.474786997 CET	53310	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:21:57.479708910 CET	23	53310	45.128.233.186	192.168.2.14
Jan 7, 2025 22:21:59.223923922 CET	23	53310	45.128.233.186	192.168.2.14
Jan 7, 2025 22:21:59.224159956 CET	53310	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:21:59.224922895 CET	53312	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:21:59.229007006 CET	23	53310	45.128.233.186	192.168.2.14
Jan 7, 2025 22:21:59.229739904 CET	23	53312	45.128.233.186	192.168.2.14
Jan 7, 2025 22:21:59.229801893 CET	53312	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:21:59.256062984 CET	53312	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:21:59.260843992 CET	23	53312	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:00.977462053 CET	23	53312	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:00.977731943 CET	53312	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:00.978395939 CET	53314	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:00.982503891 CET	23	53312	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:00.983164072 CET	23	53314	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:00.983218908 CET	53314	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:01.000780106 CET	53314	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:01.005563021 CET	23	53314	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:02.763704062 CET	23	53314	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:02.764040947 CET	53314	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:02.764520884 CET	53316	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:02.768935919 CET	23	53314	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:02.769284010 CET	23	53316	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:02.769351006 CET	53316	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:02.789782047 CET	53316	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:02.795780897 CET	23	53316	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:04.508339882 CET	23	53316	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:04.508698940 CET	53316	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:04.509398937 CET	53318	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:04.513571024 CET	23	53316	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:04.514173031 CET	23	53318	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:04.514236927 CET	53318	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:04.534631014 CET	53318	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:04.539376974 CET	23	53318	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:06.276124001 CET	23	53318	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:06.276333094 CET	53318	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:06.276897907 CET	53320	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:06.281162024 CET	23	53318	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:06.281800032 CET	23	53320	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:06.281851053 CET	53320	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:06.299875975 CET	53320	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:06.304660082 CET	23	53320	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:08.098433018 CET	23	53320	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:08.098618984 CET	53320	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:08.098988056 CET	53322	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:08.103494883 CET	23	53320	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:08.103820086 CET	23	53322	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:08.103887081 CET	53322	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:08.120686054 CET	53322	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:08.125459909 CET	23	53322	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:09.853019953 CET	23	53322	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:09.853513956 CET	53322	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:09.854190111 CET	53324	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:09.858318090 CET	23	53322	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:09.859044075 CET	23	53324	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:09.859249115 CET	53324	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:09.881724119 CET	53324	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:09.886555910 CET	23	53324	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:11.668010950 CET	23	53324	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:11.668529034 CET	53324	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:11.669003963 CET	53326	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:11.673307896 CET	23	53324	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:11.673814058 CET	23	53326	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:11.673877001 CET	53326	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:11.692312002 CET	53326	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:11.697086096 CET	23	53326	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:13.441162109 CET	23	53326	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:13.441462994 CET	53326	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:13.442050934 CET	53328	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:13.446245909 CET	23	53326	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:13.446877956 CET	23	53328	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:13.446922064 CET	53328	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:13.463449001 CET	53328	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:13.468295097 CET	23	53328	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:15.176080942 CET	23	53328	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:15.176249027 CET	53328	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:15.176754951 CET	53330	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:15.181056976 CET	23	53328	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:15.181572914 CET	23	53330	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:15.181735039 CET	53330	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:15.199070930 CET	53330	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:15.203860044 CET	23	53330	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:16.969609976 CET	23	53330	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:16.970071077 CET	53330	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:16.970547915 CET	53332	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:16.974906921 CET	23	53330	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:16.975398064 CET	23	53332	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:16.975449085 CET	53332	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:16.992985964 CET	53332	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:16.997817039 CET	23	53332	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:18.764784098 CET	23	53332	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:18.764950037 CET	53332	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:18.765503883 CET	53334	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:18.770570040 CET	23	53332	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:18.771049976 CET	23	53334	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:18.771157980 CET	53334	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:18.790870905 CET	53334	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:18.796577930 CET	23	53334	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:20.561906099 CET	23	53334	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:20.562221050 CET	53334	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:20.562840939 CET	53336	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:20.567054033 CET	23	53334	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:20.567698002 CET	23	53336	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:20.567755938 CET	53336	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:20.584852934 CET	53336	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:20.589668036 CET	23	53336	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:22.341182947 CET	23	53336	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:22.341393948 CET	53336	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:22.341983080 CET	53338	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:22.346182108 CET	23	53336	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:22.346826077 CET	23	53338	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:22.346935034 CET	53338	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:22.366852045 CET	53338	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:22.371615887 CET	23	53338	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:24.069190025 CET	23	53338	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:24.069610119 CET	53338	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:24.070328951 CET	53340	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:24.074460030 CET	23	53338	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:24.075128078 CET	23	53340	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:24.075196981 CET	53340	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:24.092680931 CET	53340	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:24.097465992 CET	23	53340	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:25.830190897 CET	23	53340	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:25.830462933 CET	53340	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:25.831191063 CET	53342	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:25.835295916 CET	23	53340	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:25.835963011 CET	23	53342	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:25.836112022 CET	53342	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:25.855113983 CET	53342	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:25.859966993 CET	23	53342	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:27.725173950 CET	23	53342	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:27.725440979 CET	53342	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:27.725796938 CET	53344	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:27.910315037 CET	23	53342	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:27.910525084 CET	23	53342	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:27.910533905 CET	23	53344	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:27.910554886 CET	53342	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:27.910628080 CET	53344	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:27.930409908 CET	53344	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:27.935190916 CET	23	53344	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:29.686724901 CET	23	53344	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:29.686953068 CET	53344	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:29.687789917 CET	53346	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:29.691751003 CET	23	53344	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:29.692569017 CET	23	53346	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:29.692650080 CET	53346	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:29.711402893 CET	53346	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:29.716198921 CET	23	53346	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:31.441660881 CET	23	53346	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:31.442059040 CET	53346	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:31.442677021 CET	53348	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:31.446901083 CET	23	53346	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:31.447494030 CET	23	53348	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:31.447619915 CET	53348	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:31.469146013 CET	53348	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:31.473980904 CET	23	53348	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:33.195590019 CET	23	53348	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:33.195867062 CET	53348	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:33.196367025 CET	53350	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:33.200695992 CET	23	53348	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:33.201128006 CET	23	53350	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:33.201176882 CET	53350	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:33.216192007 CET	53350	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:33.220936060 CET	23	53350	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:35.645586014 CET	23	53350	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:35.645678043 CET	23	53350	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:35.645771980 CET	23	53350	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:35.645852089 CET	53350	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:35.645852089 CET	53350	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:35.645895004 CET	53350	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:35.646534920 CET	53352	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:35.807522058 CET	23	53350	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:35.807543039 CET	23	53352	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:35.807670116 CET	53352	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:35.824415922 CET	53352	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:35.829298019 CET	23	53352	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:37.555493116 CET	23	53352	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:37.555768967 CET	53352	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:37.556283951 CET	53354	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:37.560615063 CET	23	53352	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:37.561103106 CET	23	53354	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:37.561160088 CET	53354	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:37.576185942 CET	53354	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:37.581101894 CET	23	53354	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:39.303214073 CET	23	53354	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:39.303664923 CET	53354	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:39.304265022 CET	53356	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:39.308532953 CET	23	53354	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:39.309082985 CET	23	53356	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:39.309216022 CET	53356	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:39.330110073 CET	53356	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:39.334976912 CET	23	53356	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:41.095086098 CET	23	53356	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:41.095436096 CET	53356	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:41.096007109 CET	53358	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:41.100344896 CET	23	53356	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:41.100832939 CET	23	53358	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:41.100879908 CET	53358	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:41.115515947 CET	53358	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:41.120359898 CET	23	53358	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:42.892601013 CET	23	53358	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:42.892913103 CET	53358	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:42.893642902 CET	53360	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:42.897741079 CET	23	53358	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:42.898432970 CET	23	53360	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:42.898492098 CET	53360	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:42.919106007 CET	53360	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:42.923924923 CET	23	53360	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:44.693137884 CET	23	53360	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:44.693438053 CET	53360	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:44.693950891 CET	53362	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:44.698283911 CET	23	53360	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:44.698743105 CET	23	53362	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:44.698874950 CET	53362	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:44.718533039 CET	53362	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:44.723436117 CET	23	53362	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:46.511832952 CET	23	53362	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:46.512099028 CET	53362	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:46.512769938 CET	53364	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:46.516861916 CET	23	53362	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:46.517648935 CET	23	53364	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:46.517724991 CET	53364	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:46.537623882 CET	53364	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:46.542406082 CET	23	53364	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:48.313456059 CET	23	53364	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:48.313565969 CET	53364	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:48.313982010 CET	53366	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:48.319431067 CET	23	53364	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:48.319437981 CET	23	53366	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:48.319549084 CET	53366	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:48.336321115 CET	53366	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:48.341546059 CET	23	53366	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:50.073389053 CET	23	53366	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:50.074043989 CET	53366	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:50.074724913 CET	53368	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:50.078855991 CET	23	53366	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:50.079513073 CET	23	53368	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:50.079592943 CET	53368	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:50.098068953 CET	53368	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:50.102879047 CET	23	53368	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:51.840439081 CET	23	53368	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:51.840655088 CET	53368	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:51.841098070 CET	53370	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:51.845484018 CET	23	53368	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:51.845896959 CET	23	53370	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:51.846013069 CET	53370	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:51.858865023 CET	53370	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:51.863691092 CET	23	53370	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:53.611295938 CET	23	53370	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:53.611584902 CET	53370	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:53.612293005 CET	53372	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:53.616379023 CET	23	53370	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:53.617074966 CET	23	53372	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:53.617151976 CET	53372	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:53.632585049 CET	53372	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:53.637384892 CET	23	53372	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:55.394033909 CET	23	53372	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:55.394360065 CET	53372	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:55.394773960 CET	53374	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:55.399202108 CET	23	53372	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:55.399585962 CET	23	53374	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:55.399765015 CET	53374	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:55.417114973 CET	53374	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:55.422205925 CET	23	53374	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:57.167433023 CET	23	53374	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:57.167877913 CET	53374	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:57.168382883 CET	53376	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:57.172749996 CET	23	53374	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:57.173224926 CET	23	53376	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:57.173355103 CET	53376	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:57.187900066 CET	53376	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:57.192744970 CET	23	53376	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:58.914109945 CET	23	53376	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:58.914295912 CET	53376	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:58.914927006 CET	53378	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:58.919135094 CET	23	53376	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:58.919708967 CET	23	53378	45.128.233.186	192.168.2.14
Jan 7, 2025 22:22:58.919836998 CET	53378	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:58.933494091 CET	53378	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:22:58.938349009 CET	23	53378	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:00.679140091 CET	23	53378	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:00.679419994 CET	53378	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:00.680114031 CET	53380	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:00.684267044 CET	23	53378	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:00.684984922 CET	23	53380	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:00.685058117 CET	53380	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:00.702802896 CET	53380	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:00.707674026 CET	23	53380	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:02.428901911 CET	23	53380	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:02.429186106 CET	53380	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:02.429910898 CET	53382	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:02.433969975 CET	23	53380	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:02.434708118 CET	23	53382	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:02.434803963 CET	53382	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:02.452544928 CET	53382	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:02.457374096 CET	23	53382	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:04.206011057 CET	23	53382	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:04.206372976 CET	53382	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:04.207263947 CET	53384	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:04.211219072 CET	23	53382	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:04.212080002 CET	23	53384	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:04.212153912 CET	53384	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:04.233417034 CET	53384	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:04.238235950 CET	23	53384	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:05.941498041 CET	23	53384	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:05.941641092 CET	53384	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:05.942101002 CET	53386	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:05.946484089 CET	23	53384	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:05.946897030 CET	23	53386	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:05.946964025 CET	53386	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:05.964031935 CET	53386	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:05.968909025 CET	23	53386	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:07.723661900 CET	23	53386	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:07.723803997 CET	53386	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:07.724678040 CET	53388	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:07.728600025 CET	23	53386	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:07.729445934 CET	23	53388	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:07.729533911 CET	53388	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:07.752279997 CET	53388	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:07.757010937 CET	23	53388	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:09.511086941 CET	23	53388	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:09.511307955 CET	53388	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:09.511960030 CET	53390	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:09.516079903 CET	23	53388	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:09.516836882 CET	23	53390	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:09.516925097 CET	53390	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:09.538970947 CET	53390	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:09.543732882 CET	23	53390	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:11.277030945 CET	23	53390	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:11.277424097 CET	53390	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:11.278243065 CET	53392	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:11.282243967 CET	23	53390	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:11.283054113 CET	23	53392	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:11.283118963 CET	53392	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:11.304075956 CET	53392	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:11.308831930 CET	23	53392	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:13.042521954 CET	23	53392	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:13.043159008 CET	53392	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:13.043790102 CET	53394	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:13.047970057 CET	23	53392	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:13.048634052 CET	23	53394	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:13.048707008 CET	53394	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:13.069319010 CET	53394	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:13.074065924 CET	23	53394	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:14.829288006 CET	23	53394	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:14.835426092 CET	53394	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:14.836091995 CET	53396	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:14.840322018 CET	23	53394	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:14.840926886 CET	23	53396	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:14.841049910 CET	53396	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:14.862337112 CET	53396	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:14.867134094 CET	23	53396	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:16.586488008 CET	23	53396	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:16.586886883 CET	53396	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:16.587671041 CET	53398	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:16.591758966 CET	23	53396	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:16.592497110 CET	23	53398	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:16.592567921 CET	53398	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:16.613835096 CET	53398	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:16.618649006 CET	23	53398	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:18.359396935 CET	23	53398	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:18.359543085 CET	53398	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:18.360200882 CET	53400	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:18.364372969 CET	23	53398	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:18.365057945 CET	23	53400	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:18.365180969 CET	53400	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:18.381325006 CET	53400	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:18.386210918 CET	23	53400	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:20.142518044 CET	23	53400	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:20.142847061 CET	53400	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:20.143292904 CET	53402	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:20.147677898 CET	23	53400	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:20.148086071 CET	23	53402	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:20.148139000 CET	53402	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:20.163172007 CET	53402	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:20.167921066 CET	23	53402	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:21.900384903 CET	23	53402	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:21.900605917 CET	53402	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:21.901139021 CET	53404	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:21.905411005 CET	23	53402	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:21.906013966 CET	23	53404	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:21.906143904 CET	53404	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:21.921902895 CET	53404	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:21.926701069 CET	23	53404	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:23.680563927 CET	23	53404	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:23.680869102 CET	53404	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:23.681673050 CET	53406	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:23.685740948 CET	23	53404	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:23.686463118 CET	23	53406	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:23.686553001 CET	53406	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:23.704705954 CET	53406	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:23.709522963 CET	23	53406	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:25.448247910 CET	23	53406	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:25.448708057 CET	53406	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:25.449359894 CET	53408	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:25.453567982 CET	23	53406	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:25.454274893 CET	23	53408	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:25.454339027 CET	53408	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:25.472788095 CET	53408	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:25.477606058 CET	23	53408	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:27.217638969 CET	23	53408	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:27.217802048 CET	53408	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:27.218417883 CET	53410	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:27.222616911 CET	23	53408	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:27.223149061 CET	23	53410	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:27.223275900 CET	53410	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:27.238945007 CET	53410	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:27.243786097 CET	23	53410	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:29.016493082 CET	23	53410	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:29.016824961 CET	53410	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:29.017256975 CET	53412	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:29.021629095 CET	23	53410	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:29.022054911 CET	23	53412	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:29.022100925 CET	53412	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:29.035226107 CET	53412	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:29.040061951 CET	23	53412	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:30.828658104 CET	23	53412	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:30.828923941 CET	53412	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:30.829574108 CET	53414	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:30.833688021 CET	23	53412	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:30.834374905 CET	23	53414	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:30.834501028 CET	53414	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:30.847256899 CET	53414	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:30.852030039 CET	23	53414	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:32.590794086 CET	23	53414	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:32.591192007 CET	53414	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:32.591587067 CET	53416	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:32.596025944 CET	23	53414	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:32.596391916 CET	23	53416	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:32.596442938 CET	53416	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:32.607626915 CET	53416	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:32.612371922 CET	23	53416	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:34.390711069 CET	23	53416	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:34.390873909 CET	53416	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:34.391274929 CET	53418	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:34.395670891 CET	23	53416	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:34.396059990 CET	23	53418	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:34.396186113 CET	53418	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:34.408847094 CET	53418	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:34.413594961 CET	23	53418	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:36.195811987 CET	23	53418	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:36.196214914 CET	53418	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:36.196619987 CET	53420	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:36.201040030 CET	23	53418	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:36.201397896 CET	23	53420	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:36.201446056 CET	53420	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:36.213541985 CET	53420	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:36.218312979 CET	23	53420	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:37.929384947 CET	23	53420	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:37.929760933 CET	53420	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:37.930149078 CET	53422	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:37.934578896 CET	23	53420	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:37.935004950 CET	23	53422	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:37.935136080 CET	53422	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:37.948896885 CET	53422	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:37.953694105 CET	23	53422	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:39.724266052 CET	23	53422	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:39.724605083 CET	53422	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:39.725279093 CET	53424	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:39.729399920 CET	23	53422	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:39.730068922 CET	23	53424	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:39.730155945 CET	53424	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:39.746725082 CET	53424	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:39.751502037 CET	23	53424	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:41.581860065 CET	23	53424	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:41.582092047 CET	53424	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:41.582788944 CET	53426	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:41.586921930 CET	23	53424	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:41.587577105 CET	23	53426	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:41.587647915 CET	53426	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:41.604145050 CET	53426	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:41.608903885 CET	23	53426	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:43.385083914 CET	23	53426	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:43.385214090 CET	53426	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:43.385579109 CET	53428	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:43.390026093 CET	23	53426	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:43.390358925 CET	23	53428	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:43.390480995 CET	53428	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:43.400571108 CET	53428	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:43.405343056 CET	23	53428	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:45.133213043 CET	23	53428	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:45.133460999 CET	53428	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:45.134171963 CET	53430	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:45.138220072 CET	23	53428	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:45.139007092 CET	23	53430	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:45.139080048 CET	53430	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:45.155977964 CET	53430	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:45.160732985 CET	23	53430	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:46.922590017 CET	23	53430	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:46.922945976 CET	53430	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:46.923419952 CET	53432	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:46.927764893 CET	23	53430	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:46.928282976 CET	23	53432	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:46.928406954 CET	53432	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:46.941239119 CET	53432	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:46.945981026 CET	23	53432	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:48.701392889 CET	23	53432	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:48.701558113 CET	53432	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:48.702193975 CET	53434	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:48.706764936 CET	23	53432	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:48.707416058 CET	23	53434	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:48.707489014 CET	53434	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:48.724373102 CET	53434	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:48.729114056 CET	23	53434	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:50.498101950 CET	23	53434	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:50.498300076 CET	53434	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:50.498908043 CET	53436	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:50.503117085 CET	23	53434	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:50.503695965 CET	23	53436	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:50.503825903 CET	53436	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:50.518932104 CET	53436	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:50.523730040 CET	23	53436	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:52.276910067 CET	23	53436	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:52.277221918 CET	53436	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:52.277949095 CET	53438	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:52.282057047 CET	23	53436	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:52.282743931 CET	23	53438	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:52.282818079 CET	53438	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:52.298866987 CET	53438	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:52.303656101 CET	23	53438	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:54.068701029 CET	23	53438	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:54.069039106 CET	53438	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:54.069670916 CET	53440	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:54.073860884 CET	23	53438	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:54.074480057 CET	23	53440	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:54.074546099 CET	53440	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:54.090156078 CET	53440	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:54.094918013 CET	23	53440	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:55.899265051 CET	23	53440	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:55.899652958 CET	53440	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:55.900201082 CET	53442	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:55.904376984 CET	23	53440	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:55.905004025 CET	23	53442	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:55.905087948 CET	53442	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:55.919424057 CET	53442	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:55.924247026 CET	23	53442	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:57.709103107 CET	23	53442	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:57.709327936 CET	53442	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:57.710025072 CET	53444	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:57.714170933 CET	23	53442	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:57.714845896 CET	23	53444	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:57.714922905 CET	53444	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:57.728844881 CET	53444	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:57.733684063 CET	23	53444	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:59.505844116 CET	23	53444	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:59.506207943 CET	53444	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:59.506777048 CET	53446	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:59.511621952 CET	23	53444	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:59.511878967 CET	23	53446	45.128.233.186	192.168.2.14
Jan 7, 2025 22:23:59.511981964 CET	53446	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:59.529736996 CET	53446	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:23:59.534625053 CET	23	53446	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:01.300226927 CET	23	53446	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:01.300458908 CET	53446	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:01.301105022 CET	53448	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:01.305306911 CET	23	53446	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:01.305891037 CET	23	53448	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:01.305963039 CET	53448	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:01.318977118 CET	53448	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:01.323800087 CET	23	53448	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:03.077290058 CET	23	53448	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:03.077685118 CET	53448	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:03.078315973 CET	53450	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:03.082521915 CET	23	53448	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:03.083142042 CET	23	53450	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:03.083228111 CET	53450	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:03.098186970 CET	53450	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:03.102940083 CET	23	53450	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:04.899691105 CET	23	53450	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:04.900177002 CET	53450	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:04.900747061 CET	53452	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:04.904941082 CET	23	53450	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:04.905579090 CET	23	53452	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:04.905648947 CET	53452	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:04.919461966 CET	53452	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:04.924213886 CET	23	53452	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:06.630831003 CET	23	53452	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:06.631285906 CET	53452	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:06.632016897 CET	53454	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:06.636154890 CET	23	53452	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:06.637963057 CET	23	53454	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:06.638046980 CET	53454	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:06.654994965 CET	53454	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:06.660717010 CET	23	53454	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:08.553205013 CET	23	53454	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:08.553634882 CET	53454	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:08.554213047 CET	53456	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:08.558443069 CET	23	53454	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:08.559005976 CET	23	53456	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:08.559065104 CET	53456	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:08.576210976 CET	53456	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:08.581302881 CET	23	53456	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:10.331326962 CET	23	53456	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:10.331628084 CET	53456	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:10.332250118 CET	53458	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:10.336436033 CET	23	53456	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:10.337008953 CET	23	53458	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:10.337080956 CET	53458	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:10.351636887 CET	53458	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:10.356463909 CET	23	53458	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:12.116292000 CET	23	53458	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:12.116635084 CET	53458	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:12.117270947 CET	53460	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:12.121432066 CET	23	53458	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:12.122076035 CET	23	53460	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:12.122200012 CET	53460	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:12.138451099 CET	53460	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:12.143224001 CET	23	53460	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:13.885113955 CET	23	53460	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:13.885287046 CET	53460	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:13.885653973 CET	53462	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:13.890084028 CET	23	53460	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:13.890430927 CET	23	53462	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:13.890477896 CET	53462	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:13.900717974 CET	53462	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:13.905467033 CET	23	53462	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:15.652971983 CET	23	53462	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:15.653131962 CET	53462	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:15.653490067 CET	53464	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:15.657893896 CET	23	53462	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:15.658253908 CET	23	53464	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:15.658322096 CET	53464	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:15.668853998 CET	53464	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:15.673630953 CET	23	53464	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:17.402137995 CET	23	53464	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:17.402359962 CET	53464	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:17.402682066 CET	53466	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:17.407176971 CET	23	53464	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:17.407510042 CET	23	53466	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:17.407560110 CET	53466	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:17.418344021 CET	53466	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:17.423070908 CET	23	53466	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:19.185511112 CET	23	53466	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:19.185684919 CET	53466	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:19.186042070 CET	53468	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:19.190463066 CET	23	53466	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:19.190843105 CET	23	53468	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:19.190965891 CET	53468	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:19.202331066 CET	53468	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:19.207107067 CET	23	53468	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:20.931498051 CET	23	53468	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:20.931685925 CET	53468	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:20.932116032 CET	53470	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:20.936537981 CET	23	53468	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:20.936901093 CET	23	53470	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:20.936949015 CET	53470	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:20.948139906 CET	53470	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:20.952929974 CET	23	53470	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:22.683233023 CET	23	53470	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:22.683546066 CET	53470	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:22.683974981 CET	53472	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:22.688884974 CET	23	53470	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:22.689230919 CET	23	53472	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:22.689279079 CET	53472	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:22.702493906 CET	53472	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:22.707838058 CET	23	53472	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:24.443809032 CET	23	53472	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:24.444114923 CET	53472	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:24.444552898 CET	53474	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:24.449322939 CET	23	53472	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:24.449743032 CET	23	53474	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:24.449836969 CET	53474	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:24.460995913 CET	53474	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:24.465781927 CET	23	53474	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:26.196969032 CET	23	53474	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:26.197259903 CET	53474	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:26.197725058 CET	53476	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:26.202069044 CET	23	53474	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:26.202503920 CET	23	53476	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:26.202554941 CET	53476	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:26.213874102 CET	53476	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:26.218633890 CET	23	53476	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:27.946551085 CET	23	53476	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:27.946706057 CET	53476	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:27.947127104 CET	53478	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:27.951580048 CET	23	53476	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:27.951956987 CET	23	53478	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:27.952121973 CET	53478	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:27.963875055 CET	53478	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:27.968651056 CET	23	53478	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:29.721255064 CET	23	53478	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:29.721477985 CET	53478	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:29.721950054 CET	53480	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:29.726322889 CET	23	53478	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:29.726824999 CET	23	53480	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:29.726927996 CET	53480	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:29.740865946 CET	53480	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:29.745685101 CET	23	53480	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:31.518336058 CET	23	53480	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:31.518631935 CET	53480	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:31.519324064 CET	53482	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:31.523417950 CET	23	53480	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:31.524321079 CET	23	53482	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:31.524463892 CET	53482	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:31.539068937 CET	53482	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:31.543883085 CET	23	53482	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:33.300709009 CET	23	53482	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:33.300976992 CET	53482	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:33.301546097 CET	53484	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:33.305799961 CET	23	53482	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:33.306401968 CET	23	53484	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:33.306454897 CET	53484	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:33.319236994 CET	53484	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:33.324024916 CET	23	53484	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:35.186120987 CET	23	53484	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:35.186295986 CET	53484	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:35.186866045 CET	53486	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:35.191730976 CET	23	53484	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:35.192153931 CET	23	53486	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:35.192245007 CET	53486	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:35.205081940 CET	53486	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:35.209888935 CET	23	53486	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:36.971771002 CET	23	53486	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:36.972261906 CET	53486	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:36.972924948 CET	53488	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:36.977068901 CET	23	53486	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:36.977756023 CET	23	53488	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:36.977827072 CET	53488	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:36.995769024 CET	53488	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:37.000525951 CET	23	53488	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:38.711405993 CET	23	53488	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:38.711635113 CET	53488	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:38.712259054 CET	53490	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:38.716398954 CET	23	53488	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:38.717081070 CET	23	53490	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:38.717132092 CET	53490	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:38.730114937 CET	53490	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:38.734958887 CET	23	53490	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:40.500921011 CET	23	53490	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:40.501138926 CET	53490	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:40.501580000 CET	53492	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:40.505928040 CET	23	53490	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:40.506412983 CET	23	53492	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:40.506500006 CET	53492	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:40.518435001 CET	53492	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:40.523350954 CET	23	53492	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:42.261717081 CET	23	53492	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:42.261894941 CET	53492	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:42.262367010 CET	53494	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:42.266686916 CET	23	53492	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:42.267208099 CET	23	53494	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:42.267255068 CET	53494	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:42.279015064 CET	53494	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:42.283773899 CET	23	53494	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:44.008774996 CET	23	53494	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:44.008841038 CET	53494	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:44.009440899 CET	53496	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:44.013684034 CET	23	53494	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:44.014259100 CET	23	53496	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:44.014328003 CET	53496	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:44.051224947 CET	53496	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:44.055967093 CET	23	53496	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:44.222318888 CET	45344	53	192.168.2.14	8.8.8.8
Jan 7, 2025 22:24:44.227359056 CET	53	45344	8.8.8.8	192.168.2.14
Jan 7, 2025 22:24:44.227427006 CET	45344	53	192.168.2.14	8.8.8.8
Jan 7, 2025 22:24:44.227448940 CET	45344	53	192.168.2.14	8.8.8.8
Jan 7, 2025 22:24:44.227473021 CET	45344	53	192.168.2.14	8.8.8.8
Jan 7, 2025 22:24:44.232260942 CET	53	45344	8.8.8.8	192.168.2.14
Jan 7, 2025 22:24:44.232270956 CET	53	45344	8.8.8.8	192.168.2.14
Jan 7, 2025 22:24:44.670342922 CET	53	45344	8.8.8.8	192.168.2.14
Jan 7, 2025 22:24:44.672920942 CET	45344	53	192.168.2.14	8.8.8.8
Jan 7, 2025 22:24:45.801990032 CET	23	53496	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:45.802122116 CET	53496	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:45.802508116 CET	53500	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:45.806940079 CET	23	53496	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:45.807377100 CET	23	53500	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:45.807460070 CET	53500	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:45.822840929 CET	53500	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:45.827608109 CET	23	53500	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:46.670541048 CET	53	45344	8.8.8.8	192.168.2.14
Jan 7, 2025 22:24:46.670752048 CET	45344	53	192.168.2.14	8.8.8.8
Jan 7, 2025 22:24:46.675590992 CET	53	45344	8.8.8.8	192.168.2.14
Jan 7, 2025 22:24:47.593213081 CET	23	53500	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:47.593409061 CET	53500	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:47.593914986 CET	53502	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:47.598289967 CET	23	53500	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:47.598833084 CET	23	53502	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:47.598889112 CET	53502	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:47.612294912 CET	53502	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:47.617146015 CET	23	53502	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:49.363388062 CET	23	53502	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:49.363524914 CET	53502	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:49.363960028 CET	53504	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:49.368777990 CET	23	53502	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:49.369270086 CET	23	53504	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:49.369316101 CET	53504	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:49.382916927 CET	53504	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:49.387687922 CET	23	53504	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:51.145380020 CET	23	53504	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:51.145551920 CET	53504	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:51.146059036 CET	53506	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:51.150398016 CET	23	53504	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:51.150829077 CET	23	53506	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:51.150954962 CET	53506	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:51.171629906 CET	53506	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:51.176445007 CET	23	53506	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:52.899349928 CET	23	53506	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:52.899517059 CET	53506	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:52.900024891 CET	53508	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:52.904297113 CET	23	53506	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:52.904773951 CET	23	53508	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:52.904833078 CET	53508	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:52.916472912 CET	53508	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:52.921238899 CET	23	53508	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:54.664282084 CET	23	53508	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:54.664488077 CET	53508	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:54.664983034 CET	53510	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:54.669305086 CET	23	53508	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:54.669800043 CET	23	53510	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:54.669897079 CET	53510	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:54.682327032 CET	53510	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:54.687098980 CET	23	53510	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:56.441586971 CET	23	53510	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:56.441827059 CET	53510	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:56.442343950 CET	53512	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:56.446670055 CET	23	53510	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:56.447144985 CET	23	53512	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:56.447204113 CET	53512	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:56.458295107 CET	53512	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:56.463128090 CET	23	53512	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:58.221374989 CET	23	53512	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:58.221565962 CET	53512	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:58.222279072 CET	53514	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:58.226325035 CET	23	53512	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:58.227102041 CET	23	53514	45.128.233.186	192.168.2.14
Jan 7, 2025 22:24:58.227236032 CET	53514	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:58.244119883 CET	53514	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:24:58.248846054 CET	23	53514	45.128.233.186	192.168.2.14
Jan 7, 2025 22:25:00.032526016 CET	23	53514	45.128.233.186	192.168.2.14
Jan 7, 2025 22:25:00.032776117 CET	53514	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:25:00.033237934 CET	53516	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:25:00.037663937 CET	23	53514	45.128.233.186	192.168.2.14
Jan 7, 2025 22:25:00.038042068 CET	23	53516	45.128.233.186	192.168.2.14
Jan 7, 2025 22:25:00.038084984 CET	53516	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:25:00.049618959 CET	53516	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:25:00.054421902 CET	23	53516	45.128.233.186	192.168.2.14
Jan 7, 2025 22:25:01.771902084 CET	23	53516	45.128.233.186	192.168.2.14
Jan 7, 2025 22:25:01.772032976 CET	53516	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:25:01.772406101 CET	53518	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:25:01.777713060 CET	23	53516	45.128.233.186	192.168.2.14
Jan 7, 2025 22:25:01.777765036 CET	23	53518	45.128.233.186	192.168.2.14
Jan 7, 2025 22:25:01.777834892 CET	53518	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:25:01.787728071 CET	53518	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:25:01.793086052 CET	23	53518	45.128.233.186	192.168.2.14
Jan 7, 2025 22:25:03.564652920 CET	23	53518	45.128.233.186	192.168.2.14
Jan 7, 2025 22:25:03.564815998 CET	53518	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:25:03.565268040 CET	53520	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:25:03.569608927 CET	23	53518	45.128.233.186	192.168.2.14
Jan 7, 2025 22:25:03.570053101 CET	23	53520	45.128.233.186	192.168.2.14
Jan 7, 2025 22:25:03.570108891 CET	53520	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:25:03.580701113 CET	53520	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:25:03.585438013 CET	23	53520	45.128.233.186	192.168.2.14
Jan 7, 2025 22:25:05.326695919 CET	23	53520	45.128.233.186	192.168.2.14
Jan 7, 2025 22:25:05.326920033 CET	53520	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:25:05.327339888 CET	53522	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:25:05.331717968 CET	23	53520	45.128.233.186	192.168.2.14
Jan 7, 2025 22:25:05.332104921 CET	23	53522	45.128.233.186	192.168.2.14
Jan 7, 2025 22:25:05.332164049 CET	53522	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:25:05.342639923 CET	53522	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:25:05.347414970 CET	23	53522	45.128.233.186	192.168.2.14
Jan 7, 2025 22:25:07.112909079 CET	23	53522	45.128.233.186	192.168.2.14
Jan 7, 2025 22:25:07.113079071 CET	53522	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:25:07.113550901 CET	53524	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:25:07.117892981 CET	23	53522	45.128.233.186	192.168.2.14
Jan 7, 2025 22:25:07.118325949 CET	23	53524	45.128.233.186	192.168.2.14
Jan 7, 2025 22:25:07.118486881 CET	53524	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:25:07.128957987 CET	53524	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:25:07.133722067 CET	23	53524	45.128.233.186	192.168.2.14
Jan 7, 2025 22:25:08.895649910 CET	23	53524	45.128.233.186	192.168.2.14
Jan 7, 2025 22:25:08.895977020 CET	53524	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:25:08.896708965 CET	53526	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:25:08.901387930 CET	23	53524	45.128.233.186	192.168.2.14
Jan 7, 2025 22:25:08.902076006 CET	23	53526	45.128.233.186	192.168.2.14
Jan 7, 2025 22:25:08.902156115 CET	53526	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:25:08.914693117 CET	53526	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:25:08.919447899 CET	23	53526	45.128.233.186	192.168.2.14
Jan 7, 2025 22:25:10.727238894 CET	23	53526	45.128.233.186	192.168.2.14
Jan 7, 2025 22:25:10.727591991 CET	53526	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:25:10.728060007 CET	53528	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:25:10.732441902 CET	23	53526	45.128.233.186	192.168.2.14
Jan 7, 2025 22:25:10.732846975 CET	23	53528	45.128.233.186	192.168.2.14
Jan 7, 2025 22:25:10.732980967 CET	53528	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:25:10.744055033 CET	53528	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:25:10.748888969 CET	23	53528	45.128.233.186	192.168.2.14
Jan 7, 2025 22:25:12.476635933 CET	23	53528	45.128.233.186	192.168.2.14
Jan 7, 2025 22:25:12.476780891 CET	53528	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:25:12.477211952 CET	53530	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:25:12.481537104 CET	23	53528	45.128.233.186	192.168.2.14
Jan 7, 2025 22:25:12.482027054 CET	23	53530	45.128.233.186	192.168.2.14
Jan 7, 2025 22:25:12.482078075 CET	53530	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:25:12.491887093 CET	53530	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:25:12.496644020 CET	23	53530	45.128.233.186	192.168.2.14
Jan 7, 2025 22:25:14.275657892 CET	23	53530	45.128.233.186	192.168.2.14
Jan 7, 2025 22:25:14.275954962 CET	53530	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:25:14.276372910 CET	53532	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:25:14.281091928 CET	23	53530	45.128.233.186	192.168.2.14
Jan 7, 2025 22:25:14.281780005 CET	23	53532	45.128.233.186	192.168.2.14
Jan 7, 2025 22:25:14.281869888 CET	53532	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:25:14.292200089 CET	53532	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:25:14.296993971 CET	23	53532	45.128.233.186	192.168.2.14
Jan 7, 2025 22:25:16.045305014 CET	23	53532	45.128.233.186	192.168.2.14
Jan 7, 2025 22:25:16.045500994 CET	53532	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:25:16.045933008 CET	53534	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:25:16.050323009 CET	23	53532	45.128.233.186	192.168.2.14
Jan 7, 2025 22:25:16.050693035 CET	23	53534	45.128.233.186	192.168.2.14
Jan 7, 2025 22:25:16.050746918 CET	53534	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:25:16.051384926 CET	53534	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:25:16.056197882 CET	23	53534	45.128.233.186	192.168.2.14
Jan 7, 2025 22:25:17.817635059 CET	23	53534	45.128.233.186	192.168.2.14
Jan 7, 2025 22:25:17.817987919 CET	53534	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:25:17.818567991 CET	53536	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:25:17.823170900 CET	23	53534	45.128.233.186	192.168.2.14
Jan 7, 2025 22:25:17.823949099 CET	23	53536	45.128.233.186	192.168.2.14
Jan 7, 2025 22:25:17.824012041 CET	53536	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:25:17.824088097 CET	53536	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:25:17.828890085 CET	23	53536	45.128.233.186	192.168.2.14
Jan 7, 2025 22:25:19.555339098 CET	23	53536	45.128.233.186	192.168.2.14
Jan 7, 2025 22:25:19.555829048 CET	53536	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:25:19.556521893 CET	53538	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:25:19.560530901 CET	23	53536	45.128.233.186	192.168.2.14
Jan 7, 2025 22:25:19.561295033 CET	23	53538	45.128.233.186	192.168.2.14
Jan 7, 2025 22:25:19.561408997 CET	53538	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:25:19.561482906 CET	53538	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:25:19.566221952 CET	23	53538	45.128.233.186	192.168.2.14
Jan 7, 2025 22:25:21.557813883 CET	23	53538	45.128.233.186	192.168.2.14
Jan 7, 2025 22:25:21.558043957 CET	53538	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:25:21.558603048 CET	53540	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:25:21.562906027 CET	23	53538	45.128.233.186	192.168.2.14
Jan 7, 2025 22:25:21.563400984 CET	23	53540	45.128.233.186	192.168.2.14
Jan 7, 2025 22:25:21.563448906 CET	53540	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:25:21.563474894 CET	53540	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:25:21.568254948 CET	23	53540	45.128.233.186	192.168.2.14
Jan 7, 2025 22:25:23.818434954 CET	23	53540	45.128.233.186	192.168.2.14
Jan 7, 2025 22:25:23.818804979 CET	53540	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:25:23.819273949 CET	53542	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:25:23.823590040 CET	23	53540	45.128.233.186	192.168.2.14
Jan 7, 2025 22:25:23.824023008 CET	23	53542	45.128.233.186	192.168.2.14
Jan 7, 2025 22:25:23.824168921 CET	53542	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:25:23.824244976 CET	53542	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:25:23.829030037 CET	23	53542	45.128.233.186	192.168.2.14
Jan 7, 2025 22:25:26.005968094 CET	23	53542	45.128.233.186	192.168.2.14
Jan 7, 2025 22:25:26.006316900 CET	53542	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:25:26.006951094 CET	53544	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:25:26.011090040 CET	23	53542	45.128.233.186	192.168.2.14
Jan 7, 2025 22:25:26.011771917 CET	23	53544	45.128.233.186	192.168.2.14
Jan 7, 2025 22:25:26.011850119 CET	53544	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:25:26.011926889 CET	53544	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:25:26.016671896 CET	23	53544	45.128.233.186	192.168.2.14
Jan 7, 2025 22:25:28.108791113 CET	23	53544	45.128.233.186	192.168.2.14
Jan 7, 2025 22:25:28.108998060 CET	53544	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:25:28.109663010 CET	53546	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:25:28.113797903 CET	23	53544	45.128.233.186	192.168.2.14
Jan 7, 2025 22:25:28.114463091 CET	23	53546	45.128.233.186	192.168.2.14
Jan 7, 2025 22:25:28.114553928 CET	53546	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:25:28.114608049 CET	53546	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:25:28.119497061 CET	23	53546	45.128.233.186	192.168.2.14
Jan 7, 2025 22:25:29.982590914 CET	23	53546	45.128.233.186	192.168.2.14
Jan 7, 2025 22:25:29.982839108 CET	53546	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:25:29.983541965 CET	53548	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:25:29.987624884 CET	23	53546	45.128.233.186	192.168.2.14
Jan 7, 2025 22:25:29.988348007 CET	23	53548	45.128.233.186	192.168.2.14
Jan 7, 2025 22:25:29.988444090 CET	53548	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:25:29.988502979 CET	53548	23	192.168.2.14	45.128.233.186
Jan 7, 2025 22:25:29.993257999 CET	23	53548	45.128.233.186	192.168.2.14

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 7, 2025 22:24:44.227448940 CET	192.168.2.14	8.8.8.8	0xca6	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Jan 7, 2025 22:24:44.227473021 CET	192.168.2.14	8.8.8.8	0x7dd8	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

System Behavior

Analysis Process: gigops.x86.elf PID: 5575, Parent PID: 5495

General

Start time (UTC):	21:21:56
Start date (UTC):	07/01/2025
Path:	/tmp/gigops.x86.elf
Arguments:	/tmp/gigops.x86.elf
File size:	108206 bytes
MD5 hash:	9a448f36d365af48793fb990dd3887ba

Chronological Activities

Analysis Process: gigops.x86.elf PID: 5577, Parent PID: 5575

General

Start time (UTC):	21:21:57
Start date (UTC):	07/01/2025
Path:	/tmp/gigops.x86.elf
Arguments:	-
File size:	108206 bytes
MD5 hash:	9a448f36d365af48793fb990dd3887ba

Chronological Activities

Analysis Process: gigops.x86.elf PID: 5578, Parent PID: 5577

General

Start time (UTC):	21:21:57
Start date (UTC):	07/01/2025
Path:	/tmp/gigops.x86.elf
Arguments:	-
File size:	108206 bytes
MD5 hash:	9a448f36d365af48793fb990dd3887ba

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping or `net view` using Net .
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report gigops.x86.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Threatname: Gafgyt

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

DNS Queries

System Behavior

Analysis Process: gigops.x86.elf PID: 5575, Parent PID: 5495

General

Chronological Activities

Analysis Process: gigops.x86.elf PID: 5577, Parent PID: 5575

General

Chronological Activities

Analysis Process: gigops.x86.elf PID: 5578, Parent PID: 5577

General

Chronological Activities

Linux Analysis Report
gigops.x86.elf