Edit tour

Linux Analysis Report
ssh.elf

Overview

General Information

Sample name:	ssh.elf
Analysis ID:	1586472
MD5:	00389ae9afc4e52098a16c0b227b45bd
SHA1:	59aab7520d7a6c875cf911f1588966825017e31f
SHA256:	26bb71bc8e6b6343bd80595934f5a8b1ef0a235a8efd86d2866a42ff82f512da
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai, Gafgyt

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Detected Mirai

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Gafgyt

Contains symbols with names commonly found in malware

Machine Learning detection for sample

Opens /proc/net/* files useful for finding connected devices and routers

Detected TCP or UDP traffic on non-standard ports

Sample contains strings that are user agent strings indicative of HTTP manipulation

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1586472
Start date and time:	2025-01-09 08:12:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	ssh.elf
Detection:	MAL
Classification:	mal100.spre.troj.linELF@0/0@2/0

Warnings

VT rate limit hit for: ssh.elf

Runtime Messages

Command:	/tmp/ssh.elf
PID:	5487
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

ssh.elf (PID: 5487, Parent: 5412, MD5: 00389ae9afc4e52098a16c0b227b45bd) Arguments: /tmp/ssh.elf

ssh.elf New Fork (PID: 5488, Parent: 5487)

ssh.elf New Fork (PID: 5489, Parent: 5488)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
ssh.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
ssh.elf	Linux_Trojan_Gafgyt_a6a2adb9	unknown	unknown	0x8af:$a: CC 01 C2 89 55 B4 8B 45 B4 C9 C3 55 48 89 E5 48 81 EC 90 00
ssh.elf	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x7318:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
ssh.elf	Linux_Trojan_Gafgyt_f3d83a74	unknown	unknown	0x7d6:$a: DC 00 74 1B 83 7D E0 0A 75 15 83 7D E4 00 79 0F C7 45 C8 01 00
ssh.elf	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0x7acf:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
ssh.elf	Linux_Trojan_Gafgyt_a0a4de11	unknown	unknown	0x1c03:$a: 42 0D 83 C8 10 88 42 0D 48 8B 55 D8 0F B6 42 0D 83 C8 08 88
ssh.elf	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0x47d6:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x493c:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
ssh.elf	Linux_Trojan_Gafgyt_09c3070e	unknown	unknown	0xfdd:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 0x1090:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 0x12c3:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83
ssh.elf	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0xafde:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
ssh.elf	Linux_Trojan_Gafgyt_d0c57a2e	unknown	unknown	0xcfc2:$a: 07 0F B6 57 01 C1 E0 08 09 D0 89 06 0F BE 47 02 C1 E8 1F 89
ssh.elf	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0x768f:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
ssh.elf	Linux_Trojan_Gafgyt_dd0d6173	unknown	unknown	0x164b:$a: 55 F8 8B 45 F0 89 42 0C 48 8B 55 F8 8B 45 F4 89 42 10 C9 C3 55 48
ssh.elf	Linux_Trojan_Gafgyt_779e142f	unknown	unknown	0x6fe:$a: EC 8B 45 E8 83 E0 02 85 C0 74 07 C7 45 D8 30 00 00 00 8B 45 E8 83
ssh.elf	Linux_Trojan_Gafgyt_cf84c9f2	unknown	unknown	0x31f:$a: 55 48 89 E5 48 83 EC 30 48 89 7D E8 89 75 E4 89 55 E0 C7 45 F8 01 00
ssh.elf	Linux_Trojan_Gafgyt_0cd591cd	unknown	unknown	0xb19a:$a: 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D
ssh.elf	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0x795a:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
ssh.elf	Linux_Trojan_Gafgyt_e4a1982b	unknown	unknown	0x313:$a: 8B 45 EC F7 D0 21 D0 33 45 FC C9 C3 55 48 89 E5 48 83 EC 30 48 89
ssh.elf	Linux_Trojan_Gafgyt_32eb0c81	unknown	unknown	0x74b:$a: D4 48 FF 45 F0 48 8B 45 F0 0F B6 00 84 C0 75 DB EB 12 48 8B
ssh.elf	Linux_Trojan_Gafgyt_a33a8363	unknown	unknown	0xb393:$a: 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E
Click to see the 14 entries

Memory Dumps

Source	Rule	Description	Author	Strings
5487.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_a6a2adb9	unknown	unknown	0x8af:$a: CC 01 C2 89 55 B4 8B 45 B4 C9 C3 55 48 89 E5 48 81 EC 90 00
5487.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x7318:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
5487.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_f3d83a74	unknown	unknown	0x7d6:$a: DC 00 74 1B 83 7D E0 0A 75 15 83 7D E4 00 79 0F C7 45 C8 01 00
5487.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0x7acf:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
5487.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_a0a4de11	unknown	unknown	0x1c03:$a: 42 0D 83 C8 10 88 42 0D 48 8B 55 D8 0F B6 42 0D 83 C8 08 88
5487.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0x47d6:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x493c:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
5487.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_09c3070e	unknown	unknown	0xfdd:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 0x1090:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 0x12c3:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83
5487.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0xafde:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
5487.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_d0c57a2e	unknown	unknown	0xcfc2:$a: 07 0F B6 57 01 C1 E0 08 09 D0 89 06 0F BE 47 02 C1 E8 1F 89
5487.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0x768f:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
5487.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_dd0d6173	unknown	unknown	0x164b:$a: 55 F8 8B 45 F0 89 42 0C 48 8B 55 F8 8B 45 F4 89 42 10 C9 C3 55 48
5487.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_779e142f	unknown	unknown	0x6fe:$a: EC 8B 45 E8 83 E0 02 85 C0 74 07 C7 45 D8 30 00 00 00 8B 45 E8 83
5487.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_cf84c9f2	unknown	unknown	0x31f:$a: 55 48 89 E5 48 83 EC 30 48 89 7D E8 89 75 E4 89 55 E0 C7 45 F8 01 00
5487.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_0cd591cd	unknown	unknown	0xb19a:$a: 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D
5487.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0x795a:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
5487.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_e4a1982b	unknown	unknown	0x313:$a: 8B 45 EC F7 D0 21 D0 33 45 FC C9 C3 55 48 89 E5 48 83 EC 30 48 89
5487.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_32eb0c81	unknown	unknown	0x74b:$a: D4 48 FF 45 F0 48 8B 45 F0 0F B6 00 84 C0 75 DB EB 12 48 8B
5487.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_a33a8363	unknown	unknown	0xb393:$a: 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E
5488.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_a6a2adb9	unknown	unknown	0x8af:$a: CC 01 C2 89 55 B4 8B 45 B4 C9 C3 55 48 89 E5 48 81 EC 90 00
5488.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x7318:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
5488.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_f3d83a74	unknown	unknown	0x7d6:$a: DC 00 74 1B 83 7D E0 0A 75 15 83 7D E4 00 79 0F C7 45 C8 01 00
5488.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0x7acf:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
5488.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_a0a4de11	unknown	unknown	0x1c03:$a: 42 0D 83 C8 10 88 42 0D 48 8B 55 D8 0F B6 42 0D 83 C8 08 88
5488.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0x47d6:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x493c:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
5488.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_09c3070e	unknown	unknown	0xfdd:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 0x1090:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 0x12c3:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83
5488.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0xafde:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
5488.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_d0c57a2e	unknown	unknown	0xcfc2:$a: 07 0F B6 57 01 C1 E0 08 09 D0 89 06 0F BE 47 02 C1 E8 1F 89
5488.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0x768f:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
5488.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_dd0d6173	unknown	unknown	0x164b:$a: 55 F8 8B 45 F0 89 42 0C 48 8B 55 F8 8B 45 F4 89 42 10 C9 C3 55 48
5488.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_779e142f	unknown	unknown	0x6fe:$a: EC 8B 45 E8 83 E0 02 85 C0 74 07 C7 45 D8 30 00 00 00 8B 45 E8 83
5488.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_cf84c9f2	unknown	unknown	0x31f:$a: 55 48 89 E5 48 83 EC 30 48 89 7D E8 89 75 E4 89 55 E0 C7 45 F8 01 00
5488.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_0cd591cd	unknown	unknown	0xb19a:$a: 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D
5488.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0x795a:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
5488.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_e4a1982b	unknown	unknown	0x313:$a: 8B 45 EC F7 D0 21 D0 33 45 FC C9 C3 55 48 89 E5 48 83 EC 30 48 89
5488.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_32eb0c81	unknown	unknown	0x74b:$a: D4 48 FF 45 F0 48 8B 45 F0 0F B6 00 84 C0 75 DB EB 12 48 8B
5488.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_a33a8363	unknown	unknown	0xb393:$a: 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E
Click to see the 31 entries

Suricata Signatures

ETPRO MALWARE ELF/Mirai Variant CnC Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-09T08:12:49.683178+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56202	89.33.192.138	6581	TCP
2025-01-09T08:12:51.172453+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56204	89.33.192.138	6581	TCP
2025-01-09T08:12:52.623661+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56206	89.33.192.138	6581	TCP
2025-01-09T08:12:54.077144+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56208	89.33.192.138	6581	TCP
2025-01-09T08:12:55.545755+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56210	89.33.192.138	6581	TCP
2025-01-09T08:12:56.998475+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56212	89.33.192.138	6581	TCP
2025-01-09T08:12:58.452238+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56214	89.33.192.138	6581	TCP
2025-01-09T08:12:59.917445+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56216	89.33.192.138	6581	TCP
2025-01-09T08:13:01.386366+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56218	89.33.192.138	6581	TCP
2025-01-09T08:13:02.823629+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56220	89.33.192.138	6581	TCP
2025-01-09T08:13:04.282029+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56222	89.33.192.138	6581	TCP
2025-01-09T08:13:05.746838+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56224	89.33.192.138	6581	TCP
2025-01-09T08:13:07.199935+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56226	89.33.192.138	6581	TCP
2025-01-09T08:13:08.669038+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56228	89.33.192.138	6581	TCP
2025-01-09T08:13:10.121218+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56230	89.33.192.138	6581	TCP
2025-01-09T08:13:11.574229+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56232	89.33.192.138	6581	TCP
2025-01-09T08:13:13.009541+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56234	89.33.192.138	6581	TCP
2025-01-09T08:13:14.469223+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56236	89.33.192.138	6581	TCP
2025-01-09T08:13:15.920464+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56238	89.33.192.138	6581	TCP
2025-01-09T08:13:17.372088+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56240	89.33.192.138	6581	TCP
2025-01-09T08:13:18.827259+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56242	89.33.192.138	6581	TCP
2025-01-09T08:13:20.292251+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56244	89.33.192.138	6581	TCP
2025-01-09T08:13:21.730225+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56246	89.33.192.138	6581	TCP
2025-01-09T08:13:23.186898+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56248	89.33.192.138	6581	TCP
2025-01-09T08:13:24.640090+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56250	89.33.192.138	6581	TCP
2025-01-09T08:13:26.288549+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56252	89.33.192.138	6581	TCP
2025-01-09T08:13:27.765053+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56254	89.33.192.138	6581	TCP
2025-01-09T08:13:29.214854+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56256	89.33.192.138	6581	TCP
2025-01-09T08:13:30.671294+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56258	89.33.192.138	6581	TCP
2025-01-09T08:13:32.140085+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56260	89.33.192.138	6581	TCP
2025-01-09T08:13:33.589186+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56262	89.33.192.138	6581	TCP
2025-01-09T08:13:35.042327+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56264	89.33.192.138	6581	TCP
2025-01-09T08:13:36.479806+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56266	89.33.192.138	6581	TCP
2025-01-09T08:13:37.917766+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56268	89.33.192.138	6581	TCP
2025-01-09T08:13:39.374521+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56270	89.33.192.138	6581	TCP
2025-01-09T08:13:40.827452+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56272	89.33.192.138	6581	TCP
2025-01-09T08:13:42.280163+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56274	89.33.192.138	6581	TCP
2025-01-09T08:13:43.751855+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56276	89.33.192.138	6581	TCP
2025-01-09T08:13:45.200537+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56278	89.33.192.138	6581	TCP
2025-01-09T08:13:46.636361+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56280	89.33.192.138	6581	TCP
2025-01-09T08:13:48.074463+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56282	89.33.192.138	6581	TCP
2025-01-09T08:13:49.527099+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56284	89.33.192.138	6581	TCP
2025-01-09T08:13:50.982076+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56286	89.33.192.138	6581	TCP
2025-01-09T08:13:52.454259+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56288	89.33.192.138	6581	TCP
2025-01-09T08:13:53.918240+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56290	89.33.192.138	6581	TCP
2025-01-09T08:13:55.373083+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56292	89.33.192.138	6581	TCP
2025-01-09T08:13:56.825947+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56294	89.33.192.138	6581	TCP
2025-01-09T08:13:58.268346+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56296	89.33.192.138	6581	TCP
2025-01-09T08:13:59.733899+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56298	89.33.192.138	6581	TCP
2025-01-09T08:14:01.167109+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56300	89.33.192.138	6581	TCP
2025-01-09T08:14:02.625113+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56302	89.33.192.138	6581	TCP
2025-01-09T08:14:04.074785+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56304	89.33.192.138	6581	TCP
2025-01-09T08:14:05.529767+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56306	89.33.192.138	6581	TCP
2025-01-09T08:14:06.984548+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56308	89.33.192.138	6581	TCP
2025-01-09T08:14:08.439626+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56310	89.33.192.138	6581	TCP
2025-01-09T08:14:09.887553+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56312	89.33.192.138	6581	TCP
2025-01-09T08:14:11.359560+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56314	89.33.192.138	6581	TCP
2025-01-09T08:14:12.811762+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56316	89.33.192.138	6581	TCP
2025-01-09T08:14:14.270030+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56318	89.33.192.138	6581	TCP
2025-01-09T08:14:15.716832+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56320	89.33.192.138	6581	TCP
2025-01-09T08:14:17.152507+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56322	89.33.192.138	6581	TCP
2025-01-09T08:14:18.625762+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56324	89.33.192.138	6581	TCP
2025-01-09T08:14:20.074866+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56326	89.33.192.138	6581	TCP
2025-01-09T08:14:21.528062+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56328	89.33.192.138	6581	TCP
2025-01-09T08:14:22.965203+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56330	89.33.192.138	6581	TCP
2025-01-09T08:14:24.422265+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56332	89.33.192.138	6581	TCP
2025-01-09T08:14:25.873740+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56334	89.33.192.138	6581	TCP
2025-01-09T08:14:27.308653+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56336	89.33.192.138	6581	TCP
2025-01-09T08:14:28.763616+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56338	89.33.192.138	6581	TCP
2025-01-09T08:14:30.218256+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56340	89.33.192.138	6581	TCP
2025-01-09T08:14:31.673656+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56342	89.33.192.138	6581	TCP
2025-01-09T08:14:33.202204+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56344	89.33.192.138	6581	TCP
2025-01-09T08:14:34.653247+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56346	89.33.192.138	6581	TCP
2025-01-09T08:14:36.123446+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56348	89.33.192.138	6581	TCP
2025-01-09T08:14:37.578946+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56350	89.33.192.138	6581	TCP
2025-01-09T08:14:39.031615+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56352	89.33.192.138	6581	TCP
2025-01-09T08:14:40.481697+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56354	89.33.192.138	6581	TCP
2025-01-09T08:14:41.918675+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56356	89.33.192.138	6581	TCP
2025-01-09T08:14:43.375412+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56358	89.33.192.138	6581	TCP
2025-01-09T08:14:44.847887+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56360	89.33.192.138	6581	TCP
2025-01-09T08:14:46.369992+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56362	89.33.192.138	6581	TCP
2025-01-09T08:14:47.812068+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56364	89.33.192.138	6581	TCP
2025-01-09T08:14:49.272242+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56366	89.33.192.138	6581	TCP
2025-01-09T08:14:50.735269+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56368	89.33.192.138	6581	TCP
2025-01-09T08:14:52.201516+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56370	89.33.192.138	6581	TCP
2025-01-09T08:14:53.655041+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56372	89.33.192.138	6581	TCP
2025-01-09T08:14:55.127998+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56374	89.33.192.138	6581	TCP
2025-01-09T08:14:56.594370+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56376	89.33.192.138	6581	TCP
2025-01-09T08:14:58.048545+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56378	89.33.192.138	6581	TCP
2025-01-09T08:14:59.497737+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56380	89.33.192.138	6581	TCP
2025-01-09T08:15:00.954392+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56382	89.33.192.138	6581	TCP
2025-01-09T08:15:02.412349+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56384	89.33.192.138	6581	TCP
2025-01-09T08:15:03.878305+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56386	89.33.192.138	6581	TCP
2025-01-09T08:15:05.360946+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56388	89.33.192.138	6581	TCP
2025-01-09T08:15:06.812240+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56390	89.33.192.138	6581	TCP
2025-01-09T08:15:08.282449+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56392	89.33.192.138	6581	TCP
2025-01-09T08:15:09.730063+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56394	89.33.192.138	6581	TCP
2025-01-09T08:15:11.190546+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56396	89.33.192.138	6581	TCP
2025-01-09T08:15:12.654793+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56398	89.33.192.138	6581	TCP
2025-01-09T08:15:14.091515+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56400	89.33.192.138	6581	TCP
2025-01-09T08:15:15.547954+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56402	89.33.192.138	6581	TCP
2025-01-09T08:15:17.016417+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56404	89.33.192.138	6581	TCP
2025-01-09T08:15:18.476834+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56406	89.33.192.138	6581	TCP
2025-01-09T08:15:19.932960+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56408	89.33.192.138	6581	TCP
2025-01-09T08:15:21.390150+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56410	89.33.192.138	6581	TCP
2025-01-09T08:15:22.860471+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56412	89.33.192.138	6581	TCP
2025-01-09T08:15:24.310189+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56414	89.33.192.138	6581	TCP
2025-01-09T08:15:25.782490+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56416	89.33.192.138	6581	TCP
2025-01-09T08:15:27.236340+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56418	89.33.192.138	6581	TCP
2025-01-09T08:15:28.684346+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56420	89.33.192.138	6581	TCP
2025-01-09T08:15:30.123470+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56422	89.33.192.138	6581	TCP
2025-01-09T08:15:31.559752+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56424	89.33.192.138	6581	TCP
2025-01-09T08:15:32.997613+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56426	89.33.192.138	6581	TCP
2025-01-09T08:15:34.452520+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56428	89.33.192.138	6581	TCP
2025-01-09T08:15:36.224269+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56430	89.33.192.138	6581	TCP
2025-01-09T08:15:37.688906+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56432	89.33.192.138	6581	TCP
2025-01-09T08:15:39.138567+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56434	89.33.192.138	6581	TCP
2025-01-09T08:15:40.595382+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56436	89.33.192.138	6581	TCP
2025-01-09T08:15:42.065703+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56438	89.33.192.138	6581	TCP
2025-01-09T08:15:43.515417+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56440	89.33.192.138	6581	TCP
2025-01-09T08:15:44.966491+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56442	89.33.192.138	6581	TCP
2025-01-09T08:15:46.434824+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56444	89.33.192.138	6581	TCP
2025-01-09T08:15:47.889694+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56446	89.33.192.138	6581	TCP
2025-01-09T08:15:49.344426+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56448	89.33.192.138	6581	TCP
2025-01-09T08:15:50.797029+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56450	89.33.192.138	6581	TCP
2025-01-09T08:15:52.232731+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56452	89.33.192.138	6581	TCP
2025-01-09T08:15:53.685381+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56454	89.33.192.138	6581	TCP
2025-01-09T08:15:55.139133+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56456	89.33.192.138	6581	TCP
2025-01-09T08:15:56.597987+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56458	89.33.192.138	6581	TCP
2025-01-09T08:15:58.046142+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56460	89.33.192.138	6581	TCP
2025-01-09T08:15:59.482154+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56462	89.33.192.138	6581	TCP
2025-01-09T08:16:00.938826+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56464	89.33.192.138	6581	TCP
2025-01-09T08:16:02.389656+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56466	89.33.192.138	6581	TCP
2025-01-09T08:16:03.825961+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56468	89.33.192.138	6581	TCP
2025-01-09T08:16:05.273711+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56470	89.33.192.138	6581	TCP
2025-01-09T08:16:06.717441+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56472	89.33.192.138	6581	TCP
2025-01-09T08:16:08.155133+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56474	89.33.192.138	6581	TCP
2025-01-09T08:16:09.611834+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56476	89.33.192.138	6581	TCP
2025-01-09T08:16:11.081011+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56478	89.33.192.138	6581	TCP
2025-01-09T08:16:12.551197+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56480	89.33.192.138	6581	TCP
2025-01-09T08:16:14.000404+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56482	89.33.192.138	6581	TCP
2025-01-09T08:16:15.452269+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56484	89.33.192.138	6581	TCP
2025-01-09T08:16:16.906917+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56486	89.33.192.138	6581	TCP
2025-01-09T08:16:18.379334+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56488	89.33.192.138	6581	TCP
2025-01-09T08:16:19.826831+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56490	89.33.192.138	6581	TCP
2025-01-09T08:16:21.275734+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56492	89.33.192.138	6581	TCP
2025-01-09T08:16:22.737608+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56494	89.33.192.138	6581	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: ssh.elf

Avira: detected

Found malware configuration

Source: ssh.elf

Malware Configuration Extractor: Gafgyt {"C2 url": "89.33.192.138:6581"}

Multi AV Scanner detection for submitted file

Source: ssh.elf

ReversingLabs: Detection: 68%

Machine Learning detection for sample

Source: ssh.elf

Joe Sandbox ML: detected

Spreading

Opens /proc/net/* files useful for finding connected devices and routers

Source: /tmp/ssh.elf (PID: 5487)

Opens: /proc/net/route

Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56210 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56214 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56254 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56226 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56320 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56334 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56236 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56290 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56204 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56220 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56344 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56262 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56346 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56208 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56238 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56384 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56380 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56212 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56352 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56386 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56350 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56282 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56264 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56428 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56348 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56242 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56268 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56362 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56206 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56308 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56232 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56258 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56260 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56248 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56468 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56218 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56246 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56420 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56266 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56286 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56272 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56340 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56312 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56370 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56424 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56356 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56432 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56328 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56322 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56216 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56234 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56398 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56440 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56452 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56448 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56466 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56332 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56364 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56402 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56474 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56488 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56408 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56406 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56464 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56484 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56250 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56296 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56392 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56300 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56400 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56324 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56450 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56470 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56326 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56338 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56458 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56434 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56394 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56202 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56454 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56228 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56436 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56274 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56342 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56306 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56404 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56316 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56480 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56358 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56368 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56378 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56412 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56294 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56410 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56442 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56270 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56336 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56414 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56292 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56494 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56244 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56304 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56366 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56302 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56310 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56330 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56288 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56354 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56374 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56382 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56390 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56460 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56396 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56462 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56444 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56418 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56222 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56314 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56416 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56230 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56278 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56486 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56256 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56388 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56438 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56430 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56240 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56372 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56252 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56276 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56318 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56426 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56298 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56280 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56360 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56422 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56492 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56446 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56284 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56472 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56456 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56476 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56478 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56482 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56376 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56224 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56490 -> 89.33.192.138:6581

Source: global traffic

TCP traffic: 192.168.2.14:56202 -> 89.33.192.138:6581

Source: global traffic

TCP traffic: 192.168.2.14:46540 -> 185.125.190.26:443

Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 185.125.190.26
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

Source: unknown

Network traffic detected: HTTP traffic on port 46540 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: ssh.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 Author: unknown
Source: ssh.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: ssh.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 Author: unknown
Source: ssh.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: ssh.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a0a4de11 Author: unknown
Source: ssh.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: ssh.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_09c3070e Author: unknown
Source: ssh.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: ssh.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d0c57a2e Author: unknown
Source: ssh.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: ssh.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_dd0d6173 Author: unknown
Source: ssh.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_779e142f Author: unknown
Source: ssh.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_cf84c9f2 Author: unknown
Source: ssh.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: ssh.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: ssh.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_e4a1982b Author: unknown
Source: ssh.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_32eb0c81 Author: unknown
Source: ssh.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: 5487.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 Author: unknown
Source: 5487.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 5487.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 Author: unknown
Source: 5487.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: 5487.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a0a4de11 Author: unknown
Source: 5487.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 5487.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_09c3070e Author: unknown
Source: 5487.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 5487.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d0c57a2e Author: unknown
Source: 5487.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 5487.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_dd0d6173 Author: unknown
Source: 5487.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_779e142f Author: unknown
Source: 5487.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_cf84c9f2 Author: unknown
Source: 5487.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: 5487.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 5487.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_e4a1982b Author: unknown
Source: 5487.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_32eb0c81 Author: unknown
Source: 5487.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: 5488.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 Author: unknown
Source: 5488.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 5488.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 Author: unknown
Source: 5488.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: 5488.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a0a4de11 Author: unknown
Source: 5488.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 5488.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_09c3070e Author: unknown
Source: 5488.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 5488.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d0c57a2e Author: unknown
Source: 5488.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 5488.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_dd0d6173 Author: unknown
Source: 5488.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_779e142f Author: unknown
Source: 5488.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_cf84c9f2 Author: unknown
Source: 5488.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: 5488.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 5488.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_e4a1982b Author: unknown
Source: 5488.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_32eb0c81 Author: unknown
Source: 5488.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown

Contains symbols with names commonly found in malware

Source: ELF static info symbol of initial sample

Name: vseattack

Source: ssh.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = cdd0bb9ce40a000bb86b0c76616fe71fb7dbb87a044ddd778b7a07fdf804b877, id = a6a2adb9-9d54-42d4-abed-5b30d8062e97, last_modified = 2021-09-16
Source: ssh.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: ssh.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 1c5df68501b688905484ed47dc588306828aa7c114644428e22e5021bb39bd4a, id = f3d83a74-2888-435a-9a3c-b7de25084e9a, last_modified = 2021-09-16
Source: ssh.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: ssh.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a0a4de11 reference_sample = cf1ca1d824c8687e87a5b0275a0e39fa101442b4bbf470859ddda9982f9b3417, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 891cfc6a4c38fb257ada29050e0047bd1301e8f0a6a1a919685b1fcc2960b047, id = a0a4de11-fe65-449f-a990-ad5f18ac66f0, last_modified = 2021-09-16
Source: ssh.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: ssh.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_09c3070e reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 84fad96b60b297736c149e14de12671ff778bff427ab7684df2c541a6f6d7e7d, id = 09c3070e-4b71-45a0-aa62-0cc6e496644a, last_modified = 2021-09-16
Source: ssh.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: ssh.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d0c57a2e os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ee7d3a33575ed3aa7431489a8fb18bf30cfd5d6c776066ab2a27f93303124b6, id = d0c57a2e-c10c-436c-be13-50a269326cf2, last_modified = 2021-09-16
Source: ssh.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: ssh.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_dd0d6173 reference_sample = c5a317d0d8470814ff343ce78ad2428ebb3f036763fcf703a589b6c4d33a3ec6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 5e2cb111c2b712951b71166111d339724b4f52b93f90cb474f1e67598212605f, id = dd0d6173-b863-45cf-9348-3375a4e624cf, last_modified = 2021-09-16
Source: ssh.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_779e142f reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 83377b6fa77fda4544c409487d2d2c1ddcef8f7d4120f49a18888c7536f3969f, id = 779e142f-b867-46e6-b1fb-9105976f42fd, last_modified = 2021-09-16
Source: ssh.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_cf84c9f2 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = bb766b356c3e8706740e3bb9b4a7171d8eb5137e09fc7ab6952412fa55e2dcfc, id = cf84c9f2-7435-4faf-8c5f-d14945ffad7a, last_modified = 2021-09-16
Source: ssh.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: ssh.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: ssh.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_e4a1982b os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d9f852c28433128b0fd330bee35f7bd4aada5226e9ca865fe5cd8cca52b2a622, id = e4a1982b-928a-4da5-b497-cedc1d26e845, last_modified = 2021-09-16
Source: ssh.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_32eb0c81 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 7c50ed29e2dd75a6a85afc43f8452794cb787ecd2061f4bf415d7038c14c523f, id = 32eb0c81-25af-4670-ab77-07ea7ce1874a, last_modified = 2021-09-16
Source: ssh.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: 5487.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = cdd0bb9ce40a000bb86b0c76616fe71fb7dbb87a044ddd778b7a07fdf804b877, id = a6a2adb9-9d54-42d4-abed-5b30d8062e97, last_modified = 2021-09-16
Source: 5487.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 5487.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 1c5df68501b688905484ed47dc588306828aa7c114644428e22e5021bb39bd4a, id = f3d83a74-2888-435a-9a3c-b7de25084e9a, last_modified = 2021-09-16
Source: 5487.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: 5487.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a0a4de11 reference_sample = cf1ca1d824c8687e87a5b0275a0e39fa101442b4bbf470859ddda9982f9b3417, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 891cfc6a4c38fb257ada29050e0047bd1301e8f0a6a1a919685b1fcc2960b047, id = a0a4de11-fe65-449f-a990-ad5f18ac66f0, last_modified = 2021-09-16
Source: 5487.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 5487.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_09c3070e reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 84fad96b60b297736c149e14de12671ff778bff427ab7684df2c541a6f6d7e7d, id = 09c3070e-4b71-45a0-aa62-0cc6e496644a, last_modified = 2021-09-16
Source: 5487.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 5487.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d0c57a2e os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ee7d3a33575ed3aa7431489a8fb18bf30cfd5d6c776066ab2a27f93303124b6, id = d0c57a2e-c10c-436c-be13-50a269326cf2, last_modified = 2021-09-16
Source: 5487.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 5487.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_dd0d6173 reference_sample = c5a317d0d8470814ff343ce78ad2428ebb3f036763fcf703a589b6c4d33a3ec6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 5e2cb111c2b712951b71166111d339724b4f52b93f90cb474f1e67598212605f, id = dd0d6173-b863-45cf-9348-3375a4e624cf, last_modified = 2021-09-16
Source: 5487.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_779e142f reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 83377b6fa77fda4544c409487d2d2c1ddcef8f7d4120f49a18888c7536f3969f, id = 779e142f-b867-46e6-b1fb-9105976f42fd, last_modified = 2021-09-16
Source: 5487.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_cf84c9f2 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = bb766b356c3e8706740e3bb9b4a7171d8eb5137e09fc7ab6952412fa55e2dcfc, id = cf84c9f2-7435-4faf-8c5f-d14945ffad7a, last_modified = 2021-09-16
Source: 5487.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: 5487.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 5487.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_e4a1982b os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d9f852c28433128b0fd330bee35f7bd4aada5226e9ca865fe5cd8cca52b2a622, id = e4a1982b-928a-4da5-b497-cedc1d26e845, last_modified = 2021-09-16
Source: 5487.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_32eb0c81 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 7c50ed29e2dd75a6a85afc43f8452794cb787ecd2061f4bf415d7038c14c523f, id = 32eb0c81-25af-4670-ab77-07ea7ce1874a, last_modified = 2021-09-16
Source: 5487.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: 5488.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = cdd0bb9ce40a000bb86b0c76616fe71fb7dbb87a044ddd778b7a07fdf804b877, id = a6a2adb9-9d54-42d4-abed-5b30d8062e97, last_modified = 2021-09-16
Source: 5488.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 5488.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 1c5df68501b688905484ed47dc588306828aa7c114644428e22e5021bb39bd4a, id = f3d83a74-2888-435a-9a3c-b7de25084e9a, last_modified = 2021-09-16
Source: 5488.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: 5488.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a0a4de11 reference_sample = cf1ca1d824c8687e87a5b0275a0e39fa101442b4bbf470859ddda9982f9b3417, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 891cfc6a4c38fb257ada29050e0047bd1301e8f0a6a1a919685b1fcc2960b047, id = a0a4de11-fe65-449f-a990-ad5f18ac66f0, last_modified = 2021-09-16
Source: 5488.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 5488.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_09c3070e reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 84fad96b60b297736c149e14de12671ff778bff427ab7684df2c541a6f6d7e7d, id = 09c3070e-4b71-45a0-aa62-0cc6e496644a, last_modified = 2021-09-16
Source: 5488.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 5488.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d0c57a2e os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ee7d3a33575ed3aa7431489a8fb18bf30cfd5d6c776066ab2a27f93303124b6, id = d0c57a2e-c10c-436c-be13-50a269326cf2, last_modified = 2021-09-16
Source: 5488.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 5488.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_dd0d6173 reference_sample = c5a317d0d8470814ff343ce78ad2428ebb3f036763fcf703a589b6c4d33a3ec6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 5e2cb111c2b712951b71166111d339724b4f52b93f90cb474f1e67598212605f, id = dd0d6173-b863-45cf-9348-3375a4e624cf, last_modified = 2021-09-16
Source: 5488.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_779e142f reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 83377b6fa77fda4544c409487d2d2c1ddcef8f7d4120f49a18888c7536f3969f, id = 779e142f-b867-46e6-b1fb-9105976f42fd, last_modified = 2021-09-16
Source: 5488.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_cf84c9f2 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = bb766b356c3e8706740e3bb9b4a7171d8eb5137e09fc7ab6952412fa55e2dcfc, id = cf84c9f2-7435-4faf-8c5f-d14945ffad7a, last_modified = 2021-09-16
Source: 5488.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: 5488.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 5488.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_e4a1982b os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d9f852c28433128b0fd330bee35f7bd4aada5226e9ca865fe5cd8cca52b2a622, id = e4a1982b-928a-4da5-b497-cedc1d26e845, last_modified = 2021-09-16
Source: 5488.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_32eb0c81 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 7c50ed29e2dd75a6a85afc43f8452794cb787ecd2061f4bf415d7038c14c523f, id = 32eb0c81-25af-4670-ab77-07ea7ce1874a, last_modified = 2021-09-16
Source: 5488.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.spre.troj.linELF@0/0@2/0

Source: ssh.elf	ELF static info symbol of initial sample: libc/string/x86_64/memcpy.S
Source: ssh.elf	ELF static info symbol of initial sample: libc/string/x86_64/mempcpy.S
Source: ssh.elf	ELF static info symbol of initial sample: libc/string/x86_64/memset.S
Source: ssh.elf	ELF static info symbol of initial sample: libc/string/x86_64/strchr.S
Source: ssh.elf	ELF static info symbol of initial sample: libc/string/x86_64/strcmp.S
Source: ssh.elf	ELF static info symbol of initial sample: libc/string/x86_64/strcpy.S
Source: ssh.elf	ELF static info symbol of initial sample: libc/string/x86_64/strlen.S
Source: ssh.elf	ELF static info symbol of initial sample: libc/string/x86_64/strpbrk.S
Source: ssh.elf	ELF static info symbol of initial sample: libc/string/x86_64/strspn.S
Source: ssh.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/x86_64/crt1.S
Source: ssh.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/x86_64/crti.S
Source: ssh.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/x86_64/crtn.S

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match

File source: ssh.elf, type: SAMPLE

Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.71 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36

Remote Access Functionality

Detected Mirai

Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin

Yara detected Gafgyt

Source: Yara match

File source: ssh.elf, type: SAMPLE

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	OS Credential Dumping	1 Remote System Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	2 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact

Malware Configuration

Threatname: Gafgyt

{"C2 url": "89.33.192.138:6581"}

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label
ssh.elf	68%	ReversingLabs	Linux.Trojan.Gafgyt
ssh.elf	100%	Avira	EXP/ELF.Mirai.Z
ssh.elf	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.24	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
89.33.192.138:6581	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
89.33.192.138	unknown	Romania		9009	M247GB	true
185.125.190.26	unknown	United Kingdom		41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
185.125.190.26	army6.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	boatnet.arm6.elf	Get hash	malicious	Mirai	Browse
	Kloki.x86_64.elf	Get hash	malicious	Unknown	Browse
	uYtea.sh4.elf	Get hash	malicious	Unknown	Browse
	uYtea.arc.elf	Get hash	malicious	Mirai	Browse
	386.elf	Get hash	malicious	Unknown	Browse
	main_arm5.elf	Get hash	malicious	Mirai	Browse
	gigops.mpsl.elf	Get hash	malicious	Gafgyt	Browse
	94.156.227.153-sora.arm5-2025-01-07T16_09_13.elf	Get hash	malicious	Mirai	Browse
	94.156.227.153-sora.m68k-2025-01-07T16_09_14.elf	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	Fantazy.mips.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	watchdog.elf	Get hash	malicious	Xmrig	Browse	162.213.35.25
	12.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	gigganiggax86.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	army4.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.25
	army6.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	mippywippy.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	army5.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.25
	boatnet.mpsl.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	boatnet.ppc.elf	Get hash	malicious	Mirai	Browse	162.213.35.25

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
M247GB	3XtEci4Mmo.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	185.177.239.66
	miori.m68k.elf	Get hash	malicious	Unknown	Browse	217.138.193.6
	Draft HBL# TTPE6948502 SO#4174 - LCL SHIPPING ADVICE (KHH-HKG)-FOB .scr.exe	Get hash	malicious	PureLog Stealer, XWorm	Browse	104.250.180.178
	Hilix.m68k.elf	Get hash	malicious	Mirai	Browse	45.13.30.97
	5EfYBe3nch.exe	Get hash	malicious	LummaC, Amadey, Babadeda, LiteHTTP Bot, LummaC Stealer, Poverty Stealer, Stealc	Browse	185.244.212.106
	random.exe	Get hash	malicious	Poverty Stealer	Browse	185.244.212.106
	mpsl.elf	Get hash	malicious	Mirai, Moobot	Browse	45.88.100.158
	db0fa4b8db0333367e9bda3ab68b8042.i686.elf	Get hash	malicious	Mirai, Gafgyt	Browse	213.109.189.115
	UD3cS4ODWz.exe	Get hash	malicious	Unknown	Browse	185.156.175.43
	nXNMsYXFFc.exe	Get hash	malicious	Unknown	Browse	185.156.175.43
CANONICAL-ASGB	Fantazy.x86_64.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	x.elf	Get hash	malicious	Xmrig	Browse	91.189.91.42
	2.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	mips.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	12.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	2.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	12.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	army7.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	army6.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.125.190.26
	mippytippy.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, not stripped
Entropy (8bit):	5.989411318710647
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	ssh.elf
File size:	101'989 bytes
MD5:	00389ae9afc4e52098a16c0b227b45bd
SHA1:	59aab7520d7a6c875cf911f1588966825017e31f
SHA256:	26bb71bc8e6b6343bd80595934f5a8b1ef0a235a8efd86d2866a42ff82f512da
SHA512:	a84f7b11091cc2c739907a351a95e0bde6ff0bdb4da8845985f27a35288f455c1894ff651a01f93a57a5dd7a434bdb96d5f0a87dffbc85bd6bb52059b281dd2d
SSDEEP:	3072:R3tl3wYkMFJIeIbpLoIc2raQarJeteC9pbw:9JI9pc2+QarJeteC9pbw
TLSH:	3CA36B13A556C67FC0CB63F52BDBD6214423B8790B32720A73D8BCEA2B1A9C91E5D711
File Content Preview:	.ELF..............>.......@.....@.......p...........@.8...@.......................@.......@...............................................Q.......Q.....@........u..............Q.td....................................................H...._....Z...H........

Static ELF Info

ELF header
Class:	ELF64
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Advanced Micro Devices X86-64
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x400194
Flags:	0x0
ELF Header Size:	64
Program Header Offset:	64
Program Header Size:	56
Number of Program Headers:	3
Section Header Offset:	73328
Section Header Size:	64
Number of Section Headers:	15
Header String Table Index:	12

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x4000e8	0xe8	0x13	0x0	0x6	AX	0	0	1
.text	PROGBITS	0x400100	0x100	0xd688	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x40d788	0xd788	0xe	0x0	0x6	AX	0	0	1
.rodata	PROGBITS	0x40d7a0	0xd7a0	0x3071	0x0	0x2	A	0	0	32
.eh_frame	PROGBITS	0x410814	0x10814	0x4	0x0	0x2	A	0	0	4
.ctors	PROGBITS	0x510818	0x10818	0x10	0x0	0x3	WA	0	0	8
.dtors	PROGBITS	0x510828	0x10828	0x10	0x0	0x3	WA	0	0	8
.jcr	PROGBITS	0x510838	0x10838	0x8	0x0	0x3	WA	0	0	8
.data	PROGBITS	0x510840	0x10840	0xa18	0x0	0x3	WA	0	0	32
.bss	NOBITS	0x511260	0x11258	0x6b70	0x0	0x3	WA	0	0	32
.comment	PROGBITS	0x0	0x11258	0xbac	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x11e04	0x66	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x12230	0x4788	0x18	0x0		14	278	8
.strtab	STRTAB	0x0	0x169b8	0x24ad	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x10818	0x10818	6.4291	0x5	R E	0x100000	.init .text .fini .rodata .eh_frame
LOAD	0x10818	0x510818	0x510818	0xa40	0x75b8	2.6399	0x6	RW	0x100000	.ctors .dtors .jcr .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x8

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x4000e8	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x400100	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x40d788	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x40d7a0	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x410814	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x510818	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x510828	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x510838	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x510840	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x511260	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	14
C.91.5530	.symtab	0x40dc80	192	OBJECT	<unknown>	DEFAULT	4
Q	.symtab	0x5112e0	16384	OBJECT	<unknown>	DEFAULT	10
SendHTTPHex	.symtab	0x4027cf	455	FUNC	<unknown>	DEFAULT	2
SendSTDHEX	.symtab	0x401fcb	297	FUNC	<unknown>	DEFAULT	2
SendUDP	.symtab	0x40165f	858	FUNC	<unknown>	DEFAULT	2
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x510820	0	OBJECT	<unknown>	DEFAULT	6
__CTOR_LIST__	.symtab	0x510818	0	OBJECT	<unknown>	DEFAULT	6
__C_ctype_b	.symtab	0x510df0	8	OBJECT	<unknown>	DEFAULT	9
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x40eb20	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x511248	8	OBJECT	<unknown>	DEFAULT	9
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x4104c0	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x510e00	8	OBJECT	<unknown>	DEFAULT	9
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x40ee20	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x510830	0	OBJECT	<unknown>	DEFAULT	7
__DTOR_LIST__	.symtab	0x510828	0	OBJECT	<unknown>	DEFAULT	7
__EH_FRAME_BEGIN__	.symtab	0x410814	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x410814	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x510df0	8	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_b_data	.symtab	0x40eb20	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_tolower	.symtab	0x511248	8	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_tolower_data	.symtab	0x4104c0	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_toupper	.symtab	0x510e00	8	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_toupper_data	.symtab	0x40ee20	768	OBJECT	<unknown>	HIDDEN	4
__GI___ctype_b	.symtab	0x510df8	8	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_tolower	.symtab	0x511250	8	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_toupper	.symtab	0x510e08	8	OBJECT	<unknown>	HIDDEN	9
__GI___errno_location	.symtab	0x404d6c	6	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x40ae9c	222	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x406c40	14	FUNC	<unknown>	HIDDEN	2
__GI___h_errno_location	.symtab	0x409594	6	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x4047d0	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_lseek	.symtab	0x4092e8	45	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x4049c4	106	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x408c58	70	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x408cd7	67	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x406c50	194	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x404834	42	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x40824c	276	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x408730	18	FUNC	<unknown>	HIDDEN	2
__GI_atol	.symtab	0x408744	12	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x40c25c	43	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0x40488c	38	FUNC	<unknown>	HIDDEN	2
__GI_clock_getres	.symtab	0x409034	41	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x4048b4	41	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0x404b74	116	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x407208	43	FUNC	<unknown>	HIDDEN	2
__GI_errno	.symtab	0x51759c	4	OBJECT	<unknown>	HIDDEN	10
__GI_exit	.symtab	0x4088c8	92	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x404d74	259	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x4047d0	100	FUNC	<unknown>	HIDDEN	2
__GI_fcntl64	.symtab	0x4047d0	100	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x406344	329	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x40ae9c	222	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x4061fc	109	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x406490	116	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x404e78	10	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x4048e0	38	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x406504	56	FUNC	<unknown>	HIDDEN	2
__GI_fscanf	.symtab	0x40616c	142	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x40c3c4	5	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x40c4b0	218	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x409060	82	FUNC	<unknown>	HIDDEN	2
__GI_fstat64	.symtab	0x409060	82	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x40653c	134	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x40ae9c	222	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x4091e0	35	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x409204	38	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x40922c	38	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x409254	38	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname	.symtab	0x406e4c	53	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x406e84	897	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x40927c	19	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x404908	38	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x409290	40	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x407234	41	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x4092b8	38	FUNC	<unknown>	HIDDEN	2
__GI_h_errno	.symtab	0x5175a0	4	OBJECT	<unknown>	HIDDEN	10
__GI_inet_addr	.symtab	0x406e30	28	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x40b580	137	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa	.symtab	0x406e25	10	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa_r	.symtab	0x406dd8	77	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x40cd0c	527	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x40ca07	493	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x408677	185	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x404930	104	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x406d30	25	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x404998	44	FUNC	<unknown>	HIDDEN	2
__GI_lseek	.symtab	0x4092e8	45	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x4092e0	5	FUNC	<unknown>	HIDDEN	2
__GI_mbrtowc	.symtab	0x40c2b4	113	FUNC	<unknown>	HIDDEN	2
__GI_mbsnrtowcs	.symtab	0x40c328	153	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x40afdc	240	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x4065d0	102	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x40b0cc	734	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x40af80	90	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x40b3ac	237	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x406640	210	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x409004	48	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x409318	38	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x409340	38	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x4049c4	106	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0x404be8	243	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x40c288	41	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x40bfdc	18	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x40836c	72	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x408574	90	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x40c810	190	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x404a68	39	FUNC	<unknown>	HIDDEN	2
__GI_readdir	.symtab	0x404cdc	143	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x407294	11	FUNC	<unknown>	HIDDEN	2
__GI_recvfrom	.symtab	0x4072a0	45	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x409368	74	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x404a90	44	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x4072d0	11	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x4072dc	48	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x404abc	38	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x40730c	53	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x4084cc	168	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x408f0d	247	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x407374	168	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x4093b4	85	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x408924	415	FUNC	<unknown>	HIDDEN	2
__GI_snprintf	.symtab	0x404e84	137	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x407344	47	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x404f10	149	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x4085ce	169	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x40d544	48	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x406720	417	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x4068c4	33	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x4068c4	33	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x4068f0	213	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x40c948	54	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x4069d0	225	FUNC	<unknown>	HIDDEN	2
__GI_strncat	.symtab	0x40c8d0	119	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x40b49c	131	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x406ab4	206	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x40c6f8	140	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x40c788	135	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x406b84	187	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x406d24	10	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x40b520	94	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x408750	10	FUNC	<unknown>	HIDDEN	2
__GI_strtoll	.symtab	0x408750	10	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x408ac4	351	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x406d4c	110	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x404ae4	39	FUNC	<unknown>	HIDDEN	2
__GI_tolower	.symtab	0x40d524	30	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x404b54	30	FUNC	<unknown>	HIDDEN	2
__GI_ungetc	.symtab	0x40c3cc	228	FUNC	<unknown>	HIDDEN	2
__GI_vfscanf	.symtab	0x40a0d1	1770	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x404fa8	199	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x40940c	47	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x404b0c	7	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x40959c	68	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x4095f0	140	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x4095e0	15	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x404b14	42	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x510838	0	OBJECT	<unknown>	DEFAULT	8
__JCR_LIST__	.symtab	0x510838	0	OBJECT	<unknown>	DEFAULT	8
__app_fini	.symtab	0x517588	8	OBJECT	<unknown>	HIDDEN	10
__atexit_lock	.symtab	0x5111e0	40	OBJECT	<unknown>	DEFAULT	9
__bsd_signal	.symtab	0x407374	168	FUNC	<unknown>	HIDDEN	2
__bss_start	.symtab	0x511258	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x408ca2	53	FUNC	<unknown>	DEFAULT	2
__ctype_b	.symtab	0x510df8	8	OBJECT	<unknown>	DEFAULT	9
__ctype_tolower	.symtab	0x511250	8	OBJECT	<unknown>	DEFAULT	9
__ctype_toupper	.symtab	0x510e08	8	OBJECT	<unknown>	DEFAULT	9
__curbrk	.symtab	0x5175f0	8	OBJECT	<unknown>	HIDDEN	10
__data_start	.symtab	0x510850	0	NOTYPE	<unknown>	DEFAULT	9
__decode_answer	.symtab	0x40d0c8	242	FUNC	<unknown>	HIDDEN	2
__decode_dotted	.symtab	0x40d614	246	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x40cfc0	161	FUNC	<unknown>	HIDDEN	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__dns_lookup	.symtab	0x40b60c	1862	FUNC	<unknown>	HIDDEN	2
__do_global_ctors_aux	.symtab	0x40d750	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x400100	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x510840	0	OBJECT	<unknown>	HIDDEN	9
__encode_dotted	.symtab	0x40d574	160	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x40cf1c	163	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x40d064	80	FUNC	<unknown>	HIDDEN	2
__environ	.symtab	0x517578	8	OBJECT	<unknown>	DEFAULT	10
__errno_location	.symtab	0x404d6c	6	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x517568	8	OBJECT	<unknown>	HIDDEN	10
__fgetc_unlocked	.symtab	0x40ae9c	222	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x510818	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fini_array_start	.symtab	0x510818	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__get_hosts_byname_r	.symtab	0x40bfac	48	FUNC	<unknown>	HIDDEN	2
__getdents	.symtab	0x4090b4	300	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x4090b4	300	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x40927c	19	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x406c40	14	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__h_errno_location	.symtab	0x409594	6	FUNC	<unknown>	DEFAULT	2
__h_errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__init_array_end	.symtab	0x510818	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__init_array_start	.symtab	0x510818	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__init_scan_cookie	.symtab	0x40a7c4	67	FUNC	<unknown>	HIDDEN	2
__length_dotted	.symtab	0x40d70c	59	FUNC	<unknown>	HIDDEN	2
__length_question	.symtab	0x40d0b4	19	FUNC	<unknown>	HIDDEN	2
__libc_close	.symtab	0x4048b4	41	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x407208	43	FUNC	<unknown>	DEFAULT	2
__libc_creat	.symtab	0x404a2e	14	FUNC	<unknown>	DEFAULT	2
__libc_fcntl	.symtab	0x4047d0	100	FUNC	<unknown>	DEFAULT	2
__libc_fcntl64	.symtab	0x4047d0	100	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x4048e0	38	FUNC	<unknown>	DEFAULT	2
__libc_getpid	.symtab	0x404908	38	FUNC	<unknown>	DEFAULT	2
__libc_lseek	.symtab	0x4092e8	45	FUNC	<unknown>	DEFAULT	2
__libc_lseek64	.symtab	0x4092e0	5	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0x409340	38	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x4049c4	106	FUNC	<unknown>	DEFAULT	2
__libc_poll	.symtab	0x40c288	41	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x404a68	39	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x407294	11	FUNC	<unknown>	DEFAULT	2
__libc_recvfrom	.symtab	0x4072a0	45	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x404a90	44	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x4072d0	11	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x4072dc	48	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x408f0d	247	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x517570	8	OBJECT	<unknown>	DEFAULT	10
__libc_waitpid	.symtab	0x404b0c	7	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x404b14	42	FUNC	<unknown>	DEFAULT	2
__malloc_consolidate	.symtab	0x407ed1	410	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x407478	96	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x511060	40	OBJECT	<unknown>	DEFAULT	9
__malloc_state	.symtab	0x5176a0	1752	OBJECT	<unknown>	DEFAULT	10
__malloc_trim	.symtab	0x407e38	153	FUNC	<unknown>	DEFAULT	2
__nameserver	.symtab	0x517da0	24	OBJECT	<unknown>	HIDDEN	10
__nameservers	.symtab	0x517db8	4	OBJECT	<unknown>	HIDDEN	10
__open_etc_hosts	.symtab	0x40d1bc	42	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x40bd54	597	FUNC	<unknown>	HIDDEN	2
__pagesize	.symtab	0x517580	8	OBJECT	<unknown>	DEFAULT	10
__preinit_array_end	.symtab	0x510818	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__preinit_array_start	.symtab	0x510818	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__psfs_do_numeric	.symtab	0x40aa4c	1103	FUNC	<unknown>	HIDDEN	2
__psfs_do_numeric.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__psfs_parse_spec	.symtab	0x40a86c	479	FUNC	<unknown>	HIDDEN	2
__psfs_parse_spec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__pthread_initialize_minimal	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0x408c9e	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x408c9e	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x408c9e	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x408c9e	3	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x408c9e	3	FUNC	<unknown>	DEFAULT	2
__pthread_return_void	.symtab	0x408ca1	1	FUNC	<unknown>	DEFAULT	2
__raise	.symtab	0x40bfdc	18	FUNC	<unknown>	HIDDEN	2
__read_etc_hosts_r	.symtab	0x40d1e6	830	FUNC	<unknown>	HIDDEN	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__resolv_lock	.symtab	0x511220	40	OBJECT	<unknown>	DEFAULT	9
__restore_rt	.symtab	0x408f04	0	NOTYPE	<unknown>	DEFAULT	2
__rtld_fini	.symtab	0x517590	8	OBJECT	<unknown>	HIDDEN	10
__scan_cookie.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__scan_getc	.symtab	0x40a807	67	FUNC	<unknown>	HIDDEN	2
__scan_ungetc	.symtab	0x40a84a	32	FUNC	<unknown>	HIDDEN	2
__searchdomain	.symtab	0x517d80	32	OBJECT	<unknown>	HIDDEN	10
__searchdomains	.symtab	0x517dbc	4	OBJECT	<unknown>	HIDDEN	10
__sigaddset	.symtab	0x40743c	28	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x407458	30	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x40741c	32	FUNC	<unknown>	DEFAULT	2
__stdin	.symtab	0x510e38	8	OBJECT	<unknown>	DEFAULT	9
__stdio_READ	.symtab	0x40c58c	58	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x40967c	147	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x40c5c8	133	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x409710	259	FUNC	<unknown>	HIDDEN	2
__stdio_init_mutex	.symtab	0x405303	15	FUNC	<unknown>	HIDDEN	2
__stdio_mutex_initializer.4280	.symtab	0x40f120	40	OBJECT	<unknown>	DEFAULT	4
__stdio_rfill	.symtab	0x40c650	37	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x40c6d4	31	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x40c678	90	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x409814	148	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x40539c	39	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x510e40	8	OBJECT	<unknown>	DEFAULT	9
__strtofpmax	.symtab	0x40bff0	593	FUNC	<unknown>	HIDDEN	2
__strtofpmax.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uClibc_fini	.symtab	0x408c58	70	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x408cd7	67	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x408d1a	489	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x511208	8	OBJECT	<unknown>	HIDDEN	9
__xpg_strerror_r	.symtab	0x406c50	194	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__xstat64_conv	.symtab	0x40943c	172	FUNC	<unknown>	HIDDEN	2
__xstat_conv	.symtab	0x4094e8	172	FUNC	<unknown>	HIDDEN	2
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_charpad	.symtab	0x4053c4	68	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_dl_aux_init	.symtab	0x40c244	23	FUNC	<unknown>	DEFAULT	2
_dl_phdr	.symtab	0x517dc0	8	OBJECT	<unknown>	DEFAULT	10
_dl_phnum	.symtab	0x517dc8	8	OBJECT	<unknown>	DEFAULT	10
_edata	.symtab	0x511258	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x517dd0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_errno	.symtab	0x51759c	4	OBJECT	<unknown>	DEFAULT	10
_exit	.symtab	0x404834	42	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x40d788	5	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x515320	8192	OBJECT	<unknown>	DEFAULT	10
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x405408	120	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x4099ec	1608	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_h_errno	.symtab	0x5175a0	4	OBJECT	<unknown>	DEFAULT	10
_init	.symtab	0x4000e8	5	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x4098a8	85	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_init	.symtab	0x405abc	114	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x405d6e	1022	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x405b30	67	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x405b74	457	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x405d40	46	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x408ca1	1	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x408ca1	1	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_sigintr	.symtab	0x517620	128	OBJECT	<unknown>	HIDDEN	10
_start	.symtab	0x400194	42	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x405070	551	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x405298	107	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x510e48	8	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_add_lock	.symtab	0x510e60	40	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_dec_use	.symtab	0x40626c	216	FUNC	<unknown>	DEFAULT	2
_stdio_openlist_del_count	.symtab	0x515304	4	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_del_lock	.symtab	0x510ea0	40	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_use_count	.symtab	0x515300	4	OBJECT	<unknown>	DEFAULT	10
_stdio_streams	.symtab	0x510ee0	384	OBJECT	<unknown>	DEFAULT	9
_stdio_term	.symtab	0x405312	135	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x510ec8	4	OBJECT	<unknown>	DEFAULT	9
_stdlib_strto_l	.symtab	0x40875c	362	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x409900	46	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x40f220	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x409930	187	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x405480	1595	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x40824c	276	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
access	.symtab	0x404860	41	FUNC	<unknown>	DEFAULT	2
access.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
advanced_kill_process	.symtab	0x40452e	49	FUNC	<unknown>	DEFAULT	2
atoi	.symtab	0x408730	18	FUNC	<unknown>	DEFAULT	2
atoi.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
atol	.symtab	0x408744	12	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
atoll	.symtab	0x408744	12	FUNC	<unknown>	DEFAULT	2
bcopy	.symtab	0x406d14	14	FUNC	<unknown>	DEFAULT	2
bcopy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
been_there_done_that	.symtab	0x517560	4	OBJECT	<unknown>	DEFAULT	10
been_there_done_that.3160	.symtab	0x517598	4	OBJECT	<unknown>	DEFAULT	10
bot.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
brk	.symtab	0x40c25c	43	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x407374	168	FUNC	<unknown>	DEFAULT	2
buf.2989	.symtab	0x517330	16	OBJECT	<unknown>	DEFAULT	10
buf.5285	.symtab	0x517340	500	OBJECT	<unknown>	DEFAULT	10
c	.symtab	0x5108bc	4	OBJECT	<unknown>	DEFAULT	9
calloc	.symtab	0x407d40	248	FUNC	<unknown>	DEFAULT	2
calloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
change_process_name_based_on_port	.symtab	0x4045da	174	FUNC	<unknown>	DEFAULT	2
chdir	.symtab	0x40488c	38	FUNC	<unknown>	DEFAULT	2
chdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
check_and_kill_processes	.symtab	0x404688	311	FUNC	<unknown>	DEFAULT	2
clock_getres	.symtab	0x409034	41	FUNC	<unknown>	DEFAULT	2
clock_getres.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x4048b4	41	FUNC	<unknown>	DEFAULT	2
close.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
closedir	.symtab	0x404b74	116	FUNC	<unknown>	DEFAULT	2
closedir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
commServer	.symtab	0x510860	8	OBJECT	<unknown>	DEFAULT	9
completed.2761	.symtab	0x511260	1	OBJECT	<unknown>	DEFAULT	10
connect	.symtab	0x407208	43	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connectTimeout	.symtab	0x40118f	572	FUNC	<unknown>	DEFAULT	2
creat	.symtab	0x404a2e	14	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
csum	.symtab	0x401494	115	FUNC	<unknown>	DEFAULT	2
currentServer	.symtab	0x5108b8	4	OBJECT	<unknown>	DEFAULT	9
data_start	.symtab	0x510850	0	NOTYPE	<unknown>	DEFAULT	9
decodea.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decpt_str	.symtab	0x410370	2	OBJECT	<unknown>	DEFAULT	4
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dnslookup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ	.symtab	0x517578	8	OBJECT	<unknown>	DEFAULT	10
errno	.symtab	0x51759c	4	OBJECT	<unknown>	DEFAULT	10
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x4088c8	92	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x4102a0	208	OBJECT	<unknown>	DEFAULT	4
fclose	.symtab	0x404d74	259	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x4047d0	100	FUNC	<unknown>	DEFAULT	2
fcntl64	.symtab	0x4047d0	100	FUNC	<unknown>	DEFAULT	2
fdgets	.symtab	0x40031f	128	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x406344	329	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x40ae9c	222	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x4061fc	109	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x406490	116	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fmt	.symtab	0x410280	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x404e78	10	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0x4048e0	38	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs_unlocked	.symtab	0x406504	56	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x400150	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x40806b	452	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fscanf	.symtab	0x40616c	142	FUNC	<unknown>	DEFAULT	2
fscanf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x40c3c4	5	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x40c3c4	5	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x40c4b0	218	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fstat	.symtab	0x409060	82	FUNC	<unknown>	DEFAULT	2
fstat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fstat64	.symtab	0x409060	82	FUNC	<unknown>	DEFAULT	2
ftcp	.symtab	0x4019b9	1554	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked	.symtab	0x40653c	134	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getArch	.symtab	0x402b5d	11	FUNC	<unknown>	DEFAULT	2
getHost	.symtab	0x400ea7	65	FUNC	<unknown>	DEFAULT	2
getOurIP	.symtab	0x40039f	484	FUNC	<unknown>	DEFAULT	2
getPortz	.symtab	0x402b68	142	FUNC	<unknown>	DEFAULT	2
getRandomIP	.symtab	0x4002f0	47	FUNC	<unknown>	DEFAULT	2
get_hosts_byname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
get_process_name	.symtab	0x404358	281	FUNC	<unknown>	DEFAULT	2
get_process_start_time	.symtab	0x4041b8	416	FUNC	<unknown>	DEFAULT	2
getc_unlocked	.symtab	0x40ae9c	222	FUNC	<unknown>	DEFAULT	2
getdents64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdtablesize	.symtab	0x4091e0	35	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x409204	38	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x40922c	38	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x409254	38	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname	.symtab	0x406e4c	53	FUNC	<unknown>	DEFAULT	2
gethostbyname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r	.symtab	0x406e84	897	FUNC	<unknown>	DEFAULT	2
gethostbyname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpagesize	.symtab	0x40927c	19	FUNC	<unknown>	DEFAULT	2
getpagesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x404908	38	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x409290	40	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit64	.symtab	0x409290	40	FUNC	<unknown>	DEFAULT	2
getsockname	.symtab	0x407234	41	FUNC	<unknown>	DEFAULT	2
getsockname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x407260	50	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x4092b8	38	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gotIP	.symtab	0x5112c4	4	OBJECT	<unknown>	DEFAULT	10
h.5284	.symtab	0x517540	32	OBJECT	<unknown>	DEFAULT	10
h_errno	.symtab	0x5175a0	4	OBJECT	<unknown>	DEFAULT	10
htonl	.symtab	0x406dc4	5	FUNC	<unknown>	DEFAULT	2
htons	.symtab	0x406dbc	8	FUNC	<unknown>	DEFAULT	2
i.4528	.symtab	0x5108c0	4	OBJECT	<unknown>	DEFAULT	9
index	.symtab	0x406720	417	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x406e30	28	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x40b580	137	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa	.symtab	0x406e25	10	FUNC	<unknown>	DEFAULT	2
inet_ntoa.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa_r	.symtab	0x406dd8	77	FUNC	<unknown>	DEFAULT	2
inet_ntop	.symtab	0x40cd0c	527	FUNC	<unknown>	DEFAULT	2
inet_ntop4	.symtab	0x40cbf4	280	FUNC	<unknown>	DEFAULT	2
inet_pton	.symtab	0x40ca07	493	FUNC	<unknown>	DEFAULT	2
inet_pton4	.symtab	0x40c980	135	FUNC	<unknown>	DEFAULT	2
initConnection	.symtab	0x403aab	298	FUNC	<unknown>	DEFAULT	2
init_rand	.symtab	0x4001c0	125	FUNC	<unknown>	DEFAULT	2
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initstate	.symtab	0x408416	110	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x408677	185	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x404930	104	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
is_digit	.symtab	0x404174	68	FUNC	<unknown>	DEFAULT	2
is_port_open	.symtab	0x40455f	123	FUNC	<unknown>	DEFAULT	2
is_whitelisted	.symtab	0x404471	140	FUNC	<unknown>	DEFAULT	2
isatty	.symtab	0x406d30	25	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isspace	.symtab	0x404b40	18	FUNC	<unknown>	DEFAULT	2
isspace.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0x404998	44	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill_process	.symtab	0x4044fd	49	FUNC	<unknown>	DEFAULT	2
killer.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
killer_main	.symtab	0x4047bf	16	FUNC	<unknown>	DEFAULT	2
lengthd.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lengthq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/memcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/mempcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/memset.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/strchr.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/strcmp.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/strcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/strlen.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/strpbrk.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/strspn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/x86_64/crt1.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/x86_64/crti.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/x86_64/crtn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
listFork	.symtab	0x4013cb	201	FUNC	<unknown>	DEFAULT	2
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek	.symtab	0x4092e8	45	FUNC	<unknown>	DEFAULT	2
lseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x4092e0	5	FUNC	<unknown>	DEFAULT	2
macAddress	.symtab	0x5112d0	6	OBJECT	<unknown>	DEFAULT	10
main	.symtab	0x403bd5	1439	FUNC	<unknown>	DEFAULT	2
mainCommSock	.symtab	0x5112c0	4	OBJECT	<unknown>	DEFAULT	10
makeIPPacket	.symtab	0x4015c6	153	FUNC	<unknown>	DEFAULT	2
makeRandomStr	.symtab	0x400ee8	109	FUNC	<unknown>	DEFAULT	2
makevsepacket	.symtab	0x4021cc	169	FUNC	<unknown>	DEFAULT	2
malloc	.symtab	0x4074d8	2149	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
malloc_trim	.symtab	0x40822f	28	FUNC	<unknown>	DEFAULT	2
mbrtowc	.symtab	0x40c2b4	113	FUNC	<unknown>	DEFAULT	2
mbrtowc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mbsnrtowcs	.symtab	0x40c328	153	FUNC	<unknown>	DEFAULT	2
mbsnrtowcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mbstate.2936	.symtab	0x5175f8	8	OBJECT	<unknown>	DEFAULT	10
mbstate.2936	.symtab	0x517600	8	OBJECT	<unknown>	DEFAULT	10
memchr	.symtab	0x40afdc	240	FUNC	<unknown>	DEFAULT	2
memchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memcpy	.symtab	0x4065d0	102	FUNC	<unknown>	DEFAULT	2
memmove	.symtab	0x40b0cc	734	FUNC	<unknown>	DEFAULT	2
memmove.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mempcpy	.symtab	0x40af80	90	FUNC	<unknown>	DEFAULT	2
memrchr	.symtab	0x40b3ac	237	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x406640	210	FUNC	<unknown>	DEFAULT	2
mmap	.symtab	0x409004	48	FUNC	<unknown>	DEFAULT	2
mmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
munmap	.symtab	0x409318	38	FUNC	<unknown>	DEFAULT	2
munmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mylock	.symtab	0x5110a0	40	OBJECT	<unknown>	DEFAULT	9
mylock	.symtab	0x5110e0	40	OBJECT	<unknown>	DEFAULT	9
mylock	.symtab	0x5175c0	40	OBJECT	<unknown>	DEFAULT	10
nan_inf_str.2505	.symtab	0x410490	21	OBJECT	<unknown>	DEFAULT	4
nan_inf_str.4663	.symtab	0x4103f5	11	OBJECT	<unknown>	DEFAULT	4
nanosleep	.symtab	0x409340	38	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
next_start.1440	.symtab	0x517320	8	OBJECT	<unknown>	DEFAULT	10
nil_string	.symtab	0x4103ef	6	OBJECT	<unknown>	DEFAULT	4
ntohl	.symtab	0x406dd1	5	FUNC	<unknown>	DEFAULT	2
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0x406dc9	8	FUNC	<unknown>	DEFAULT	2
ntop.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
numpids	.symtab	0x5112c8	8	OBJECT	<unknown>	DEFAULT	10
object.2814	.symtab	0x511280	48	OBJECT	<unknown>	DEFAULT	10
open	.symtab	0x4049c4	106	FUNC	<unknown>	DEFAULT	2
open.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opendir	.symtab	0x404be8	243	FUNC	<unknown>	DEFAULT	2
opendir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opennameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ourIP	.symtab	0x517608	4	OBJECT	<unknown>	DEFAULT	10
p.2759	.symtab	0x510848	0	OBJECT	<unknown>	DEFAULT	9
pids	.symtab	0x517610	8	OBJECT	<unknown>	DEFAULT	10
poll	.symtab	0x40c288	41	FUNC	<unknown>	DEFAULT	2
poll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prctl	.symtab	0x404a3c	44	FUNC	<unknown>	DEFAULT	2
prctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prefix.4494	.symtab	0x40f155	12	OBJECT	<unknown>	DEFAULT	4
print	.symtab	0x4008ba	1085	FUNC	<unknown>	DEFAULT	2
printchar	.symtab	0x400650	75	FUNC	<unknown>	DEFAULT	2
printi	.symtab	0x40077a	320	FUNC	<unknown>	DEFAULT	2
prints	.symtab	0x40069b	223	FUNC	<unknown>	DEFAULT	2
processCmd	.symtab	0x402bf6	3765	FUNC	<unknown>	DEFAULT	2
qual_chars	.symtab	0x410390	18	OBJECT	<unknown>	DEFAULT	4
qual_chars.4498	.symtab	0x40f170	20	OBJECT	<unknown>	DEFAULT	4
raise	.symtab	0x40bfdc	18	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x408360	11	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand_cmwc	.symtab	0x40023d	179	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x40836c	72	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x40fd80	40	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x408574	90	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randtbl	.symtab	0x511160	128	OBJECT	<unknown>	DEFAULT	9
rawmemchr	.symtab	0x40c810	190	FUNC	<unknown>	DEFAULT	2
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read	.symtab	0x404a68	39	FUNC	<unknown>	DEFAULT	2
read.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read_etc_hosts_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
readdir	.symtab	0x404cdc	143	FUNC	<unknown>	DEFAULT	2
readdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recv	.symtab	0x407294	11	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recvLine	.symtab	0x400f55	570	FUNC	<unknown>	DEFAULT	2
recvfrom	.symtab	0x4072a0	45	FUNC	<unknown>	DEFAULT	2
recvfrom.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sbrk	.symtab	0x409368	74	FUNC	<unknown>	DEFAULT	2
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sc_getc	.symtab	0x40a7bb	9	FUNC	<unknown>	DEFAULT	2
scan_getwc	.symtab	0x40a034	157	FUNC	<unknown>	DEFAULT	2
select	.symtab	0x404a90	44	FUNC	<unknown>	DEFAULT	2
select.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send	.symtab	0x4072d0	11	FUNC	<unknown>	DEFAULT	2
send.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sendHTTPtwo	.symtab	0x402996	455	FUNC	<unknown>	DEFAULT	2
sendto	.symtab	0x4072dc	48	FUNC	<unknown>	DEFAULT	2
sendto.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsid	.symtab	0x404abc	38	FUNC	<unknown>	DEFAULT	2
setsid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsockopt	.symtab	0x40730c	53	FUNC	<unknown>	DEFAULT	2
setsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate	.symtab	0x4083b4	98	FUNC	<unknown>	DEFAULT	2
setstate_r	.symtab	0x4084cc	168	FUNC	<unknown>	DEFAULT	2
sigaction	.symtab	0x408f0d	247	FUNC	<unknown>	DEFAULT	2
sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
signal	.symtab	0x407374	168	FUNC	<unknown>	DEFAULT	2
signal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigprocmask	.symtab	0x4093b4	85	FUNC	<unknown>	DEFAULT	2
sigprocmask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigsetops.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sleep	.symtab	0x408924	415	FUNC	<unknown>	DEFAULT	2
sleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
snprintf	.symtab	0x404e84	137	FUNC	<unknown>	DEFAULT	2
snprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket	.symtab	0x407344	47	FUNC	<unknown>	DEFAULT	2
socket.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket_connect	.symtab	0x4020f4	216	FUNC	<unknown>	DEFAULT	2
sockprintf	.symtab	0x400cf7	432	FUNC	<unknown>	DEFAULT	2
spec_allowed	.symtab	0x4103d0	16	OBJECT	<unknown>	DEFAULT	4
spec_and_mask.4497	.symtab	0x40f190	16	OBJECT	<unknown>	DEFAULT	4
spec_base	.symtab	0x4103e0	15	OBJECT	<unknown>	DEFAULT	4
spec_base.4493	.symtab	0x40f161	7	OBJECT	<unknown>	DEFAULT	4
spec_chars	.symtab	0x4103b0	23	OBJECT	<unknown>	DEFAULT	4
spec_chars.4494	.symtab	0x40f1c0	21	OBJECT	<unknown>	DEFAULT	4
spec_flags	.symtab	0x410380	4	OBJECT	<unknown>	DEFAULT	4
spec_flags.4493	.symtab	0x40f1d5	8	OBJECT	<unknown>	DEFAULT	4
spec_or_mask.4496	.symtab	0x40f1a0	16	OBJECT	<unknown>	DEFAULT	4
spec_ranges	.symtab	0x4103c7	8	OBJECT	<unknown>	DEFAULT	4
spec_ranges.4495	.symtab	0x40f1b0	9	OBJECT	<unknown>	DEFAULT	4
sprintf	.symtab	0x404f10	149	FUNC	<unknown>	DEFAULT	2
sprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
srand	.symtab	0x408484	72	FUNC	<unknown>	DEFAULT	2
srandom	.symtab	0x408484	72	FUNC	<unknown>	DEFAULT	2
srandom_r	.symtab	0x4085ce	169	FUNC	<unknown>	DEFAULT	2
static_id	.symtab	0x511210	2	OBJECT	<unknown>	DEFAULT	9
static_ns	.symtab	0x5175e8	4	OBJECT	<unknown>	DEFAULT	10
stderr	.symtab	0x510e30	8	OBJECT	<unknown>	DEFAULT	9
stdin	.symtab	0x510e20	8	OBJECT	<unknown>	DEFAULT	9
stdout	.symtab	0x510e28	8	OBJECT	<unknown>	DEFAULT	9
strcasecmp	.symtab	0x40d544	48	FUNC	<unknown>	DEFAULT	2
strcasecmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchr	.symtab	0x406720	417	FUNC	<unknown>	DEFAULT	2
strcmp	.symtab	0x4068c4	33	FUNC	<unknown>	DEFAULT	2
strcoll	.symtab	0x4068c4	33	FUNC	<unknown>	DEFAULT	2
strcpy	.symtab	0x4068f0	213	FUNC	<unknown>	DEFAULT	2
strdup	.symtab	0x40c948	54	FUNC	<unknown>	DEFAULT	2
strdup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strerror_r	.symtab	0x406c50	194	FUNC	<unknown>	DEFAULT	2
strlen	.symtab	0x4069d0	225	FUNC	<unknown>	DEFAULT	2
strncat	.symtab	0x40c8d0	119	FUNC	<unknown>	DEFAULT	2
strncat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncpy	.symtab	0x40b49c	131	FUNC	<unknown>	DEFAULT	2
strncpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strnlen	.symtab	0x406ab4	206	FUNC	<unknown>	DEFAULT	2
strnlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strpbrk	.symtab	0x40c6f8	140	FUNC	<unknown>	DEFAULT	2
strspn	.symtab	0x40c788	135	FUNC	<unknown>	DEFAULT	2
strstr	.symtab	0x406b84	187	FUNC	<unknown>	DEFAULT	2
strstr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtoimax	.symtab	0x408750	10	FUNC	<unknown>	DEFAULT	2
strtok	.symtab	0x406d24	10	FUNC	<unknown>	DEFAULT	2
strtok.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok_r	.symtab	0x40b520	94	FUNC	<unknown>	DEFAULT	2
strtok_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtol	.symtab	0x408750	10	FUNC	<unknown>	DEFAULT	2
strtol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtoll	.symtab	0x408750	10	FUNC	<unknown>	DEFAULT	2
sysconf	.symtab	0x408ac4	351	FUNC	<unknown>	DEFAULT	2
sysconf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcgetattr	.symtab	0x406d4c	110	FUNC	<unknown>	DEFAULT	2
tcgetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcpcsum	.symtab	0x401507	191	FUNC	<unknown>	DEFAULT	2
time	.symtab	0x404ae4	39	FUNC	<unknown>	DEFAULT	2
time.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tolower	.symtab	0x40d524	30	FUNC	<unknown>	DEFAULT	2
tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
toupper	.symtab	0x404b54	30	FUNC	<unknown>	DEFAULT	2
toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
trim	.symtab	0x400583	205	FUNC	<unknown>	DEFAULT	2
type_codes	.symtab	0x40f1e0	24	OBJECT	<unknown>	DEFAULT	4
type_sizes	.symtab	0x40f1f8	12	OBJECT	<unknown>	DEFAULT	4
ungetc	.symtab	0x40c3cc	228	FUNC	<unknown>	DEFAULT	2
ungetc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
unknown.2050	.symtab	0x40f204	14	OBJECT	<unknown>	DEFAULT	4
unsafe_state	.symtab	0x511120	48	OBJECT	<unknown>	DEFAULT	9
useragents	.symtab	0x510880	56	OBJECT	<unknown>	DEFAULT	9
usleep	.symtab	0x408c24	52	FUNC	<unknown>	DEFAULT	2
usleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
vfscanf	.symtab	0x40a0d1	1770	FUNC	<unknown>	DEFAULT	2
vfscanf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
vseattack	.symtab	0x402275	1370	FUNC	<unknown>	DEFAULT	2
vsnprintf	.symtab	0x404fa8	199	FUNC	<unknown>	DEFAULT	2
vsnprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wait4	.symtab	0x40940c	47	FUNC	<unknown>	DEFAULT	2
wait4.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
waitpid	.symtab	0x404b0c	7	FUNC	<unknown>	DEFAULT	2
waitpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcrtomb	.symtab	0x40959c	68	FUNC	<unknown>	DEFAULT	2
wcrtomb.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsnrtombs	.symtab	0x4095f0	140	FUNC	<unknown>	DEFAULT	2
wcsnrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsrtombs	.symtab	0x4095e0	15	FUNC	<unknown>	DEFAULT	2
wcsrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
whitelist_pid_count	.symtab	0x5152e8	8	OBJECT	<unknown>	DEFAULT	10
whitelist_size	.symtab	0x40eae0	8	OBJECT	<unknown>	DEFAULT	4
whitelisted_pids	.symtab	0x5152e0	0	OBJECT	<unknown>	DEFAULT	10
whitelisted_processes	.symtab	0x5108e0	1296	OBJECT	<unknown>	DEFAULT	9
write	.symtab	0x404b14	42	FUNC	<unknown>	DEFAULT	2
write.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
xdigits.3747	.symtab	0x4107e0	17	OBJECT	<unknown>	DEFAULT	4
xstatconv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-09T08:12:49.683178+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56202	89.33.192.138	6581	TCP
2025-01-09T08:12:51.172453+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56204	89.33.192.138	6581	TCP
2025-01-09T08:12:52.623661+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56206	89.33.192.138	6581	TCP
2025-01-09T08:12:54.077144+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56208	89.33.192.138	6581	TCP
2025-01-09T08:12:55.545755+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56210	89.33.192.138	6581	TCP
2025-01-09T08:12:56.998475+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56212	89.33.192.138	6581	TCP
2025-01-09T08:12:58.452238+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56214	89.33.192.138	6581	TCP
2025-01-09T08:12:59.917445+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56216	89.33.192.138	6581	TCP
2025-01-09T08:13:01.386366+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56218	89.33.192.138	6581	TCP
2025-01-09T08:13:02.823629+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56220	89.33.192.138	6581	TCP
2025-01-09T08:13:04.282029+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56222	89.33.192.138	6581	TCP
2025-01-09T08:13:05.746838+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56224	89.33.192.138	6581	TCP
2025-01-09T08:13:07.199935+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56226	89.33.192.138	6581	TCP
2025-01-09T08:13:08.669038+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56228	89.33.192.138	6581	TCP
2025-01-09T08:13:10.121218+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56230	89.33.192.138	6581	TCP
2025-01-09T08:13:11.574229+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56232	89.33.192.138	6581	TCP
2025-01-09T08:13:13.009541+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56234	89.33.192.138	6581	TCP
2025-01-09T08:13:14.469223+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56236	89.33.192.138	6581	TCP
2025-01-09T08:13:15.920464+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56238	89.33.192.138	6581	TCP
2025-01-09T08:13:17.372088+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56240	89.33.192.138	6581	TCP
2025-01-09T08:13:18.827259+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56242	89.33.192.138	6581	TCP
2025-01-09T08:13:20.292251+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56244	89.33.192.138	6581	TCP
2025-01-09T08:13:21.730225+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56246	89.33.192.138	6581	TCP
2025-01-09T08:13:23.186898+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56248	89.33.192.138	6581	TCP
2025-01-09T08:13:24.640090+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56250	89.33.192.138	6581	TCP
2025-01-09T08:13:26.288549+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56252	89.33.192.138	6581	TCP
2025-01-09T08:13:27.765053+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56254	89.33.192.138	6581	TCP
2025-01-09T08:13:29.214854+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56256	89.33.192.138	6581	TCP
2025-01-09T08:13:30.671294+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56258	89.33.192.138	6581	TCP
2025-01-09T08:13:32.140085+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56260	89.33.192.138	6581	TCP
2025-01-09T08:13:33.589186+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56262	89.33.192.138	6581	TCP
2025-01-09T08:13:35.042327+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56264	89.33.192.138	6581	TCP
2025-01-09T08:13:36.479806+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56266	89.33.192.138	6581	TCP
2025-01-09T08:13:37.917766+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56268	89.33.192.138	6581	TCP
2025-01-09T08:13:39.374521+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56270	89.33.192.138	6581	TCP
2025-01-09T08:13:40.827452+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56272	89.33.192.138	6581	TCP
2025-01-09T08:13:42.280163+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56274	89.33.192.138	6581	TCP
2025-01-09T08:13:43.751855+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56276	89.33.192.138	6581	TCP
2025-01-09T08:13:45.200537+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56278	89.33.192.138	6581	TCP
2025-01-09T08:13:46.636361+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56280	89.33.192.138	6581	TCP
2025-01-09T08:13:48.074463+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56282	89.33.192.138	6581	TCP
2025-01-09T08:13:49.527099+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56284	89.33.192.138	6581	TCP
2025-01-09T08:13:50.982076+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56286	89.33.192.138	6581	TCP
2025-01-09T08:13:52.454259+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56288	89.33.192.138	6581	TCP
2025-01-09T08:13:53.918240+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56290	89.33.192.138	6581	TCP
2025-01-09T08:13:55.373083+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56292	89.33.192.138	6581	TCP
2025-01-09T08:13:56.825947+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56294	89.33.192.138	6581	TCP
2025-01-09T08:13:58.268346+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56296	89.33.192.138	6581	TCP
2025-01-09T08:13:59.733899+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56298	89.33.192.138	6581	TCP
2025-01-09T08:14:01.167109+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56300	89.33.192.138	6581	TCP
2025-01-09T08:14:02.625113+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56302	89.33.192.138	6581	TCP
2025-01-09T08:14:04.074785+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56304	89.33.192.138	6581	TCP
2025-01-09T08:14:05.529767+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56306	89.33.192.138	6581	TCP
2025-01-09T08:14:06.984548+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56308	89.33.192.138	6581	TCP
2025-01-09T08:14:08.439626+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56310	89.33.192.138	6581	TCP
2025-01-09T08:14:09.887553+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56312	89.33.192.138	6581	TCP
2025-01-09T08:14:11.359560+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56314	89.33.192.138	6581	TCP
2025-01-09T08:14:12.811762+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56316	89.33.192.138	6581	TCP
2025-01-09T08:14:14.270030+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56318	89.33.192.138	6581	TCP
2025-01-09T08:14:15.716832+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56320	89.33.192.138	6581	TCP
2025-01-09T08:14:17.152507+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56322	89.33.192.138	6581	TCP
2025-01-09T08:14:18.625762+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56324	89.33.192.138	6581	TCP
2025-01-09T08:14:20.074866+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56326	89.33.192.138	6581	TCP
2025-01-09T08:14:21.528062+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56328	89.33.192.138	6581	TCP
2025-01-09T08:14:22.965203+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56330	89.33.192.138	6581	TCP
2025-01-09T08:14:24.422265+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56332	89.33.192.138	6581	TCP
2025-01-09T08:14:25.873740+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56334	89.33.192.138	6581	TCP
2025-01-09T08:14:27.308653+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56336	89.33.192.138	6581	TCP
2025-01-09T08:14:28.763616+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56338	89.33.192.138	6581	TCP
2025-01-09T08:14:30.218256+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56340	89.33.192.138	6581	TCP
2025-01-09T08:14:31.673656+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56342	89.33.192.138	6581	TCP
2025-01-09T08:14:33.202204+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56344	89.33.192.138	6581	TCP
2025-01-09T08:14:34.653247+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56346	89.33.192.138	6581	TCP
2025-01-09T08:14:36.123446+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56348	89.33.192.138	6581	TCP
2025-01-09T08:14:37.578946+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56350	89.33.192.138	6581	TCP
2025-01-09T08:14:39.031615+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56352	89.33.192.138	6581	TCP
2025-01-09T08:14:40.481697+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56354	89.33.192.138	6581	TCP
2025-01-09T08:14:41.918675+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56356	89.33.192.138	6581	TCP
2025-01-09T08:14:43.375412+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56358	89.33.192.138	6581	TCP
2025-01-09T08:14:44.847887+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56360	89.33.192.138	6581	TCP
2025-01-09T08:14:46.369992+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56362	89.33.192.138	6581	TCP
2025-01-09T08:14:47.812068+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56364	89.33.192.138	6581	TCP
2025-01-09T08:14:49.272242+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56366	89.33.192.138	6581	TCP
2025-01-09T08:14:50.735269+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56368	89.33.192.138	6581	TCP
2025-01-09T08:14:52.201516+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56370	89.33.192.138	6581	TCP
2025-01-09T08:14:53.655041+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56372	89.33.192.138	6581	TCP
2025-01-09T08:14:55.127998+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56374	89.33.192.138	6581	TCP
2025-01-09T08:14:56.594370+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56376	89.33.192.138	6581	TCP
2025-01-09T08:14:58.048545+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56378	89.33.192.138	6581	TCP
2025-01-09T08:14:59.497737+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56380	89.33.192.138	6581	TCP
2025-01-09T08:15:00.954392+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56382	89.33.192.138	6581	TCP
2025-01-09T08:15:02.412349+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56384	89.33.192.138	6581	TCP
2025-01-09T08:15:03.878305+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56386	89.33.192.138	6581	TCP
2025-01-09T08:15:05.360946+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56388	89.33.192.138	6581	TCP
2025-01-09T08:15:06.812240+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56390	89.33.192.138	6581	TCP
2025-01-09T08:15:08.282449+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56392	89.33.192.138	6581	TCP
2025-01-09T08:15:09.730063+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56394	89.33.192.138	6581	TCP
2025-01-09T08:15:11.190546+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56396	89.33.192.138	6581	TCP
2025-01-09T08:15:12.654793+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56398	89.33.192.138	6581	TCP
2025-01-09T08:15:14.091515+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56400	89.33.192.138	6581	TCP
2025-01-09T08:15:15.547954+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56402	89.33.192.138	6581	TCP
2025-01-09T08:15:17.016417+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56404	89.33.192.138	6581	TCP
2025-01-09T08:15:18.476834+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56406	89.33.192.138	6581	TCP
2025-01-09T08:15:19.932960+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56408	89.33.192.138	6581	TCP
2025-01-09T08:15:21.390150+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56410	89.33.192.138	6581	TCP
2025-01-09T08:15:22.860471+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56412	89.33.192.138	6581	TCP
2025-01-09T08:15:24.310189+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56414	89.33.192.138	6581	TCP
2025-01-09T08:15:25.782490+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56416	89.33.192.138	6581	TCP
2025-01-09T08:15:27.236340+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56418	89.33.192.138	6581	TCP
2025-01-09T08:15:28.684346+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56420	89.33.192.138	6581	TCP
2025-01-09T08:15:30.123470+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56422	89.33.192.138	6581	TCP
2025-01-09T08:15:31.559752+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56424	89.33.192.138	6581	TCP
2025-01-09T08:15:32.997613+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56426	89.33.192.138	6581	TCP
2025-01-09T08:15:34.452520+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56428	89.33.192.138	6581	TCP
2025-01-09T08:15:36.224269+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56430	89.33.192.138	6581	TCP
2025-01-09T08:15:37.688906+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56432	89.33.192.138	6581	TCP
2025-01-09T08:15:39.138567+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56434	89.33.192.138	6581	TCP
2025-01-09T08:15:40.595382+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56436	89.33.192.138	6581	TCP
2025-01-09T08:15:42.065703+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56438	89.33.192.138	6581	TCP
2025-01-09T08:15:43.515417+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56440	89.33.192.138	6581	TCP
2025-01-09T08:15:44.966491+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56442	89.33.192.138	6581	TCP
2025-01-09T08:15:46.434824+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56444	89.33.192.138	6581	TCP
2025-01-09T08:15:47.889694+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56446	89.33.192.138	6581	TCP
2025-01-09T08:15:49.344426+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56448	89.33.192.138	6581	TCP
2025-01-09T08:15:50.797029+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56450	89.33.192.138	6581	TCP
2025-01-09T08:15:52.232731+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56452	89.33.192.138	6581	TCP
2025-01-09T08:15:53.685381+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56454	89.33.192.138	6581	TCP
2025-01-09T08:15:55.139133+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56456	89.33.192.138	6581	TCP
2025-01-09T08:15:56.597987+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56458	89.33.192.138	6581	TCP
2025-01-09T08:15:58.046142+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56460	89.33.192.138	6581	TCP
2025-01-09T08:15:59.482154+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56462	89.33.192.138	6581	TCP
2025-01-09T08:16:00.938826+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56464	89.33.192.138	6581	TCP
2025-01-09T08:16:02.389656+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56466	89.33.192.138	6581	TCP
2025-01-09T08:16:03.825961+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56468	89.33.192.138	6581	TCP
2025-01-09T08:16:05.273711+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56470	89.33.192.138	6581	TCP
2025-01-09T08:16:06.717441+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56472	89.33.192.138	6581	TCP
2025-01-09T08:16:08.155133+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56474	89.33.192.138	6581	TCP
2025-01-09T08:16:09.611834+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56476	89.33.192.138	6581	TCP
2025-01-09T08:16:11.081011+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56478	89.33.192.138	6581	TCP
2025-01-09T08:16:12.551197+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56480	89.33.192.138	6581	TCP
2025-01-09T08:16:14.000404+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56482	89.33.192.138	6581	TCP
2025-01-09T08:16:15.452269+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56484	89.33.192.138	6581	TCP
2025-01-09T08:16:16.906917+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56486	89.33.192.138	6581	TCP
2025-01-09T08:16:18.379334+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56488	89.33.192.138	6581	TCP
2025-01-09T08:16:19.826831+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56490	89.33.192.138	6581	TCP
2025-01-09T08:16:21.275734+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56492	89.33.192.138	6581	TCP
2025-01-09T08:16:22.737608+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56494	89.33.192.138	6581	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 9, 2025 08:12:49.678122997 CET	56202	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:12:49.683056116 CET	6581	56202	89.33.192.138	192.168.2.14
Jan 9, 2025 08:12:49.683106899 CET	56202	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:12:49.683177948 CET	56202	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:12:49.688592911 CET	6581	56202	89.33.192.138	192.168.2.14
Jan 9, 2025 08:12:51.166644096 CET	6581	56202	89.33.192.138	192.168.2.14
Jan 9, 2025 08:12:51.166877031 CET	56202	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:12:51.167520046 CET	56204	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:12:51.171685934 CET	6581	56202	89.33.192.138	192.168.2.14
Jan 9, 2025 08:12:51.172348976 CET	6581	56204	89.33.192.138	192.168.2.14
Jan 9, 2025 08:12:51.172430038 CET	56204	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:12:51.172452927 CET	56204	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:12:51.177184105 CET	6581	56204	89.33.192.138	192.168.2.14
Jan 9, 2025 08:12:52.618000031 CET	6581	56204	89.33.192.138	192.168.2.14
Jan 9, 2025 08:12:52.618171930 CET	56204	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:12:52.618798018 CET	56206	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:12:52.622957945 CET	6581	56204	89.33.192.138	192.168.2.14
Jan 9, 2025 08:12:52.623575926 CET	6581	56206	89.33.192.138	192.168.2.14
Jan 9, 2025 08:12:52.623661041 CET	56206	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:12:52.623661041 CET	56206	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:12:52.628406048 CET	6581	56206	89.33.192.138	192.168.2.14
Jan 9, 2025 08:12:54.071568012 CET	6581	56206	89.33.192.138	192.168.2.14
Jan 9, 2025 08:12:54.071779966 CET	56206	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:12:54.072269917 CET	56208	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:12:54.076576948 CET	6581	56206	89.33.192.138	192.168.2.14
Jan 9, 2025 08:12:54.077071905 CET	6581	56208	89.33.192.138	192.168.2.14
Jan 9, 2025 08:12:54.077119112 CET	56208	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:12:54.077143908 CET	56208	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:12:54.081931114 CET	6581	56208	89.33.192.138	192.168.2.14
Jan 9, 2025 08:12:55.540126085 CET	6581	56208	89.33.192.138	192.168.2.14
Jan 9, 2025 08:12:55.540293932 CET	56208	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:12:55.540803909 CET	56210	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:12:55.545108080 CET	6581	56208	89.33.192.138	192.168.2.14
Jan 9, 2025 08:12:55.545648098 CET	6581	56210	89.33.192.138	192.168.2.14
Jan 9, 2025 08:12:55.545728922 CET	56210	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:12:55.545754910 CET	56210	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:12:55.550494909 CET	6581	56210	89.33.192.138	192.168.2.14
Jan 9, 2025 08:12:56.992758036 CET	6581	56210	89.33.192.138	192.168.2.14
Jan 9, 2025 08:12:56.992952108 CET	56210	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:12:56.993515968 CET	56212	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:12:56.997869968 CET	6581	56210	89.33.192.138	192.168.2.14
Jan 9, 2025 08:12:56.998393059 CET	6581	56212	89.33.192.138	192.168.2.14
Jan 9, 2025 08:12:56.998445034 CET	56212	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:12:56.998475075 CET	56212	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:12:57.003266096 CET	6581	56212	89.33.192.138	192.168.2.14
Jan 9, 2025 08:12:58.446544886 CET	6581	56212	89.33.192.138	192.168.2.14
Jan 9, 2025 08:12:58.446713924 CET	56212	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:12:58.447316885 CET	56214	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:12:58.451500893 CET	6581	56212	89.33.192.138	192.168.2.14
Jan 9, 2025 08:12:58.452141047 CET	6581	56214	89.33.192.138	192.168.2.14
Jan 9, 2025 08:12:58.452219009 CET	56214	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:12:58.452238083 CET	56214	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:12:58.457041025 CET	6581	56214	89.33.192.138	192.168.2.14
Jan 9, 2025 08:12:59.911942959 CET	6581	56214	89.33.192.138	192.168.2.14
Jan 9, 2025 08:12:59.912132978 CET	56214	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:12:59.912524939 CET	56216	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:12:59.916943073 CET	6581	56214	89.33.192.138	192.168.2.14
Jan 9, 2025 08:12:59.917375088 CET	6581	56216	89.33.192.138	192.168.2.14
Jan 9, 2025 08:12:59.917419910 CET	56216	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:12:59.917444944 CET	56216	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:12:59.922204971 CET	6581	56216	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:01.380729914 CET	6581	56216	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:01.380872011 CET	56216	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:01.381395102 CET	56218	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:01.385685921 CET	6581	56216	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:01.386260033 CET	6581	56218	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:01.386343002 CET	56218	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:01.386365891 CET	56218	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:01.391150951 CET	6581	56218	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:02.142129898 CET	46540	443	192.168.2.14	185.125.190.26
Jan 9, 2025 08:13:02.817621946 CET	6581	56218	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:02.817840099 CET	56218	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:02.818659067 CET	56220	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:02.822705984 CET	6581	56218	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:02.823491096 CET	6581	56220	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:02.823559046 CET	56220	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:02.823628902 CET	56220	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:02.828389883 CET	6581	56220	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:04.275789022 CET	6581	56220	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:04.275954962 CET	56220	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:04.276746035 CET	56222	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:04.280844927 CET	6581	56220	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:04.281805992 CET	6581	56222	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:04.282002926 CET	56222	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:04.282028913 CET	56222	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:04.286864042 CET	6581	56222	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:05.740981102 CET	6581	56222	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:05.741204023 CET	56222	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:05.741964102 CET	56224	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:05.746064901 CET	6581	56222	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:05.746754885 CET	6581	56224	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:05.746817112 CET	56224	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:05.746838093 CET	56224	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:05.751629114 CET	6581	56224	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:07.194344997 CET	6581	56224	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:07.194509983 CET	56224	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:07.195039034 CET	56226	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:07.199366093 CET	6581	56224	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:07.199857950 CET	6581	56226	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:07.199913979 CET	56226	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:07.199934959 CET	56226	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:07.204771042 CET	6581	56226	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:08.663108110 CET	6581	56226	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:08.663443089 CET	56226	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:08.664067984 CET	56228	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:08.668214083 CET	6581	56226	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:08.668895960 CET	6581	56228	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:08.668993950 CET	56228	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:08.669038057 CET	56228	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:08.673826933 CET	6581	56228	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:10.115057945 CET	6581	56228	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:10.115425110 CET	56228	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:10.116211891 CET	56230	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:10.120248079 CET	6581	56228	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:10.121082067 CET	6581	56230	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:10.121155977 CET	56230	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:10.121217966 CET	56230	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:10.126003027 CET	6581	56230	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:11.568305969 CET	6581	56230	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:11.568558931 CET	56230	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:11.569330931 CET	56232	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:11.573473930 CET	6581	56230	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:11.574116945 CET	6581	56232	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:11.574201107 CET	56232	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:11.574229002 CET	56232	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:11.579018116 CET	6581	56232	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:13.003993988 CET	6581	56232	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:13.004165888 CET	56232	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:13.004672050 CET	56234	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:13.009000063 CET	6581	56232	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:13.009453058 CET	6581	56234	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:13.009499073 CET	56234	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:13.009541035 CET	56234	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:13.014281988 CET	6581	56234	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:14.463056087 CET	6581	56234	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:14.463352919 CET	56234	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:14.464262962 CET	56236	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:14.468199015 CET	6581	56234	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:14.469085932 CET	6581	56236	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:14.469223022 CET	56236	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:14.469223022 CET	56236	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:14.474056005 CET	6581	56236	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:15.914680004 CET	6581	56236	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:15.914870977 CET	56236	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:15.915442944 CET	56238	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:15.919770002 CET	6581	56236	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:15.920325041 CET	6581	56238	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:15.920408964 CET	56238	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:15.920464039 CET	56238	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:15.925314903 CET	6581	56238	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:17.366430044 CET	6581	56238	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:17.366628885 CET	56238	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:17.367197990 CET	56240	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:17.371582031 CET	6581	56238	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:17.372003078 CET	6581	56240	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:17.372056007 CET	56240	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:17.372087955 CET	56240	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:17.376827002 CET	6581	56240	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:18.821109056 CET	6581	56240	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:18.821577072 CET	56240	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:18.822261095 CET	56242	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:18.826426983 CET	6581	56240	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:18.827092886 CET	6581	56242	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:18.827182055 CET	56242	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:18.827259064 CET	56242	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:18.832046032 CET	6581	56242	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:20.286530018 CET	6581	56242	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:20.286729097 CET	56242	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:20.287301064 CET	56244	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:20.291562080 CET	6581	56242	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:20.292141914 CET	6581	56244	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:20.292217970 CET	56244	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:20.292251110 CET	56244	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:20.297004938 CET	6581	56244	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:21.724162102 CET	6581	56244	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:21.724529028 CET	56244	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:21.725271940 CET	56246	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:21.729367971 CET	6581	56244	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:21.730098009 CET	6581	56246	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:21.730196953 CET	56246	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:21.730225086 CET	56246	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:21.734976053 CET	6581	56246	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:23.181070089 CET	6581	56246	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:23.181380033 CET	56246	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:23.181931019 CET	56248	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:23.186208010 CET	6581	56246	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:23.186810970 CET	6581	56248	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:23.186871052 CET	56248	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:23.186897993 CET	56248	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:23.191746950 CET	6581	56248	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:24.634052038 CET	6581	56248	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:24.634308100 CET	56248	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:24.635107040 CET	56250	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:24.639189005 CET	6581	56248	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:24.639921904 CET	6581	56250	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:24.640048027 CET	56250	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:24.640089989 CET	56250	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:24.644875050 CET	6581	56250	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:26.282488108 CET	6581	56250	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:26.282746077 CET	56250	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:26.283571005 CET	56252	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:26.287533045 CET	6581	56250	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:26.288395882 CET	6581	56252	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:26.288476944 CET	56252	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:26.288548946 CET	56252	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:26.293329954 CET	6581	56252	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:27.745335102 CET	6581	56252	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:27.745620966 CET	56252	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:27.746114016 CET	56254	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:27.764764071 CET	6581	56252	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:27.764776945 CET	6581	56254	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:27.765034914 CET	56254	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:27.765053034 CET	56254	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:27.769936085 CET	6581	56254	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:29.208580017 CET	6581	56254	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:29.208774090 CET	56254	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:29.209304094 CET	56256	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:29.214200020 CET	6581	56254	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:29.214787006 CET	6581	56256	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:29.214854002 CET	56256	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:29.214854002 CET	56256	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:29.220300913 CET	6581	56256	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:30.665354967 CET	6581	56256	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:30.665644884 CET	56256	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:30.666340113 CET	56258	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:30.670511007 CET	6581	56256	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:30.671161890 CET	6581	56258	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:30.671241045 CET	56258	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:30.671293974 CET	56258	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:30.676028967 CET	6581	56258	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:32.134479046 CET	6581	56258	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:32.134639025 CET	56258	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:32.135143042 CET	56260	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:32.139497995 CET	6581	56258	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:32.139944077 CET	6581	56260	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:32.140073061 CET	56260	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:32.140084982 CET	56260	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:32.144937992 CET	6581	56260	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:32.860770941 CET	46540	443	192.168.2.14	185.125.190.26
Jan 9, 2025 08:13:33.583507061 CET	6581	56260	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:33.583689928 CET	56260	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:33.584247112 CET	56262	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:33.588540077 CET	6581	56260	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:33.589108944 CET	6581	56262	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:33.589163065 CET	56262	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:33.589185953 CET	56262	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:33.593934059 CET	6581	56262	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:35.036545038 CET	6581	56262	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:35.036794901 CET	56262	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:35.037332058 CET	56264	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:35.041625023 CET	6581	56262	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:35.042176962 CET	6581	56264	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:35.042304039 CET	56264	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:35.042326927 CET	56264	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:35.047152042 CET	6581	56264	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:36.474018097 CET	6581	56264	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:36.474203110 CET	56264	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:36.474798918 CET	56266	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:36.479064941 CET	6581	56264	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:36.479727983 CET	6581	56266	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:36.479788065 CET	56266	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:36.479805946 CET	56266	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:36.484622955 CET	6581	56266	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:37.912113905 CET	6581	56266	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:37.912286043 CET	56266	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:37.912792921 CET	56268	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:37.917112112 CET	6581	56266	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:37.917623997 CET	6581	56268	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:37.917751074 CET	56268	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:37.917766094 CET	56268	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:37.922595024 CET	6581	56268	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:39.368829012 CET	6581	56268	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:39.369119883 CET	56268	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:39.369687080 CET	56270	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:39.373908997 CET	6581	56268	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:39.374443054 CET	6581	56270	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:39.374495029 CET	56270	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:39.374521017 CET	56270	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:39.379384995 CET	6581	56270	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:40.821903944 CET	6581	56270	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:40.822058916 CET	56270	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:40.822577953 CET	56272	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:40.826951027 CET	6581	56270	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:40.827372074 CET	6581	56272	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:40.827428102 CET	56272	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:40.827451944 CET	56272	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:40.832212925 CET	6581	56272	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:42.274334908 CET	6581	56272	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:42.274501085 CET	56272	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:42.275247097 CET	56274	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:42.279349089 CET	6581	56272	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:42.280045033 CET	6581	56274	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:42.280127048 CET	56274	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:42.280163050 CET	56274	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:42.284953117 CET	6581	56274	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:43.746015072 CET	6581	56274	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:43.746211052 CET	56274	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:43.746917963 CET	56276	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:43.751003981 CET	6581	56274	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:43.751705885 CET	6581	56276	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:43.751782894 CET	56276	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:43.751854897 CET	56276	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:43.756629944 CET	6581	56276	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:45.194828987 CET	6581	56276	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:45.194977045 CET	56276	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:45.195568085 CET	56278	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:45.199800014 CET	6581	56276	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:45.200443029 CET	6581	56278	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:45.200515985 CET	56278	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:45.200536966 CET	56278	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:45.205300093 CET	6581	56278	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:46.630727053 CET	6581	56278	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:46.630959034 CET	56278	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:46.631536961 CET	56280	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:46.635782003 CET	6581	56278	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:46.636275053 CET	6581	56280	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:46.636326075 CET	56280	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:46.636360884 CET	56280	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:46.641098976 CET	6581	56280	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:48.068351030 CET	6581	56280	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:48.068614006 CET	56280	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:48.069454908 CET	56282	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:48.073513985 CET	6581	56280	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:48.074311018 CET	6581	56282	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:48.074395895 CET	56282	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:48.074462891 CET	56282	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:48.079304934 CET	6581	56282	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:49.521342993 CET	6581	56282	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:49.521522999 CET	56282	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:49.522142887 CET	56284	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:49.526392937 CET	6581	56282	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:49.527004004 CET	6581	56284	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:49.527061939 CET	56284	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:49.527098894 CET	56284	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:49.531929970 CET	6581	56284	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:50.976303101 CET	6581	56284	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:50.976459980 CET	56284	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:50.976977110 CET	56286	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:50.981416941 CET	6581	56284	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:50.981940985 CET	6581	56286	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:50.982049942 CET	56286	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:50.982075930 CET	56286	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:50.987364054 CET	6581	56286	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:52.448369980 CET	6581	56286	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:52.448548079 CET	56286	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:52.449063063 CET	56288	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:52.453834057 CET	6581	56286	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:52.454148054 CET	6581	56288	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:52.454258919 CET	56288	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:52.454258919 CET	56288	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:52.459486008 CET	6581	56288	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:53.912693024 CET	6581	56288	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:53.912864923 CET	56288	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:53.913368940 CET	56290	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:53.917706013 CET	6581	56288	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:53.918159008 CET	6581	56290	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:53.918215036 CET	56290	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:53.918240070 CET	56290	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:53.923085928 CET	6581	56290	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:55.367371082 CET	6581	56290	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:55.367542028 CET	56290	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:55.368168116 CET	56292	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:55.372411013 CET	6581	56290	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:55.372976065 CET	6581	56292	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:55.373068094 CET	56292	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:55.373083115 CET	56292	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:55.377829075 CET	6581	56292	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:56.819952011 CET	6581	56292	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:56.820214987 CET	56292	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:56.820769072 CET	56294	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:56.825110912 CET	6581	56292	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:56.825859070 CET	6581	56294	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:56.825915098 CET	56294	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:56.825947046 CET	56294	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:56.830760956 CET	6581	56294	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:58.262656927 CET	6581	56294	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:58.262806892 CET	56294	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:58.263411045 CET	56296	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:58.267638922 CET	6581	56294	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:58.268179893 CET	6581	56296	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:58.268277884 CET	56296	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:58.268346071 CET	56296	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:58.273108959 CET	6581	56296	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:59.728281021 CET	6581	56296	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:59.728425026 CET	56296	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:59.729013920 CET	56298	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:59.733305931 CET	6581	56296	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:59.733773947 CET	6581	56298	89.33.192.138	192.168.2.14
Jan 9, 2025 08:13:59.733846903 CET	56298	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:59.733899117 CET	56298	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:13:59.738717079 CET	6581	56298	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:01.161237001 CET	6581	56298	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:01.161458015 CET	56298	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:01.162174940 CET	56300	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:01.166255951 CET	6581	56298	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:01.166963100 CET	6581	56300	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:01.167049885 CET	56300	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:01.167109013 CET	56300	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:01.171894073 CET	6581	56300	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:02.619446993 CET	6581	56300	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:02.619632959 CET	56300	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:02.620206118 CET	56302	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:02.624506950 CET	6581	56300	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:02.625027895 CET	6581	56302	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:02.625086069 CET	56302	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:02.625113010 CET	56302	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:02.629961967 CET	6581	56302	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:04.069127083 CET	6581	56302	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:04.069294930 CET	56302	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:04.069870949 CET	56304	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:04.074188948 CET	6581	56302	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:04.074697018 CET	6581	56304	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:04.074784994 CET	56304	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:04.074784994 CET	56304	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:04.079605103 CET	6581	56304	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:05.523140907 CET	6581	56304	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:05.523328066 CET	56304	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:05.523855925 CET	56306	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:05.529630899 CET	6581	56304	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:05.529643059 CET	6581	56306	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:05.529735088 CET	56306	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:05.529767036 CET	56306	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:05.534506083 CET	6581	56306	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:06.978547096 CET	6581	56306	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:06.978760004 CET	56306	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:06.979602098 CET	56308	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:06.983555079 CET	6581	56306	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:06.984400988 CET	6581	56308	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:06.984488964 CET	56308	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:06.984548092 CET	56308	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:06.989401102 CET	6581	56308	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:08.432502031 CET	6581	56308	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:08.432662010 CET	56308	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:08.433196068 CET	56310	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:08.438899994 CET	6581	56308	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:08.439498901 CET	6581	56310	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:08.439599037 CET	56310	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:08.439625978 CET	56310	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:08.445811987 CET	6581	56310	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:09.881652117 CET	6581	56310	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:09.881902933 CET	56310	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:09.882541895 CET	56312	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:09.886688948 CET	6581	56310	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:09.887373924 CET	6581	56312	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:09.887501955 CET	56312	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:09.887552977 CET	56312	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:09.892342091 CET	6581	56312	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:11.353490114 CET	6581	56312	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:11.353816986 CET	56312	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:11.354594946 CET	56314	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:11.358668089 CET	6581	56312	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:11.359414101 CET	6581	56314	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:11.359524012 CET	56314	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:11.359560013 CET	56314	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:11.364326000 CET	6581	56314	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:12.803946018 CET	6581	56314	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:12.804183006 CET	56314	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:12.804764986 CET	56316	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:12.811162949 CET	6581	56314	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:12.811671019 CET	6581	56316	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:12.811743975 CET	56316	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:12.811762094 CET	56316	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:12.818490982 CET	6581	56316	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:14.264467955 CET	6581	56316	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:14.264626026 CET	56316	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:14.265073061 CET	56318	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:14.269445896 CET	6581	56316	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:14.269861937 CET	6581	56318	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:14.269996881 CET	56318	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:14.270030022 CET	56318	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:14.274770975 CET	6581	56318	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:15.711004972 CET	6581	56318	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:15.711353064 CET	56318	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:15.711895943 CET	56320	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:15.716234922 CET	6581	56318	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:15.716726065 CET	6581	56320	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:15.716795921 CET	56320	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:15.716831923 CET	56320	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:15.721645117 CET	6581	56320	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:17.146720886 CET	6581	56320	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:17.146883011 CET	56320	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:17.146923065 CET	56320	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:17.147392988 CET	56322	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:17.151747942 CET	6581	56320	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:17.152333021 CET	6581	56322	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:17.152476072 CET	56322	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:17.152507067 CET	56322	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:17.157232046 CET	6581	56322	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:18.619556904 CET	6581	56322	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:18.620053053 CET	56322	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:18.620820045 CET	56324	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:18.624872923 CET	6581	56322	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:18.625623941 CET	6581	56324	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:18.625698090 CET	56324	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:18.625761986 CET	56324	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:18.630584002 CET	6581	56324	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:20.069071054 CET	6581	56324	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:20.069250107 CET	56324	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:20.069853067 CET	56326	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:20.074115038 CET	6581	56324	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:20.074686050 CET	6581	56326	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:20.074853897 CET	56326	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:20.074866056 CET	56326	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:20.079664946 CET	6581	56326	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:21.522037983 CET	6581	56326	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:21.522304058 CET	56326	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:21.523045063 CET	56328	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:21.527085066 CET	6581	56326	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:21.527940989 CET	6581	56328	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:21.528003931 CET	56328	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:21.528062105 CET	56328	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:21.532839060 CET	6581	56328	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:22.959148884 CET	6581	56328	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:22.959393024 CET	56328	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:22.960186958 CET	56330	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:22.964205027 CET	6581	56328	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:22.965004921 CET	6581	56330	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:22.965154886 CET	56330	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:22.965203047 CET	56330	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:22.969990015 CET	6581	56330	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:24.416095972 CET	6581	56330	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:24.416466951 CET	56330	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:24.417309046 CET	56332	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:24.421304941 CET	6581	56330	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:24.422116041 CET	6581	56332	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:24.422199965 CET	56332	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:24.422265053 CET	56332	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:24.427026987 CET	6581	56332	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:25.867872953 CET	6581	56332	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:25.868067026 CET	56332	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:25.868630886 CET	56334	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:25.872859001 CET	6581	56332	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:25.873436928 CET	6581	56334	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:25.873727083 CET	56334	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:25.873739958 CET	56334	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:25.878508091 CET	6581	56334	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:27.302956104 CET	6581	56334	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:27.303124905 CET	56334	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:27.303683996 CET	56336	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:27.307959080 CET	6581	56334	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:27.308563948 CET	6581	56336	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:27.308628082 CET	56336	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:27.308653116 CET	56336	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:27.313448906 CET	6581	56336	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:28.757841110 CET	6581	56336	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:28.758188963 CET	56336	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:28.758754969 CET	56338	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:28.763016939 CET	6581	56336	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:28.763504982 CET	6581	56338	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:28.763565063 CET	56338	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:28.763616085 CET	56338	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:28.768395901 CET	6581	56338	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:30.212522030 CET	6581	56338	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:30.212677002 CET	56338	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:30.213233948 CET	56340	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:30.217442036 CET	6581	56338	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:30.218089104 CET	6581	56340	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:30.218209982 CET	56340	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:30.218255997 CET	56340	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:30.223056078 CET	6581	56340	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:31.667953968 CET	6581	56340	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:31.668226004 CET	56340	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:31.668812037 CET	56342	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:31.672990084 CET	6581	56340	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:31.673561096 CET	6581	56342	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:31.673620939 CET	56342	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:31.673655987 CET	56342	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:31.678453922 CET	6581	56342	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:33.192971945 CET	6581	56342	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:33.193129063 CET	56342	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:33.193627119 CET	56344	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:33.201937914 CET	6581	56342	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:33.201976061 CET	6581	56344	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:33.202161074 CET	56344	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:33.202203989 CET	56344	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:33.207113981 CET	6581	56344	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:34.647747993 CET	6581	56344	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:34.647887945 CET	56344	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:34.648370981 CET	56346	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:34.652714968 CET	6581	56344	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:34.653167009 CET	6581	56346	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:34.653222084 CET	56346	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:34.653247118 CET	56346	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:34.658030987 CET	6581	56346	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:36.117827892 CET	6581	56346	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:36.117958069 CET	56346	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:36.118416071 CET	56348	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:36.122756004 CET	6581	56346	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:36.123234987 CET	6581	56348	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:36.123430967 CET	56348	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:36.123445988 CET	56348	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:36.128231049 CET	6581	56348	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:37.573014021 CET	6581	56348	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:37.573352098 CET	56348	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:37.573971987 CET	56350	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:37.578193903 CET	6581	56348	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:37.578823090 CET	6581	56350	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:37.578896046 CET	56350	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:37.578946114 CET	56350	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:37.583725929 CET	6581	56350	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:39.025957108 CET	6581	56350	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:39.026143074 CET	56350	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:39.026689053 CET	56352	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:39.030977011 CET	6581	56350	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:39.031543016 CET	6581	56352	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:39.031598091 CET	56352	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:39.031615019 CET	56352	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:39.036468983 CET	6581	56352	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:40.476114035 CET	6581	56352	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:40.476254940 CET	56352	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:40.476793051 CET	56354	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:40.481085062 CET	6581	56352	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:40.481587887 CET	6581	56354	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:40.481672049 CET	56354	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:40.481697083 CET	56354	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:40.486426115 CET	6581	56354	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:41.912981033 CET	6581	56354	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:41.913172960 CET	56354	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:41.913707972 CET	56356	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:41.917998075 CET	6581	56354	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:41.918587923 CET	6581	56356	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:41.918642998 CET	56356	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:41.918674946 CET	56356	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:41.923485041 CET	6581	56356	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:43.369788885 CET	6581	56356	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:43.369949102 CET	56356	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:43.370482922 CET	56358	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:43.374742985 CET	6581	56356	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:43.375276089 CET	6581	56358	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:43.375386953 CET	56358	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:43.375411987 CET	56358	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:43.380172014 CET	6581	56358	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:44.841401100 CET	6581	56358	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:44.841608047 CET	56358	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:44.842170954 CET	56360	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:44.847387075 CET	6581	56358	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:44.847809076 CET	6581	56360	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:44.847861052 CET	56360	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:44.847887039 CET	56360	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:44.853629112 CET	6581	56360	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:46.363183022 CET	6581	56360	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:46.363457918 CET	56360	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:46.364347935 CET	56362	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:46.368935108 CET	6581	56360	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:46.369838953 CET	6581	56362	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:46.369927883 CET	56362	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:46.369992018 CET	56362	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:46.375627041 CET	6581	56362	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:47.805785894 CET	6581	56362	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:47.806031942 CET	56362	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:47.806684017 CET	56364	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:47.811434031 CET	6581	56362	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:47.811964989 CET	6581	56364	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:47.812026978 CET	56364	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:47.812067986 CET	56364	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:47.816884995 CET	6581	56364	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:49.266596079 CET	6581	56364	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:49.266752005 CET	56364	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:49.267317057 CET	56366	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:49.271579981 CET	6581	56364	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:49.272111893 CET	6581	56366	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:49.272228003 CET	56366	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:49.272242069 CET	56366	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:49.277086973 CET	6581	56366	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:50.729479074 CET	6581	56366	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:50.729688883 CET	56366	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:50.730304956 CET	56368	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:50.734632015 CET	6581	56366	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:50.735153913 CET	6581	56368	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:50.735251904 CET	56368	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:50.735269070 CET	56368	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:50.740091085 CET	6581	56368	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:52.195231915 CET	6581	56368	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:52.195631981 CET	56368	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:52.196417093 CET	56370	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:52.200474977 CET	6581	56368	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:52.201257944 CET	6581	56370	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:52.201332092 CET	56370	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:52.201515913 CET	56370	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:52.206305027 CET	6581	56370	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:53.649393082 CET	6581	56370	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:53.649574041 CET	56370	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:53.650074005 CET	56372	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:53.654400110 CET	6581	56370	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:53.654911995 CET	6581	56372	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:53.655028105 CET	56372	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:53.655040979 CET	56372	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:53.659882069 CET	6581	56372	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:55.121923923 CET	6581	56372	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:55.122317076 CET	56372	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:55.123095989 CET	56374	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:55.127079010 CET	6581	56372	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:55.127872944 CET	6581	56374	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:55.127942085 CET	56374	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:55.127998114 CET	56374	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:55.132766962 CET	6581	56374	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:56.588380098 CET	6581	56374	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:56.588615894 CET	56374	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:56.589432001 CET	56376	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:56.593452930 CET	6581	56374	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:56.594207048 CET	6581	56376	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:56.594319105 CET	56376	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:56.594369888 CET	56376	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:56.599129915 CET	6581	56376	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:58.041789055 CET	6581	56376	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:58.042020082 CET	56376	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:58.042545080 CET	56378	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:58.047976017 CET	6581	56376	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:58.048381090 CET	6581	56378	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:58.048448086 CET	56378	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:58.048544884 CET	56378	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:58.054342985 CET	6581	56378	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:59.492058039 CET	6581	56378	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:59.492247105 CET	56378	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:59.492795944 CET	56380	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:59.497123957 CET	6581	56378	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:59.497612000 CET	6581	56380	89.33.192.138	192.168.2.14
Jan 9, 2025 08:14:59.497706890 CET	56380	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:59.497736931 CET	56380	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:14:59.502576113 CET	6581	56380	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:00.948343992 CET	6581	56380	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:00.948678017 CET	56380	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:00.949430943 CET	56382	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:00.953536987 CET	6581	56380	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:00.954240084 CET	6581	56382	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:00.954334021 CET	56382	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:00.954391956 CET	56382	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:00.959157944 CET	6581	56382	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:02.406003952 CET	6581	56382	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:02.406281948 CET	56382	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:02.407299042 CET	56384	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:02.411125898 CET	6581	56382	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:02.412220001 CET	6581	56384	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:02.412286997 CET	56384	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:02.412348986 CET	56384	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:02.417138100 CET	6581	56384	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:03.872153044 CET	6581	56384	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:03.872519016 CET	56384	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:03.873336077 CET	56386	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:03.877350092 CET	6581	56384	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:03.878160954 CET	6581	56386	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:03.878281116 CET	56386	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:03.878304958 CET	56386	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:03.883143902 CET	6581	56386	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:05.354852915 CET	6581	56386	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:05.355259895 CET	56386	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:05.355989933 CET	56388	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:05.360073090 CET	6581	56386	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:05.360810995 CET	6581	56388	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:05.360888004 CET	56388	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:05.360945940 CET	56388	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:05.365724087 CET	6581	56388	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:06.805919886 CET	6581	56388	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:06.806162119 CET	56388	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:06.807260036 CET	56390	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:06.811000109 CET	6581	56388	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:06.812057018 CET	6581	56390	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:06.812182903 CET	56390	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:06.812239885 CET	56390	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:06.816982985 CET	6581	56390	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:08.276482105 CET	6581	56390	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:08.276771069 CET	56390	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:08.277395964 CET	56392	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:08.282349110 CET	6581	56390	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:08.282365084 CET	6581	56392	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:08.282423973 CET	56392	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:08.282449007 CET	56392	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:08.289935112 CET	6581	56392	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:09.724482059 CET	6581	56392	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:09.724626064 CET	56392	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:09.725152016 CET	56394	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:09.729475021 CET	6581	56392	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:09.729928017 CET	6581	56394	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:09.730048895 CET	56394	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:09.730062962 CET	56394	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:09.734874964 CET	6581	56394	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:11.184614897 CET	6581	56394	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:11.184865952 CET	56394	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:11.185592890 CET	56396	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:11.189755917 CET	6581	56394	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:11.190433025 CET	6581	56396	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:11.190486908 CET	56396	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:11.190546036 CET	56396	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:11.196317911 CET	6581	56396	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:12.648610115 CET	6581	56396	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:12.649138927 CET	56396	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:12.649779081 CET	56398	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:12.653991938 CET	6581	56396	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:12.654639006 CET	6581	56398	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:12.654720068 CET	56398	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:12.654793024 CET	56398	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:12.659600019 CET	6581	56398	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:14.085360050 CET	6581	56398	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:14.085764885 CET	56398	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:14.086466074 CET	56400	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:14.090614080 CET	6581	56398	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:14.091367006 CET	6581	56400	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:14.091439962 CET	56400	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:14.091515064 CET	56400	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:14.096266031 CET	6581	56400	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:15.542156935 CET	6581	56400	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:15.542536974 CET	56400	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:15.543081999 CET	56402	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:15.547372103 CET	6581	56400	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:15.547842026 CET	6581	56402	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:15.547919989 CET	56402	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:15.547954082 CET	56402	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:15.552741051 CET	6581	56402	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:17.010200977 CET	6581	56402	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:17.010595083 CET	56402	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:17.011333942 CET	56404	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:17.015441895 CET	6581	56402	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:17.016243935 CET	6581	56404	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:17.016335011 CET	56404	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:17.016417027 CET	56404	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:17.021202087 CET	6581	56404	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:18.470855951 CET	6581	56404	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:18.471225023 CET	56404	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:18.471939087 CET	56406	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:18.476130009 CET	6581	56404	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:18.476703882 CET	6581	56406	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:18.476766109 CET	56406	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:18.476834059 CET	56406	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:18.481663942 CET	6581	56406	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:19.927294016 CET	6581	56406	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:19.927443981 CET	56406	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:19.928014994 CET	56408	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:19.932252884 CET	6581	56406	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:19.932795048 CET	6581	56408	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:19.932883024 CET	56408	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:19.932960033 CET	56408	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:19.937720060 CET	6581	56408	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:21.384228945 CET	6581	56408	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:21.384411097 CET	56408	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:21.385144949 CET	56410	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:21.389642000 CET	6581	56408	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:21.389995098 CET	6581	56410	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:21.390077114 CET	56410	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:21.390150070 CET	56410	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:21.394954920 CET	6581	56410	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:22.854717970 CET	6581	56410	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:22.854912996 CET	56410	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:22.855545998 CET	56412	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:22.859683037 CET	6581	56410	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:22.860305071 CET	6581	56412	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:22.860388041 CET	56412	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:22.860471010 CET	56412	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:22.865232944 CET	6581	56412	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:24.304256916 CET	6581	56412	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:24.304387093 CET	56412	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:24.305233002 CET	56414	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:24.309215069 CET	6581	56412	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:24.310020924 CET	6581	56414	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:24.310129881 CET	56414	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:24.310189009 CET	56414	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:24.314987898 CET	6581	56414	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:25.776710987 CET	6581	56414	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:25.776958942 CET	56414	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:25.777549982 CET	56416	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:25.781748056 CET	6581	56414	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:25.782381058 CET	6581	56416	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:25.782457113 CET	56416	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:25.782490015 CET	56416	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:25.787275076 CET	6581	56416	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:27.230288982 CET	6581	56416	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:27.230526924 CET	56416	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:27.231331110 CET	56418	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:27.235362053 CET	6581	56416	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:27.236179113 CET	6581	56418	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:27.236264944 CET	56418	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:27.236340046 CET	56418	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:27.241122961 CET	6581	56418	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:28.678622961 CET	6581	56418	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:28.678806067 CET	56418	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:28.679357052 CET	56420	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:28.683631897 CET	6581	56418	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:28.684205055 CET	6581	56420	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:28.684271097 CET	56420	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:28.684345961 CET	56420	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:28.689070940 CET	6581	56420	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:30.117701054 CET	6581	56420	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:30.117866039 CET	56420	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:30.118529081 CET	56422	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:30.122647047 CET	6581	56420	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:30.123366117 CET	6581	56422	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:30.123429060 CET	56422	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:30.123470068 CET	56422	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:30.128278971 CET	6581	56422	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:31.554178953 CET	6581	56422	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:31.554317951 CET	56422	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:31.554867029 CET	56424	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:31.559181929 CET	6581	56422	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:31.559648991 CET	6581	56424	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:31.559727907 CET	56424	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:31.559751987 CET	56424	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:31.564490080 CET	6581	56424	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:32.991889000 CET	6581	56424	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:32.992091894 CET	56424	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:32.992628098 CET	56426	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:32.997087955 CET	6581	56424	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:32.997404099 CET	6581	56426	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:32.997584105 CET	56426	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:32.997612953 CET	56426	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:33.002456903 CET	6581	56426	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:34.446882963 CET	6581	56426	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:34.447041035 CET	56426	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:34.447608948 CET	56428	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:34.451860905 CET	6581	56426	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:34.452431917 CET	6581	56428	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:34.452497959 CET	56428	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:34.452519894 CET	56428	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:34.457252979 CET	6581	56428	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:36.218277931 CET	6581	56428	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:36.218368053 CET	6581	56428	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:36.218373060 CET	56428	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:36.218461990 CET	56428	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:36.219403028 CET	56430	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:36.223133087 CET	6581	56428	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:36.224190950 CET	6581	56430	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:36.224234104 CET	56430	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:36.224268913 CET	56430	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:36.229007006 CET	6581	56430	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:37.683178902 CET	6581	56430	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:37.683392048 CET	56430	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:37.684001923 CET	56432	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:37.688199997 CET	6581	56430	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:37.688824892 CET	6581	56432	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:37.688905954 CET	56432	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:37.688905954 CET	56432	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:37.693665981 CET	6581	56432	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:39.132738113 CET	6581	56432	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:39.133054018 CET	56432	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:39.133696079 CET	56434	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:39.137842894 CET	6581	56432	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:39.138458014 CET	6581	56434	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:39.138546944 CET	56434	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:39.138566971 CET	56434	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:39.143404961 CET	6581	56434	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:40.589688063 CET	6581	56434	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:40.589896917 CET	56434	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:40.590509892 CET	56436	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:40.594744921 CET	6581	56434	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:40.595282078 CET	6581	56436	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:40.595381021 CET	56436	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:40.595381975 CET	56436	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:40.600188971 CET	6581	56436	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:42.059909105 CET	6581	56436	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:42.060286045 CET	56436	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:42.060811996 CET	56438	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:42.065061092 CET	6581	56436	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:42.065604925 CET	6581	56438	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:42.065675974 CET	56438	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:42.065702915 CET	56438	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:42.070487022 CET	6581	56438	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:43.507618904 CET	6581	56438	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:43.507792950 CET	56438	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:43.508371115 CET	56440	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:43.514697075 CET	6581	56438	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:43.515328884 CET	6581	56440	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:43.515393019 CET	56440	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:43.515417099 CET	56440	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:43.522361040 CET	6581	56440	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:44.960783958 CET	6581	56440	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:44.961013079 CET	56440	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:44.961553097 CET	56442	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:44.965915918 CET	6581	56440	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:44.966399908 CET	6581	56442	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:44.966459036 CET	56442	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:44.966490984 CET	56442	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:44.971272945 CET	6581	56442	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:46.429092884 CET	6581	56442	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:46.429375887 CET	56442	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:46.429928064 CET	56444	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:46.434245110 CET	6581	56442	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:46.434732914 CET	6581	56444	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:46.434802055 CET	56444	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:46.434823990 CET	56444	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:46.439594984 CET	6581	56444	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:47.883991003 CET	6581	56444	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:47.884243011 CET	56444	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:47.884797096 CET	56446	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:47.889087915 CET	6581	56444	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:47.889616013 CET	6581	56446	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:47.889678001 CET	56446	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:47.889693975 CET	56446	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:47.894531012 CET	6581	56446	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:49.338649988 CET	6581	56446	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:49.338798046 CET	56446	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:49.339366913 CET	56448	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:49.343722105 CET	6581	56446	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:49.344326973 CET	6581	56448	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:49.344403028 CET	56448	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:49.344425917 CET	56448	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:49.349440098 CET	6581	56448	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:50.791203976 CET	6581	56448	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:50.791467905 CET	56448	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:50.792133093 CET	56450	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:50.796288967 CET	6581	56448	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:50.796926975 CET	6581	56450	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:50.797012091 CET	56450	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:50.797029018 CET	56450	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:50.801827908 CET	6581	56450	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:52.226577997 CET	6581	56450	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:52.226960897 CET	56450	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:52.227736950 CET	56452	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:52.231849909 CET	6581	56450	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:52.232589006 CET	6581	56452	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:52.232670069 CET	56452	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:52.232731104 CET	56452	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:52.237488985 CET	6581	56452	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:53.679553032 CET	6581	56452	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:53.679918051 CET	56452	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:53.680495024 CET	56454	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:53.684725046 CET	6581	56452	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:53.685267925 CET	6581	56454	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:53.685324907 CET	56454	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:53.685380936 CET	56454	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:53.690185070 CET	6581	56454	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:55.133233070 CET	6581	56454	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:55.133477926 CET	56454	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:55.134138107 CET	56456	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:55.138302088 CET	6581	56454	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:55.138900042 CET	6581	56456	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:55.138993979 CET	56456	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:55.139132977 CET	56456	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:55.143909931 CET	6581	56456	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:56.591978073 CET	6581	56456	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:56.592253923 CET	56456	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:56.593044043 CET	56458	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:56.597315073 CET	6581	56456	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:56.597867966 CET	6581	56458	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:56.597929955 CET	56458	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:56.597986937 CET	56458	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:56.602720976 CET	6581	56458	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:58.039132118 CET	6581	56458	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:58.040111065 CET	56458	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:58.040812016 CET	56460	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:58.045692921 CET	6581	56458	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:58.046014071 CET	6581	56460	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:58.046101093 CET	56460	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:58.046142101 CET	56460	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:58.051467896 CET	6581	56460	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:59.475945950 CET	6581	56460	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:59.476325035 CET	56460	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:59.477219105 CET	56462	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:59.481168032 CET	6581	56460	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:59.482006073 CET	6581	56462	89.33.192.138	192.168.2.14
Jan 9, 2025 08:15:59.482108116 CET	56462	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:59.482153893 CET	56462	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:15:59.486901999 CET	6581	56462	89.33.192.138	192.168.2.14
Jan 9, 2025 08:16:00.931565046 CET	6581	56462	89.33.192.138	192.168.2.14
Jan 9, 2025 08:16:00.931840897 CET	56462	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:16:00.932672024 CET	56464	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:16:00.938664913 CET	6581	56462	89.33.192.138	192.168.2.14
Jan 9, 2025 08:16:00.938676119 CET	6581	56464	89.33.192.138	192.168.2.14
Jan 9, 2025 08:16:00.938775063 CET	56464	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:16:00.938826084 CET	56464	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:16:00.943638086 CET	6581	56464	89.33.192.138	192.168.2.14
Jan 9, 2025 08:16:02.383361101 CET	6581	56464	89.33.192.138	192.168.2.14
Jan 9, 2025 08:16:02.383641958 CET	56464	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:16:02.384596109 CET	56466	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:16:02.388442039 CET	6581	56464	89.33.192.138	192.168.2.14
Jan 9, 2025 08:16:02.389489889 CET	6581	56466	89.33.192.138	192.168.2.14
Jan 9, 2025 08:16:02.389590025 CET	56466	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:16:02.389656067 CET	56466	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:16:02.394408941 CET	6581	56466	89.33.192.138	192.168.2.14
Jan 9, 2025 08:16:03.820194006 CET	6581	56466	89.33.192.138	192.168.2.14
Jan 9, 2025 08:16:03.820368052 CET	56466	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:16:03.820949078 CET	56468	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:16:03.825225115 CET	6581	56466	89.33.192.138	192.168.2.14
Jan 9, 2025 08:16:03.825823069 CET	6581	56468	89.33.192.138	192.168.2.14
Jan 9, 2025 08:16:03.825911045 CET	56468	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:16:03.825961113 CET	56468	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:16:03.830806971 CET	6581	56468	89.33.192.138	192.168.2.14
Jan 9, 2025 08:16:05.267591953 CET	6581	56468	89.33.192.138	192.168.2.14
Jan 9, 2025 08:16:05.267872095 CET	56468	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:16:05.268719912 CET	56470	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:16:05.272664070 CET	6581	56468	89.33.192.138	192.168.2.14
Jan 9, 2025 08:16:05.273552895 CET	6581	56470	89.33.192.138	192.168.2.14
Jan 9, 2025 08:16:05.273652077 CET	56470	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:16:05.273710966 CET	56470	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:16:05.278490067 CET	6581	56470	89.33.192.138	192.168.2.14
Jan 9, 2025 08:16:06.711344004 CET	6581	56470	89.33.192.138	192.168.2.14
Jan 9, 2025 08:16:06.711664915 CET	56470	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:16:06.712392092 CET	56472	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:16:06.716541052 CET	6581	56470	89.33.192.138	192.168.2.14
Jan 9, 2025 08:16:06.717192888 CET	6581	56472	89.33.192.138	192.168.2.14
Jan 9, 2025 08:16:06.717295885 CET	56472	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:16:06.717441082 CET	56472	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:16:06.722228050 CET	6581	56472	89.33.192.138	192.168.2.14
Jan 9, 2025 08:16:08.148953915 CET	6581	56472	89.33.192.138	192.168.2.14
Jan 9, 2025 08:16:08.149333954 CET	56472	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:16:08.150188923 CET	56474	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:16:08.154186964 CET	6581	56472	89.33.192.138	192.168.2.14
Jan 9, 2025 08:16:08.154977083 CET	6581	56474	89.33.192.138	192.168.2.14
Jan 9, 2025 08:16:08.155072927 CET	56474	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:16:08.155133009 CET	56474	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:16:08.159929991 CET	6581	56474	89.33.192.138	192.168.2.14
Jan 9, 2025 08:16:09.605739117 CET	6581	56474	89.33.192.138	192.168.2.14
Jan 9, 2025 08:16:09.606003046 CET	56474	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:16:09.606801987 CET	56476	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:16:09.610920906 CET	6581	56474	89.33.192.138	192.168.2.14
Jan 9, 2025 08:16:09.611706018 CET	6581	56476	89.33.192.138	192.168.2.14
Jan 9, 2025 08:16:09.611763954 CET	56476	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:16:09.611834049 CET	56476	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:16:09.616636992 CET	6581	56476	89.33.192.138	192.168.2.14
Jan 9, 2025 08:16:11.075166941 CET	6581	56476	89.33.192.138	192.168.2.14
Jan 9, 2025 08:16:11.075386047 CET	56476	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:16:11.076045036 CET	56478	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:16:11.080311060 CET	6581	56476	89.33.192.138	192.168.2.14
Jan 9, 2025 08:16:11.080873966 CET	6581	56478	89.33.192.138	192.168.2.14
Jan 9, 2025 08:16:11.081011057 CET	56478	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:16:11.081011057 CET	56478	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:16:11.085896969 CET	6581	56478	89.33.192.138	192.168.2.14
Jan 9, 2025 08:16:12.544958115 CET	6581	56478	89.33.192.138	192.168.2.14
Jan 9, 2025 08:16:12.545310020 CET	56478	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:16:12.546216011 CET	56480	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:16:12.550270081 CET	6581	56478	89.33.192.138	192.168.2.14
Jan 9, 2025 08:16:12.551040888 CET	6581	56480	89.33.192.138	192.168.2.14
Jan 9, 2025 08:16:12.551131964 CET	56480	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:16:12.551197052 CET	56480	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:16:12.556021929 CET	6581	56480	89.33.192.138	192.168.2.14
Jan 9, 2025 08:16:13.994354010 CET	6581	56480	89.33.192.138	192.168.2.14
Jan 9, 2025 08:16:13.994590998 CET	56480	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:16:13.995413065 CET	56482	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:16:13.999454021 CET	6581	56480	89.33.192.138	192.168.2.14
Jan 9, 2025 08:16:14.000309944 CET	6581	56482	89.33.192.138	192.168.2.14
Jan 9, 2025 08:16:14.000384092 CET	56482	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:16:14.000403881 CET	56482	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:16:14.005167007 CET	6581	56482	89.33.192.138	192.168.2.14
Jan 9, 2025 08:16:15.445749998 CET	6581	56482	89.33.192.138	192.168.2.14
Jan 9, 2025 08:16:15.446363926 CET	56482	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:16:15.447223902 CET	56484	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:16:15.451219082 CET	6581	56482	89.33.192.138	192.168.2.14
Jan 9, 2025 08:16:15.452097893 CET	6581	56484	89.33.192.138	192.168.2.14
Jan 9, 2025 08:16:15.452188015 CET	56484	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:16:15.452269077 CET	56484	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:16:15.457123041 CET	6581	56484	89.33.192.138	192.168.2.14
Jan 9, 2025 08:16:16.900710106 CET	6581	56484	89.33.192.138	192.168.2.14
Jan 9, 2025 08:16:16.901051998 CET	56484	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:16:16.901988983 CET	56486	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:16:16.905874968 CET	6581	56484	89.33.192.138	192.168.2.14
Jan 9, 2025 08:16:16.906774998 CET	6581	56486	89.33.192.138	192.168.2.14
Jan 9, 2025 08:16:16.906864882 CET	56486	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:16:16.906917095 CET	56486	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:16:16.911659956 CET	6581	56486	89.33.192.138	192.168.2.14
Jan 9, 2025 08:16:18.373296022 CET	6581	56486	89.33.192.138	192.168.2.14
Jan 9, 2025 08:16:18.373656988 CET	56486	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:16:18.374418974 CET	56488	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:16:18.378439903 CET	6581	56486	89.33.192.138	192.168.2.14
Jan 9, 2025 08:16:18.379208088 CET	6581	56488	89.33.192.138	192.168.2.14
Jan 9, 2025 08:16:18.379290104 CET	56488	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:16:18.379333973 CET	56488	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:16:18.384077072 CET	6581	56488	89.33.192.138	192.168.2.14
Jan 9, 2025 08:16:19.820557117 CET	6581	56488	89.33.192.138	192.168.2.14
Jan 9, 2025 08:16:19.820683002 CET	56488	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:16:19.821851969 CET	56490	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:16:19.825480938 CET	6581	56488	89.33.192.138	192.168.2.14
Jan 9, 2025 08:16:19.826698065 CET	6581	56490	89.33.192.138	192.168.2.14
Jan 9, 2025 08:16:19.826786041 CET	56490	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:16:19.826831102 CET	56490	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:16:19.831604004 CET	6581	56490	89.33.192.138	192.168.2.14
Jan 9, 2025 08:16:21.269973040 CET	6581	56490	89.33.192.138	192.168.2.14
Jan 9, 2025 08:16:21.270173073 CET	56490	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:16:21.270778894 CET	56492	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:16:21.274930954 CET	6581	56490	89.33.192.138	192.168.2.14
Jan 9, 2025 08:16:21.275614023 CET	6581	56492	89.33.192.138	192.168.2.14
Jan 9, 2025 08:16:21.275686979 CET	56492	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:16:21.275733948 CET	56492	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:16:21.280514956 CET	6581	56492	89.33.192.138	192.168.2.14
Jan 9, 2025 08:16:22.731230974 CET	6581	56492	89.33.192.138	192.168.2.14
Jan 9, 2025 08:16:22.731626034 CET	56492	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:16:22.732578993 CET	56494	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:16:22.736473083 CET	6581	56492	89.33.192.138	192.168.2.14
Jan 9, 2025 08:16:22.737461090 CET	6581	56494	89.33.192.138	192.168.2.14
Jan 9, 2025 08:16:22.737560034 CET	56494	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:16:22.737607956 CET	56494	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:16:22.742368937 CET	6581	56494	89.33.192.138	192.168.2.14

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 9, 2025 08:15:36.000036001 CET	45046	53	192.168.2.14	8.8.8.8
Jan 9, 2025 08:15:36.000088930 CET	36721	53	192.168.2.14	8.8.8.8
Jan 9, 2025 08:15:36.220633030 CET	53	36721	8.8.8.8	192.168.2.14
Jan 9, 2025 08:15:36.220643997 CET	53	45046	8.8.8.8	192.168.2.14

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 9, 2025 08:15:36.000036001 CET	192.168.2.14	8.8.8.8	0x6585	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 08:15:36.000088930 CET	192.168.2.14	8.8.8.8	0x9b73	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 9, 2025 08:15:36.220643997 CET	8.8.8.8	192.168.2.14	0x6585	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false
Jan 9, 2025 08:15:36.220643997 CET	8.8.8.8	192.168.2.14	0x6585	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: ssh.elf PID: 5487, Parent PID: 5412

General

Start time (UTC):	07:12:49
Start date (UTC):	09/01/2025
Path:	/tmp/ssh.elf
Arguments:	/tmp/ssh.elf
File size:	101989 bytes
MD5 hash:	00389ae9afc4e52098a16c0b227b45bd

Chronological Activities

Analysis Process: ssh.elf PID: 5488, Parent PID: 5487

General

Start time (UTC):	07:12:49
Start date (UTC):	09/01/2025
Path:	/tmp/ssh.elf
Arguments:	-
File size:	101989 bytes
MD5 hash:	00389ae9afc4e52098a16c0b227b45bd

Chronological Activities

Analysis Process: ssh.elf PID: 5489, Parent PID: 5488

General

Start time (UTC):	07:12:49
Start date (UTC):	09/01/2025
Path:	/tmp/ssh.elf
Arguments:	-
File size:	101989 bytes
MD5 hash:	00389ae9afc4e52098a16c0b227b45bd

Description:	Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping or `net view` using Net .
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report ssh.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Threatname: Gafgyt

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: ssh.elf PID: 5487, Parent PID: 5412

General

Chronological Activities

Analysis Process: ssh.elf PID: 5488, Parent PID: 5487

General

Chronological Activities

Analysis Process: ssh.elf PID: 5489, Parent PID: 5488

General

Chronological Activities

Linux Analysis Report
ssh.elf