Edit tour

Linux Analysis Report
ssi.elf

Overview

General Information

Sample name:	ssi.elf
Analysis ID:	1586484
MD5:	30694d958a9e2308817e320f254df07a
SHA1:	4e4b0f201afff635eeb94ab741bd5bd3524252de
SHA256:	23fc21364599d0415706b7b1d7e6d53d2d56a1af5aaa794dd4df2d934728bc2a
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai, Gafgyt

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Detected Mirai

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Gafgyt

Contains symbols with names commonly found in malware

Machine Learning detection for sample

Opens /proc/net/* files useful for finding connected devices and routers

Detected TCP or UDP traffic on non-standard ports

Sample contains strings that are user agent strings indicative of HTTP manipulation

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1586484
Start date and time:	2025-01-09 08:27:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	ssi.elf
Detection:	MAL
Classification:	mal100.spre.troj.linELF@0/0@2/0

Runtime Messages

Command:	/tmp/ssi.elf
PID:	5491
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

ssi.elf (PID: 5491, Parent: 5414, MD5: 30694d958a9e2308817e320f254df07a) Arguments: /tmp/ssi.elf

ssi.elf New Fork (PID: 5492, Parent: 5491)

ssi.elf New Fork (PID: 5493, Parent: 5492)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
ssi.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
ssi.elf	Linux_Trojan_Gafgyt_6122acdf	unknown	unknown	0x591:$a: E8 B0 00 FC 8B 7D E8 F2 AE 89 C8 F7 D0 48 48 89 45 F8 EB 03 FF
ssi.elf	Linux_Trojan_Gafgyt_1b2e2a3a	unknown	unknown	0x81e:$a: 83 7D 18 00 74 25 8B 45 1C 83 E0 02 85 C0 74 1B C7 44 24 04 2D 00
ssi.elf	Linux_Trojan_Gafgyt_9127f7be	unknown	unknown	0xc7b:$a: E4 F7 E1 89 D0 C1 E8 03 89 45 E8 8B 45 E8 01 C0 03 45 E8 C1

Memory Dumps

Source	Rule	Description	Author	Strings
5491.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Gafgyt_6122acdf	unknown	unknown	0x591:$a: E8 B0 00 FC 8B 7D E8 F2 AE 89 C8 F7 D0 48 48 89 45 F8 EB 03 FF
5491.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Gafgyt_1b2e2a3a	unknown	unknown	0x81e:$a: 83 7D 18 00 74 25 8B 45 1C 83 E0 02 85 C0 74 1B C7 44 24 04 2D 00
5491.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Gafgyt_9127f7be	unknown	unknown	0xc7b:$a: E4 F7 E1 89 D0 C1 E8 03 89 45 E8 8B 45 E8 01 C0 03 45 E8 C1
5492.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Gafgyt_6122acdf	unknown	unknown	0x591:$a: E8 B0 00 FC 8B 7D E8 F2 AE 89 C8 F7 D0 48 48 89 45 F8 EB 03 FF
5492.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Gafgyt_1b2e2a3a	unknown	unknown	0x81e:$a: 83 7D 18 00 74 25 8B 45 1C 83 E0 02 85 C0 74 1B C7 44 24 04 2D 00
5492.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Gafgyt_9127f7be	unknown	unknown	0xc7b:$a: E4 F7 E1 89 D0 C1 E8 03 89 45 E8 8B 45 E8 01 C0 03 45 E8 C1
Click to see the 1 entries

Suricata Signatures

ETPRO MALWARE ELF/Mirai Variant CnC Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-09T08:27:55.948648+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56202	89.33.192.138	6581	TCP
2025-01-09T08:28:05.363813+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56204	89.33.192.138	6581	TCP
2025-01-09T08:28:06.830131+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56206	89.33.192.138	6581	TCP
2025-01-09T08:28:13.768714+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56208	89.33.192.138	6581	TCP
2025-01-09T08:28:15.218673+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56210	89.33.192.138	6581	TCP
2025-01-09T08:28:19.155836+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56212	89.33.192.138	6581	TCP
2025-01-09T08:28:32.585467+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56214	89.33.192.138	6581	TCP
2025-01-09T08:28:46.024212+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56216	89.33.192.138	6581	TCP
2025-01-09T08:28:47.467534+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56218	89.33.192.138	6581	TCP
2025-01-09T08:28:48.924596+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56220	89.33.192.138	6581	TCP
2025-01-09T08:28:55.842157+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56222	89.33.192.138	6581	TCP
2025-01-09T08:28:57.279939+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56224	89.33.192.138	6581	TCP
2025-01-09T08:29:01.205689+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56226	89.33.192.138	6581	TCP
2025-01-09T08:29:08.123605+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56228	89.33.192.138	6581	TCP
2025-01-09T08:29:27.027663+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56230	89.33.192.138	6581	TCP
2025-01-09T08:29:28.487766+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56232	89.33.192.138	6581	TCP
2025-01-09T08:29:29.940294+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56234	89.33.192.138	6581	TCP
2025-01-09T08:29:31.396326+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56236	89.33.192.138	6581	TCP
2025-01-09T08:29:32.846475+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56238	89.33.192.138	6581	TCP
2025-01-09T08:29:34.295879+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56240	89.33.192.138	6581	TCP
2025-01-09T08:29:35.777190+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56242	89.33.192.138	6581	TCP
2025-01-09T08:29:37.217068+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56244	89.33.192.138	6581	TCP
2025-01-09T08:29:38.656216+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56246	89.33.192.138	6581	TCP
2025-01-09T08:29:40.093757+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56248	89.33.192.138	6581	TCP
2025-01-09T08:29:41.548778+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56250	89.33.192.138	6581	TCP
2025-01-09T08:29:43.001678+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56252	89.33.192.138	6581	TCP
2025-01-09T08:29:44.443182+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56254	89.33.192.138	6581	TCP
2025-01-09T08:29:45.909651+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56256	89.33.192.138	6581	TCP
2025-01-09T08:29:47.359024+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56258	89.33.192.138	6581	TCP
2025-01-09T08:29:48.796597+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56260	89.33.192.138	6581	TCP
2025-01-09T08:29:50.251450+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56262	89.33.192.138	6581	TCP
2025-01-09T08:29:51.703379+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56264	89.33.192.138	6581	TCP
2025-01-09T08:29:53.140353+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56266	89.33.192.138	6581	TCP
2025-01-09T08:29:54.578211+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56268	89.33.192.138	6581	TCP
2025-01-09T08:29:56.033221+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56270	89.33.192.138	6581	TCP
2025-01-09T08:29:57.486403+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56272	89.33.192.138	6581	TCP
2025-01-09T08:29:58.940442+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56274	89.33.192.138	6581	TCP
2025-01-09T08:30:00.410951+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56276	89.33.192.138	6581	TCP
2025-01-09T08:30:01.843864+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56278	89.33.192.138	6581	TCP
2025-01-09T08:30:03.298821+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56280	89.33.192.138	6581	TCP
2025-01-09T08:30:04.771741+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56282	89.33.192.138	6581	TCP
2025-01-09T08:30:06.229179+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56284	89.33.192.138	6581	TCP
2025-01-09T08:30:07.672562+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56286	89.33.192.138	6581	TCP
2025-01-09T08:30:09.109734+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56288	89.33.192.138	6581	TCP
2025-01-09T08:30:10.578676+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56290	89.33.192.138	6581	TCP
2025-01-09T08:30:12.016770+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56292	89.33.192.138	6581	TCP
2025-01-09T08:30:13.453239+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56294	89.33.192.138	6581	TCP
2025-01-09T08:30:14.927287+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56296	89.33.192.138	6581	TCP
2025-01-09T08:30:16.375652+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56298	89.33.192.138	6581	TCP
2025-01-09T08:30:17.812647+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56300	89.33.192.138	6581	TCP
2025-01-09T08:30:19.271682+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56302	89.33.192.138	6581	TCP
2025-01-09T08:30:20.720189+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56304	89.33.192.138	6581	TCP
2025-01-09T08:30:22.175194+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56306	89.33.192.138	6581	TCP
2025-01-09T08:30:23.647332+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56308	89.33.192.138	6581	TCP
2025-01-09T08:30:25.113179+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56310	89.33.192.138	6581	TCP
2025-01-09T08:30:26.563260+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56312	89.33.192.138	6581	TCP
2025-01-09T08:30:28.018003+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56314	89.33.192.138	6581	TCP
2025-01-09T08:30:29.475001+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56316	89.33.192.138	6581	TCP
2025-01-09T08:30:30.927016+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56318	89.33.192.138	6581	TCP
2025-01-09T08:30:32.429379+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56320	89.33.192.138	6581	TCP
2025-01-09T08:30:33.880720+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56322	89.33.192.138	6581	TCP
2025-01-09T08:30:35.313141+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56324	89.33.192.138	6581	TCP
2025-01-09T08:30:36.771353+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56326	89.33.192.138	6581	TCP
2025-01-09T08:30:38.224500+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56328	89.33.192.138	6581	TCP
2025-01-09T08:30:39.694590+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56330	89.33.192.138	6581	TCP
2025-01-09T08:30:41.141184+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56332	89.33.192.138	6581	TCP
2025-01-09T08:30:42.579928+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56334	89.33.192.138	6581	TCP
2025-01-09T08:30:44.037102+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56336	89.33.192.138	6581	TCP
2025-01-09T08:30:45.509210+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56338	89.33.192.138	6581	TCP
2025-01-09T08:30:46.955973+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56340	89.33.192.138	6581	TCP
2025-01-09T08:30:48.410918+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56342	89.33.192.138	6581	TCP
2025-01-09T08:30:49.853166+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56344	89.33.192.138	6581	TCP
2025-01-09T08:30:51.318334+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56346	89.33.192.138	6581	TCP
2025-01-09T08:30:52.769002+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56348	89.33.192.138	6581	TCP
2025-01-09T08:30:54.204221+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56350	89.33.192.138	6581	TCP
2025-01-09T08:30:55.695893+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56352	89.33.192.138	6581	TCP
2025-01-09T08:30:57.144173+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56354	89.33.192.138	6581	TCP
2025-01-09T08:30:58.580708+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56356	89.33.192.138	6581	TCP
2025-01-09T08:31:00.025069+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56358	89.33.192.138	6581	TCP
2025-01-09T08:31:01.474188+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56360	89.33.192.138	6581	TCP
2025-01-09T08:31:02.942107+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56362	89.33.192.138	6581	TCP
2025-01-09T08:31:04.409467+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56364	89.33.192.138	6581	TCP
2025-01-09T08:31:05.862892+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56366	89.33.192.138	6581	TCP
2025-01-09T08:31:07.319286+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56368	89.33.192.138	6581	TCP
2025-01-09T08:31:08.773151+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56370	89.33.192.138	6581	TCP
2025-01-09T08:31:10.223683+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56372	89.33.192.138	6581	TCP
2025-01-09T08:31:11.660814+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56374	89.33.192.138	6581	TCP
2025-01-09T08:31:13.117576+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56376	89.33.192.138	6581	TCP
2025-01-09T08:31:14.585358+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56378	89.33.192.138	6581	TCP
2025-01-09T08:31:16.035475+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56380	89.33.192.138	6581	TCP
2025-01-09T08:31:17.493748+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56382	89.33.192.138	6581	TCP
2025-01-09T08:31:18.963212+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56384	89.33.192.138	6581	TCP
2025-01-09T08:31:20.432021+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56386	89.33.192.138	6581	TCP
2025-01-09T08:31:21.879501+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56388	89.33.192.138	6581	TCP
2025-01-09T08:31:23.332807+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56390	89.33.192.138	6581	TCP
2025-01-09T08:31:24.770387+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56392	89.33.192.138	6581	TCP
2025-01-09T08:31:26.207662+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56394	89.33.192.138	6581	TCP
2025-01-09T08:31:27.663801+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56396	89.33.192.138	6581	TCP
2025-01-09T08:31:29.124407+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.14	56398	89.33.192.138	6581	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: ssi.elf

Avira: detected

Found malware configuration

Source: ssi.elf

Malware Configuration Extractor: Gafgyt {"C2 url": "89.33.192.138:6581"}

Multi AV Scanner detection for submitted file

Source: ssi.elf	ReversingLabs: Detection: 68%
Source: ssi.elf	Virustotal: Detection: 62%			Perma Link

Machine Learning detection for sample

Source: ssi.elf

Joe Sandbox ML: detected

Spreading

Opens /proc/net/* files useful for finding connected devices and routers

Source: /tmp/ssi.elf (PID: 5491)

Opens: /proc/net/route

Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56218 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56242 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56212 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56206 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56224 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56208 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56238 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56230 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56214 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56216 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56246 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56210 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56234 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56252 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56220 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56236 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56254 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56266 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56282 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56272 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56244 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56250 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56248 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56274 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56204 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56278 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56228 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56268 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56270 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56222 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56280 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56264 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56258 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56284 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56226 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56286 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56232 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56290 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56292 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56294 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56314 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56312 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56240 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56322 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56304 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56310 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56298 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56326 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56316 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56346 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56300 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56334 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56376 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56390 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56324 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56336 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56308 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56358 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56396 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56318 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56342 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56366 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56378 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56328 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56344 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56388 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56330 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56354 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56386 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56348 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56382 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56356 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56374 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56364 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56398 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56362 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56256 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56296 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56394 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56260 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56332 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56320 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56360 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56392 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56350 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56384 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56352 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56288 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56302 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56306 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56338 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56368 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56370 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56202 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56340 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56372 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56380 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56262 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.14:56276 -> 89.33.192.138:6581

Source: global traffic

TCP traffic: 192.168.2.14:56202 -> 89.33.192.138:6581

Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

System Summary

Malicious sample detected (through community Yara rule)

Source: ssi.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_6122acdf Author: unknown
Source: ssi.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_1b2e2a3a Author: unknown
Source: ssi.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_9127f7be Author: unknown
Source: 5491.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6122acdf Author: unknown
Source: 5491.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_1b2e2a3a Author: unknown
Source: 5491.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9127f7be Author: unknown
Source: 5492.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6122acdf Author: unknown
Source: 5492.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_1b2e2a3a Author: unknown
Source: 5492.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9127f7be Author: unknown

Contains symbols with names commonly found in malware

Source: ELF static info symbol of initial sample

Name: vseattack

Source: ssi.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_6122acdf os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 283275705c729be23d7dc75056388ecae00390bd25ee7b66b0cfc9b85feee212, id = 6122acdf-1eef-45ea-83ea-699d21c2dc20, last_modified = 2021-09-16
Source: ssi.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_1b2e2a3a reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 6f24b67d0a6a4fc4e1cfea5a5414b82af1332a3e6074eb2178aee6b27702b407, id = 1b2e2a3a-1302-41c7-be99-43edb5563294, last_modified = 2021-09-16
Source: ssi.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_9127f7be reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 72c742cb8b11ddf030e10f67e13c0392748dcd970394ec77ace3d2baa705a375, id = 9127f7be-6e82-46a1-9f11-0b3570b0cd76, last_modified = 2021-09-16
Source: 5491.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6122acdf os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 283275705c729be23d7dc75056388ecae00390bd25ee7b66b0cfc9b85feee212, id = 6122acdf-1eef-45ea-83ea-699d21c2dc20, last_modified = 2021-09-16
Source: 5491.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_1b2e2a3a reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 6f24b67d0a6a4fc4e1cfea5a5414b82af1332a3e6074eb2178aee6b27702b407, id = 1b2e2a3a-1302-41c7-be99-43edb5563294, last_modified = 2021-09-16
Source: 5491.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9127f7be reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 72c742cb8b11ddf030e10f67e13c0392748dcd970394ec77ace3d2baa705a375, id = 9127f7be-6e82-46a1-9f11-0b3570b0cd76, last_modified = 2021-09-16
Source: 5492.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6122acdf os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 283275705c729be23d7dc75056388ecae00390bd25ee7b66b0cfc9b85feee212, id = 6122acdf-1eef-45ea-83ea-699d21c2dc20, last_modified = 2021-09-16
Source: 5492.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_1b2e2a3a reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 6f24b67d0a6a4fc4e1cfea5a5414b82af1332a3e6074eb2178aee6b27702b407, id = 1b2e2a3a-1302-41c7-be99-43edb5563294, last_modified = 2021-09-16
Source: 5492.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9127f7be reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 72c742cb8b11ddf030e10f67e13c0392748dcd970394ec77ace3d2baa705a375, id = 9127f7be-6e82-46a1-9f11-0b3570b0cd76, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.spre.troj.linELF@0/0@2/0

Source: ssi.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/i386/crt1.S
Source: ssi.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/i386/crti.S
Source: ssi.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/i386/crtn.S
Source: ssi.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/i386/mmap.S

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match

File source: ssi.elf, type: SAMPLE

Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.71 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36

Remote Access Functionality

Detected Mirai

Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin

Yara detected Gafgyt

Source: Yara match

File source: ssi.elf, type: SAMPLE

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	OS Credential Dumping	1 Remote System Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

Threatname: Gafgyt

{"C2 url": "89.33.192.138:6581"}

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
ssi.elf	68%	ReversingLabs	Linux.Trojan.Gafgyt
ssi.elf	62%	Virustotal		Browse
ssi.elf	100%	Avira	EXP/ELF.Mirai.Z
ssi.elf	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.24	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
89.33.192.138:6581	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
89.33.192.138	unknown	Romania		9009	M247GB	true

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
89.33.192.138	ssl.elf	Get hash	malicious	Gafgyt	Browse
	sss.elf	Get hash	malicious	Gafgyt	Browse
	ssb.elf	Get hash	malicious	Gafgyt	Browse
	ssx.elf	Get hash	malicious	Gafgyt	Browse
	ssg.elf	Get hash	malicious	Mirai, Gafgyt	Browse
	ssp.elf	Get hash	malicious	Gafgyt	Browse
	ssc.elf	Get hash	malicious	Gafgyt	Browse
	sst.elf	Get hash	malicious	Gafgyt	Browse
	ssy.elf	Get hash	malicious	Gafgyt	Browse
	ssd.elf	Get hash	malicious	Gafgyt	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	sss.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.25
	ssb.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.24
	ssg.elf	Get hash	malicious	Mirai, Gafgyt	Browse	162.213.35.24
	ssp.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.25
	ssc.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.24
	ssy.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.25
	ssd.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.25
	ssh.elf	Get hash	malicious	Mirai, Gafgyt	Browse	162.213.35.24
	Fantazy.mips.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	watchdog.elf	Get hash	malicious	Xmrig	Browse	162.213.35.25

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
M247GB	ssl.elf	Get hash	malicious	Gafgyt	Browse	89.33.192.138
	sss.elf	Get hash	malicious	Gafgyt	Browse	89.33.192.138
	ssb.elf	Get hash	malicious	Gafgyt	Browse	89.33.192.138
	ssx.elf	Get hash	malicious	Gafgyt	Browse	89.33.192.138
	ssg.elf	Get hash	malicious	Mirai, Gafgyt	Browse	89.33.192.138
	ssp.elf	Get hash	malicious	Gafgyt	Browse	89.33.192.138
	ssc.elf	Get hash	malicious	Gafgyt	Browse	89.33.192.138
	sst.elf	Get hash	malicious	Gafgyt	Browse	89.33.192.138
	ssy.elf	Get hash	malicious	Gafgyt	Browse	89.33.192.138
	ssd.elf	Get hash	malicious	Gafgyt	Browse	89.33.192.138

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	6.262894111066676
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	ssi.elf
File size:	95'982 bytes
MD5:	30694d958a9e2308817e320f254df07a
SHA1:	4e4b0f201afff635eeb94ab741bd5bd3524252de
SHA256:	23fc21364599d0415706b7b1d7e6d53d2d56a1af5aaa794dd4df2d934728bc2a
SHA512:	62c9eee761f0130326c54b1b32990b86fc3933b94bcdf29d900b73a91d808940c79f4a8fa236af0b6bcb5d5bd03a6573a05248f55966c797c08206ba4df7321c
SSDEEP:	1536:DrSthiWmGWE6BALuPLkklHAkw7WBU/GNX79ejBd/kncW7efTcgZvYV:chiWKBBALuTZNPwQU/GPedNkncW7ef45
TLSH:	EE934B81FB43CAB3C4830BB602979B650631FC2A0A2A9F59F31D7DF49B134C97616B25
File Content Preview:	.ELF....................h...4...........4. ...(.........................................................dl..........Q.td............................U..S.......w....h........[]...$.............U......=.....t..1....$......$.......u........t...$.t...........

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8048168
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	73124
Section Header Size:	40
Number of Section Headers:	25
Header String Table Index:	22

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x8048094	0x94	0x1c	0x0	0x6	AX	0	0	1
.text	PROGBITS	0x80480b0	0xb0	0xc734	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x80547e4	0xc7e4	0x17	0x0	0x6	AX	0	0	1
.rodata	PROGBITS	0x8054800	0xc800	0x2ca2	0x0	0x2	A	0	0	32
.eh_frame	PROGBITS	0x80574a4	0xf4a4	0x4	0x0	0x2	A	0	0	4
.ctors	PROGBITS	0x8058000	0x10000	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x8058008	0x10008	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x8058010	0x10010	0x4	0x0	0x3	WA	0	0	4
.got.plt	PROGBITS	0x8058014	0x10014	0xc	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x8058020	0x10020	0x560	0x0	0x3	WA	0	0	32
.bss	NOBITS	0x8058580	0x10580	0x66e4	0x0	0x3	WA	0	0	32
.comment	PROGBITS	0x0	0x10580	0xca8	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x11228	0x20	0x0	0x0		0	0	1
.debug_pubnames	PROGBITS	0x0	0x11248	0x1f	0x0	0x0		0	0	1
.debug_info	PROGBITS	0x0	0x11267	0x340	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x115a7	0x164	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x1170b	0xd6	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x117e4	0x34	0x0	0x0		0	0	4
.debug_str	PROGBITS	0x0	0x11818	0x13e	0x1	0x30	MS	0	0	1
.debug_loc	PROGBITS	0x0	0x11956	0x2f9	0x0	0x0		0	0	1
.debug_ranges	PROGBITS	0x0	0x11c4f	0x70	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x11cbf	0xe5	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x1218c	0x30b0	0x10	0x0		24	296	4
.strtab	STRTAB	0x0	0x1523c	0x24b2	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8048000	0x8048000	0xf4a8	0xf4a8	6.5843	0x5	R E	0x1000	.init .text .fini .rodata .eh_frame
LOAD	0x10000	0x8058000	0x8058000	0x580	0x6c64	4.5572	0x6	RW	0x1000	.ctors .dtors .jcr .got.plt .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x8048094	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80480b0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x80547e4	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x8054800	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x80574a4	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x8058000	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x8058008	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x8058010	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x8058014	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x8058020	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x8058580	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	19
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	20
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	21
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	22
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	23
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	24
C.111.5152	.symtab	0x8054cc0	96	OBJECT	<unknown>	DEFAULT	4
Q	.symtab	0x80585c0	16384	OBJECT	<unknown>	DEFAULT	11
SendHTTPHex	.symtab	0x804a3e3	431	FUNC	<unknown>	DEFAULT	2
SendSTDHEX	.symtab	0x8049c33	324	FUNC	<unknown>	DEFAULT	2
SendUDP	.symtab	0x8049362	850	FUNC	<unknown>	DEFAULT	2
_GLOBAL_OFFSET_TABLE_	.symtab	0x8058014	0	OBJECT	<unknown>	HIDDEN	9
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x8058004	0	OBJECT	<unknown>	DEFAULT	6
__CTOR_LIST__	.symtab	0x8058000	0	OBJECT	<unknown>	DEFAULT	6
__C_ctype_b	.symtab	0x80582e8	4	OBJECT	<unknown>	DEFAULT	10
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x8055ae0	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x8058578	4	OBJECT	<unknown>	DEFAULT	10
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x8057160	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x80582f0	4	OBJECT	<unknown>	DEFAULT	10
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x8055de0	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x805800c	0	OBJECT	<unknown>	DEFAULT	7
__DTOR_LIST__	.symtab	0x8058008	0	OBJECT	<unknown>	DEFAULT	7
__EH_FRAME_BEGIN__	.symtab	0x80574a4	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x80574a4	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x80582e8	4	OBJECT	<unknown>	HIDDEN	10
__GI___C_ctype_b_data	.symtab	0x8055ae0	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_tolower	.symtab	0x8058578	4	OBJECT	<unknown>	HIDDEN	10
__GI___C_ctype_tolower_data	.symtab	0x8057160	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_toupper	.symtab	0x80582f0	4	OBJECT	<unknown>	HIDDEN	10
__GI___C_ctype_toupper_data	.symtab	0x8055de0	768	OBJECT	<unknown>	HIDDEN	4
__GI___ctype_b	.symtab	0x80582ec	4	OBJECT	<unknown>	HIDDEN	10
__GI___ctype_tolower	.symtab	0x805857c	4	OBJECT	<unknown>	HIDDEN	10
__GI___ctype_toupper	.symtab	0x80582f4	4	OBJECT	<unknown>	HIDDEN	10
__GI___errno_location	.symtab	0x804cb14	6	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x8052524	220	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x804e230	29	FUNC	<unknown>	HIDDEN	2
__GI___h_errno_location	.symtab	0x8050c8c	6	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x804c518	87	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl64	.symtab	0x804c570	63	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x804c730	75	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x80502dc	63	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x8050353	64	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x804e250	182	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x804c5b0	40	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x804f750	273	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x804fbe8	20	FUNC	<unknown>	HIDDEN	2
__GI_atol	.symtab	0x804fbe8	20	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x8053470	54	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0x804c60c	46	FUNC	<unknown>	HIDDEN	2
__GI_clock_getres	.symtab	0x80506c8	50	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x804c63c	46	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0x804c92c	112	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x804e7e4	43	FUNC	<unknown>	HIDDEN	2
__GI_errno	.symtab	0x805e800	4	OBJECT	<unknown>	HIDDEN	11
__GI_exit	.symtab	0x804ff70	103	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x804cb1c	271	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x804c518	87	FUNC	<unknown>	HIDDEN	2
__GI_fcntl64	.symtab	0x804c570	63	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x804de2c	333	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x8052524	220	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x804dce4	98	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x804df7c	105	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x804cc2c	24	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x804c66c	38	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x804dfe8	49	FUNC	<unknown>	HIDDEN	2
__GI_fscanf	.symtab	0x804dcc4	30	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x80535fc	27	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x80536f0	231	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x80506fc	72	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x804e01c	120	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x8052524	220	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x80508c8	37	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x80508f0	38	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x8050918	38	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x8050940	38	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname	.symtab	0x804e480	48	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x804e4b0	818	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x8050968	17	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x804c694	38	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x805097c	50	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x804e810	43	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x80509b0	38	FUNC	<unknown>	HIDDEN	2
__GI_h_errno	.symtab	0x805e804	4	OBJECT	<unknown>	HIDDEN	11
__GI_inet_addr	.symtab	0x804e458	37	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x80527cc	148	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa	.symtab	0x804e443	21	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa_r	.symtab	0x804e3f4	79	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x8053df9	465	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x8053b1e	458	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x804fb3d	171	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x804c6bc	63	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x804e33c	29	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x804c6fc	50	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x80509d8	86	FUNC	<unknown>	HIDDEN	2
__GI_mbrtowc	.symtab	0x80534f8	112	FUNC	<unknown>	HIDDEN	2
__GI_mbsnrtowcs	.symtab	0x8053568	145	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x8052600	35	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x804e094	39	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x8052624	39	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x8052674	33	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x8052698	176	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x804e0bc	21	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x805063c	27	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x8050a30	50	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x8050a64	50	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x804c730	75	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0x804c99c	241	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x80534c0	54	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x8053224	24	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x804f86c	72	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x804fa45	94	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x80539c8	99	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x804c7d4	54	FUNC	<unknown>	HIDDEN	2
__GI_readdir	.symtab	0x804ca90	132	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x804e878	51	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x8050a98	78	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x804c80c	63	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x804e8ac	51	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x804e8e0	67	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x804c84c	38	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x804e924	59	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x804f9ac	153	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x805055f	218	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x804e98c	175	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x8050ae8	85	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x804ffd8	393	FUNC	<unknown>	HIDDEN	2
__GI_snprintf	.symtab	0x804cc44	33	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x804e960	43	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x804cc68	31	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x804faa3	154	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x80545bc	54	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x804e0d4	30	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x804e0f4	29	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x804e0f4	29	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x804e114	27	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x8053a60	54	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x804e130	19	FUNC	<unknown>	HIDDEN	2
__GI_strncat	.symtab	0x8053998	46	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x805264c	38	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x804e144	25	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x80527a4	39	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x8053a2c	50	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x804e160	206	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x804e320	25	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x8052748	89	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x804fbfc	26	FUNC	<unknown>	HIDDEN	2
__GI_strtoll	.symtab	0x804fd50	26	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x8050164	325	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x804e35c	112	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x804c874	46	FUNC	<unknown>	HIDDEN	2
__GI_tolower	.symtab	0x805459c	29	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x804c90c	29	FUNC	<unknown>	HIDDEN	2
__GI_ungetc	.symtab	0x8053618	214	FUNC	<unknown>	HIDDEN	2
__GI_vfscanf	.symtab	0x8051744	1746	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x804cc88	176	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x8050b40	59	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x804c8a4	26	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x8050c94	69	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x8050cfc	133	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x8050cdc	30	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x804c8c0	54	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x8058010	0	OBJECT	<unknown>	DEFAULT	8
__JCR_LIST__	.symtab	0x8058010	0	OBJECT	<unknown>	DEFAULT	8
__app_fini	.symtab	0x805e7f4	4	OBJECT	<unknown>	HIDDEN	11
__atexit_lock	.symtab	0x8058540	24	OBJECT	<unknown>	DEFAULT	10
__bsd_signal	.symtab	0x804e98c	175	FUNC	<unknown>	HIDDEN	2
__bss_start	.symtab	0x8058580	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x805031f	52	FUNC	<unknown>	DEFAULT	2
__ctype_b	.symtab	0x80582ec	4	OBJECT	<unknown>	DEFAULT	10
__ctype_tolower	.symtab	0x805857c	4	OBJECT	<unknown>	DEFAULT	10
__ctype_toupper	.symtab	0x80582f4	4	OBJECT	<unknown>	DEFAULT	10
__curbrk	.symtab	0x805e824	4	OBJECT	<unknown>	HIDDEN	11
__data_start	.symtab	0x8058028	0	NOTYPE	<unknown>	DEFAULT	10
__decode_answer	.symtab	0x8054198	249	FUNC	<unknown>	HIDDEN	2
__decode_dotted	.symtab	0x8054684	217	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x805407c	171	FUNC	<unknown>	HIDDEN	2
__deregister_frame_info_bases	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__divdi3	.symtab	0x804c370	424	FUNC	<unknown>	DEFAULT	2
__dns_lookup	.symtab	0x8052860	1876	FUNC	<unknown>	HIDDEN	2
__do_global_ctors_aux	.symtab	0x80547b0	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x80480c0	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x8058020	0	OBJECT	<unknown>	HIDDEN	10
__encode_dotted	.symtab	0x80545f4	144	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x8053fcc	175	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x8054128	83	FUNC	<unknown>	HIDDEN	2
__environ	.symtab	0x805e7ec	4	OBJECT	<unknown>	DEFAULT	11
__errno_location	.symtab	0x804cb14	6	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x805e7e4	4	OBJECT	<unknown>	HIDDEN	11
__fgetc_unlocked	.symtab	0x8052524	220	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x8058000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fini_array_start	.symtab	0x8058000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__get_hosts_byname_r	.symtab	0x80531f8	44	FUNC	<unknown>	HIDDEN	2
__get_pc_thunk_bx	.symtab	0x80480b0	0	FUNC	<unknown>	HIDDEN	2
__getdents	.symtab	0x8050744	111	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x80507b4	276	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x8050968	17	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x804e230	29	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__h_errno_location	.symtab	0x8050c8c	6	FUNC	<unknown>	DEFAULT	2
__h_errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__init_array_end	.symtab	0x8058000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__init_array_start	.symtab	0x8058000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__init_scan_cookie	.symtab	0x8051e28	72	FUNC	<unknown>	HIDDEN	2
__length_dotted	.symtab	0x8054760	65	FUNC	<unknown>	HIDDEN	2
__length_question	.symtab	0x805417c	28	FUNC	<unknown>	HIDDEN	2
__libc_close	.symtab	0x804c63c	46	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x804e7e4	43	FUNC	<unknown>	DEFAULT	2
__libc_creat	.symtab	0x804c77b	25	FUNC	<unknown>	DEFAULT	2
__libc_fcntl	.symtab	0x804c518	87	FUNC	<unknown>	DEFAULT	2
__libc_fcntl64	.symtab	0x804c570	63	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x804c66c	38	FUNC	<unknown>	DEFAULT	2
__libc_getpid	.symtab	0x804c694	38	FUNC	<unknown>	DEFAULT	2
__libc_lseek64	.symtab	0x80509d8	86	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0x8050a64	50	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x804c730	75	FUNC	<unknown>	DEFAULT	2
__libc_poll	.symtab	0x80534c0	54	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x804c7d4	54	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x804e878	51	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x804c80c	63	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x804e8ac	51	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x804e8e0	67	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x805055f	218	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x805e7e8	4	OBJECT	<unknown>	DEFAULT	11
__libc_waitpid	.symtab	0x804c8a4	26	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x804c8c0	54	FUNC	<unknown>	DEFAULT	2
__malloc_consolidate	.symtab	0x804f3e9	424	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x804eaa0	38	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x8058450	24	OBJECT	<unknown>	DEFAULT	10
__malloc_state	.symtab	0x805e8c0	888	OBJECT	<unknown>	DEFAULT	11
__malloc_trim	.symtab	0x804f35c	141	FUNC	<unknown>	DEFAULT	2
__nameserver	.symtab	0x805ec48	12	OBJECT	<unknown>	HIDDEN	11
__nameservers	.symtab	0x805ec54	4	OBJECT	<unknown>	HIDDEN	11
__open_etc_hosts	.symtab	0x8054294	49	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x8052fb4	579	FUNC	<unknown>	HIDDEN	2
__pagesize	.symtab	0x805e7f0	4	OBJECT	<unknown>	DEFAULT	11
__preinit_array_end	.symtab	0x8058000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__preinit_array_start	.symtab	0x8058000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__psfs_do_numeric	.symtab	0x80520a8	1148	FUNC	<unknown>	HIDDEN	2
__psfs_do_numeric.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__psfs_parse_spec	.symtab	0x8051ee4	450	FUNC	<unknown>	HIDDEN	2
__psfs_parse_spec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__pthread_initialize_minimal	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0x805031b	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x805031b	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x805031b	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x805031b	3	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x805031b	3	FUNC	<unknown>	DEFAULT	2
__pthread_return_void	.symtab	0x805031e	1	FUNC	<unknown>	DEFAULT	2
__raise	.symtab	0x8053224	24	FUNC	<unknown>	HIDDEN	2
__read_etc_hosts_r	.symtab	0x80542c5	724	FUNC	<unknown>	HIDDEN	2
__register_frame_info_bases	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__resolv_lock	.symtab	0x8058560	24	OBJECT	<unknown>	DEFAULT	10
__restore	.symtab	0x8050557	0	NOTYPE	<unknown>	DEFAULT	2
__restore_rt	.symtab	0x8050550	0	NOTYPE	<unknown>	DEFAULT	2
__rtld_fini	.symtab	0x805e7f8	4	OBJECT	<unknown>	HIDDEN	11
__scan_cookie.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__scan_getc	.symtab	0x8051e70	80	FUNC	<unknown>	HIDDEN	2
__scan_ungetc	.symtab	0x8051ec0	36	FUNC	<unknown>	HIDDEN	2
__searchdomain	.symtab	0x805ec38	16	OBJECT	<unknown>	HIDDEN	11
__searchdomains	.symtab	0x805ec58	4	OBJECT	<unknown>	HIDDEN	11
__sigaddset	.symtab	0x804ea60	32	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x804ea80	32	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x804ea3c	36	FUNC	<unknown>	DEFAULT	2
__socketcall	.symtab	0x8050658	50	FUNC	<unknown>	HIDDEN	2
__socketcall.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__stdin	.symtab	0x8058304	4	OBJECT	<unknown>	DEFAULT	10
__stdio_READ	.symtab	0x80537d8	79	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x8050d84	128	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x8053828	164	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x8050e04	234	FUNC	<unknown>	HIDDEN	2
__stdio_init_mutex	.symtab	0x804cfdf	23	FUNC	<unknown>	HIDDEN	2
__stdio_mutex_initializer.4160	.symtab	0x80560e0	24	OBJECT	<unknown>	DEFAULT	4
__stdio_rfill	.symtab	0x80538cc	40	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x8053964	51	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x80538f4	110	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x8050ef0	167	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x804d080	43	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x8058308	4	OBJECT	<unknown>	DEFAULT	10
__strtofpmax	.symtab	0x805323c	543	FUNC	<unknown>	HIDDEN	2
__strtofpmax.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_error	.symtab	0x80534a8	21	FUNC	<unknown>	HIDDEN	2
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_rt_sigaction	.symtab	0x805068c	59	FUNC	<unknown>	HIDDEN	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uClibc_fini	.symtab	0x80502dc	63	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x8050353	64	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x8050393	443	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x8058558	4	OBJECT	<unknown>	HIDDEN	10
__xpg_strerror_r	.symtab	0x804e250	182	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__xstat64_conv	.symtab	0x8050b7c	146	FUNC	<unknown>	HIDDEN	2
__xstat_conv	.symtab	0x8050c0e	125	FUNC	<unknown>	HIDDEN	2
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_charpad	.symtab	0x804d0ac	54	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_dl_aux_init	.symtab	0x805345c	18	FUNC	<unknown>	DEFAULT	2
_dl_phdr	.symtab	0x805ec5c	4	OBJECT	<unknown>	DEFAULT	11
_dl_phnum	.symtab	0x805ec60	4	OBJECT	<unknown>	DEFAULT	11
_edata	.symtab	0x8058580	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x805ec64	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_errno	.symtab	0x805e800	4	OBJECT	<unknown>	DEFAULT	11
_exit	.symtab	0x804c5b0	40	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x80547e4	3	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x805c5e0	8192	OBJECT	<unknown>	DEFAULT	11
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x804d0e2	106	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x8051100	1449	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_h_errno	.symtab	0x805e804	4	OBJECT	<unknown>	DEFAULT	11
_init	.symtab	0x8048094	3	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x8050f98	86	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_init	.symtab	0x804d704	111	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x804d8f5	975	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x804d774	66	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x804d7b8	273	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x804d8cc	41	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x805031e	1	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x805031e	1	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_sigintr	.symtab	0x805e840	128	OBJECT	<unknown>	HIDDEN	11
_start	.symtab	0x8048168	34	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x804cd38	579	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x804cf7c	99	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x805830c	4	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_add_lock	.symtab	0x8058310	24	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_dec_use	.symtab	0x804dd48	228	FUNC	<unknown>	DEFAULT	2
_stdio_openlist_del_count	.symtab	0x805c5cc	4	OBJECT	<unknown>	DEFAULT	11
_stdio_openlist_del_lock	.symtab	0x8058328	24	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_use_count	.symtab	0x805c5c8	4	OBJECT	<unknown>	DEFAULT	11
_stdio_streams	.symtab	0x8058360	240	OBJECT	<unknown>	DEFAULT	10
_stdio_term	.symtab	0x804cff6	136	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x8058340	4	OBJECT	<unknown>	DEFAULT	10
_stdlib_strto_l	.symtab	0x804fc18	289	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdlib_strto_ll	.symtab	0x804fd6c	513	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_ll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x8050ff0	61	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x80561c0	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x8051030	207	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x804d14c	1464	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x804f750	273	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
access	.symtab	0x804c5d8	50	FUNC	<unknown>	DEFAULT	2
access.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
advanced_kill_process	.symtab	0x804c07e	51	FUNC	<unknown>	DEFAULT	2
atoi	.symtab	0x804fbe8	20	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x804fbe8	20	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
atoll	.symtab	0x804fd3c	20	FUNC	<unknown>	DEFAULT	2
atoll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bcopy	.symtab	0x804e308	21	FUNC	<unknown>	DEFAULT	2
bcopy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
been_there_done_that	.symtab	0x805e7e0	1	OBJECT	<unknown>	DEFAULT	11
been_there_done_that.3001	.symtab	0x805e7fc	1	OBJECT	<unknown>	DEFAULT	11
bot.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
brk	.symtab	0x8053470	54	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x804e98c	175	FUNC	<unknown>	DEFAULT	2
buf.2827	.symtab	0x805e5e4	16	OBJECT	<unknown>	DEFAULT	11
buf.5162	.symtab	0x805e600	460	OBJECT	<unknown>	DEFAULT	11
c	.symtab	0x8058050	4	OBJECT	<unknown>	DEFAULT	10
calloc	.symtab	0x804f268	244	FUNC	<unknown>	DEFAULT	2
calloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
change_process_name_based_on_port	.symtab	0x804c141	208	FUNC	<unknown>	DEFAULT	2
chdir	.symtab	0x804c60c	46	FUNC	<unknown>	DEFAULT	2
chdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
check_and_kill_processes	.symtab	0x804c211	328	FUNC	<unknown>	DEFAULT	2
clock_getres	.symtab	0x80506c8	50	FUNC	<unknown>	DEFAULT	2
clock_getres.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x804c63c	46	FUNC	<unknown>	DEFAULT	2
close.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
closedir	.symtab	0x804c92c	112	FUNC	<unknown>	DEFAULT	2
closedir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
commServer	.symtab	0x805802c	4	OBJECT	<unknown>	DEFAULT	10
completed.2429	.symtab	0x8058580	1	OBJECT	<unknown>	DEFAULT	11
connect	.symtab	0x804e7e4	43	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connectTimeout	.symtab	0x8048e77	523	FUNC	<unknown>	DEFAULT	2
creat	.symtab	0x804c77b	25	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
csum	.symtab	0x8049187	159	FUNC	<unknown>	DEFAULT	2
currentServer	.symtab	0x805804c	4	OBJECT	<unknown>	DEFAULT	10
data_start	.symtab	0x8058028	0	NOTYPE	<unknown>	DEFAULT	10
decodea.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decpt_str	.symtab	0x805707c	2	OBJECT	<unknown>	DEFAULT	4
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dnslookup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ	.symtab	0x805e7ec	4	OBJECT	<unknown>	DEFAULT	11
errno	.symtab	0x805e800	4	OBJECT	<unknown>	DEFAULT	11
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x804ff70	103	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x8056fe0	156	OBJECT	<unknown>	DEFAULT	4
fclose	.symtab	0x804cb1c	271	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x804c518	87	FUNC	<unknown>	DEFAULT	2
fcntl64	.symtab	0x804c570	63	FUNC	<unknown>	DEFAULT	2
fdgets	.symtab	0x80482e7	111	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x804de2c	333	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x8052524	220	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x804dce4	98	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x804df7c	105	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fmt	.symtab	0x8056fbc	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x804cc2c	24	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0x804c66c	38	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs_unlocked	.symtab	0x804dfe8	49	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x8048110	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x804f591	412	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fscanf	.symtab	0x804dcc4	30	FUNC	<unknown>	DEFAULT	2
fscanf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x80535fc	27	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x80535fc	27	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x80536f0	231	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fstat	.symtab	0x80506fc	72	FUNC	<unknown>	DEFAULT	2
fstat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ftcp	.symtab	0x80496b4	1407	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked	.symtab	0x804e01c	120	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getArch	.symtab	0x804a741	10	FUNC	<unknown>	DEFAULT	2
getHost	.symtab	0x8048c15	55	FUNC	<unknown>	DEFAULT	2
getOurIP	.symtab	0x8048356	547	FUNC	<unknown>	DEFAULT	2
getPortz	.symtab	0x804a74b	154	FUNC	<unknown>	DEFAULT	2
getRandomIP	.symtab	0x80482bb	44	FUNC	<unknown>	DEFAULT	2
get_hosts_byname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
get_process_name	.symtab	0x804bedb	244	FUNC	<unknown>	DEFAULT	2
get_process_start_time	.symtab	0x804bcea	497	FUNC	<unknown>	DEFAULT	2
getc_unlocked	.symtab	0x8052524	220	FUNC	<unknown>	DEFAULT	2
getdents.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdents64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdtablesize	.symtab	0x80508c8	37	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x80508f0	38	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x8050918	38	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x8050940	38	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname	.symtab	0x804e480	48	FUNC	<unknown>	DEFAULT	2
gethostbyname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r	.symtab	0x804e4b0	818	FUNC	<unknown>	DEFAULT	2
gethostbyname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpagesize	.symtab	0x8050968	17	FUNC	<unknown>	DEFAULT	2
getpagesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x804c694	38	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x805097c	50	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockname	.symtab	0x804e810	43	FUNC	<unknown>	DEFAULT	2
getsockname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x804e83c	59	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x80509b0	38	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gotIP	.symtab	0x80585a4	4	OBJECT	<unknown>	DEFAULT	11
h.5161	.symtab	0x805e7cc	20	OBJECT	<unknown>	DEFAULT	11
h_errno	.symtab	0x805e804	4	OBJECT	<unknown>	DEFAULT	11
htonl	.symtab	0x804e3d9	7	FUNC	<unknown>	DEFAULT	2
htons	.symtab	0x804e3cc	13	FUNC	<unknown>	DEFAULT	2
i.4243	.symtab	0x8058054	4	OBJECT	<unknown>	DEFAULT	10
index	.symtab	0x804e0d4	30	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x804e458	37	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x80527cc	148	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa	.symtab	0x804e443	21	FUNC	<unknown>	DEFAULT	2
inet_ntoa.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa_r	.symtab	0x804e3f4	79	FUNC	<unknown>	DEFAULT	2
inet_ntop	.symtab	0x8053df9	465	FUNC	<unknown>	DEFAULT	2
inet_ntop4	.symtab	0x8053ce8	273	FUNC	<unknown>	DEFAULT	2
inet_pton	.symtab	0x8053b1e	458	FUNC	<unknown>	DEFAULT	2
inet_pton4	.symtab	0x8053a98	134	FUNC	<unknown>	DEFAULT	2
initConnection	.symtab	0x804b578	334	FUNC	<unknown>	DEFAULT	2
init_rand	.symtab	0x804818c	111	FUNC	<unknown>	DEFAULT	2
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initstate	.symtab	0x804f911	87	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x804fb3d	171	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x804c6bc	63	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
is_digit	.symtab	0x804bcac	62	FUNC	<unknown>	DEFAULT	2
is_port_open	.symtab	0x804c0b1	144	FUNC	<unknown>	DEFAULT	2
is_whitelisted	.symtab	0x804bfcf	124	FUNC	<unknown>	DEFAULT	2
isatty	.symtab	0x804e33c	29	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isspace	.symtab	0x804c8f8	17	FUNC	<unknown>	DEFAULT	2
isspace.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0x804c6fc	50	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill_process	.symtab	0x804c04b	51	FUNC	<unknown>	DEFAULT	2
killer.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
killer_main	.symtab	0x804c359	13	FUNC	<unknown>	DEFAULT	2
lengthd.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lengthq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/i386/crt1.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/i386/crti.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/i386/crtn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/i386/mmap.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libgcc2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
listFork	.symtab	0x8049082	261	FUNC	<unknown>	DEFAULT	2
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x80509d8	86	FUNC	<unknown>	DEFAULT	2
macAddress	.symtab	0x80585b0	6	OBJECT	<unknown>	DEFAULT	11
main	.symtab	0x804b6c6	1507	FUNC	<unknown>	DEFAULT	2
mainCommSock	.symtab	0x80585a0	4	OBJECT	<unknown>	DEFAULT	11
makeIPPacket	.symtab	0x80492de	132	FUNC	<unknown>	DEFAULT	2
makeRandomStr	.symtab	0x8048c4c	106	FUNC	<unknown>	DEFAULT	2
makevsepacket	.symtab	0x8049e75	151	FUNC	<unknown>	DEFAULT	2
malloc	.symtab	0x804eac6	1954	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
malloc_trim	.symtab	0x804f72d	34	FUNC	<unknown>	DEFAULT	2
mbrtowc	.symtab	0x80534f8	112	FUNC	<unknown>	DEFAULT	2
mbrtowc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mbsnrtowcs	.symtab	0x8053568	145	FUNC	<unknown>	DEFAULT	2
mbsnrtowcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mbstate.2775	.symtab	0x805e828	8	OBJECT	<unknown>	DEFAULT	11
mbstate.2775	.symtab	0x805e830	8	OBJECT	<unknown>	DEFAULT	11
memchr	.symtab	0x8052600	35	FUNC	<unknown>	DEFAULT	2
memchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memcpy	.symtab	0x804e094	39	FUNC	<unknown>	DEFAULT	2
memcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memmove	.symtab	0x8052624	39	FUNC	<unknown>	DEFAULT	2
memmove.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mempcpy	.symtab	0x8052674	33	FUNC	<unknown>	DEFAULT	2
mempcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memrchr	.symtab	0x8052698	176	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x804e0bc	21	FUNC	<unknown>	DEFAULT	2
memset.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mmap	.symtab	0x805063c	27	FUNC	<unknown>	DEFAULT	2
munmap	.symtab	0x8050a30	50	FUNC	<unknown>	DEFAULT	2
munmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mylock	.symtab	0x8058468	24	OBJECT	<unknown>	DEFAULT	10
mylock	.symtab	0x8058480	24	OBJECT	<unknown>	DEFAULT	10
mylock	.symtab	0x805e808	24	OBJECT	<unknown>	DEFAULT	11
nan_inf_str.2344	.symtab	0x8057130	21	OBJECT	<unknown>	DEFAULT	4
nan_inf_str.4543	.symtab	0x80570d9	11	OBJECT	<unknown>	DEFAULT	4
nanosleep	.symtab	0x8050a64	50	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
next_start.1278	.symtab	0x805e5e0	4	OBJECT	<unknown>	DEFAULT	11
nil_string	.symtab	0x80570d3	6	OBJECT	<unknown>	DEFAULT	4
ntohl	.symtab	0x804e3ed	7	FUNC	<unknown>	DEFAULT	2
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0x804e3e0	13	FUNC	<unknown>	DEFAULT	2
ntop.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
numpids	.symtab	0x80585a8	8	OBJECT	<unknown>	DEFAULT	11
object.2482	.symtab	0x8058584	24	OBJECT	<unknown>	DEFAULT	11
open	.symtab	0x804c730	75	FUNC	<unknown>	DEFAULT	2
open.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opendir	.symtab	0x804c99c	241	FUNC	<unknown>	DEFAULT	2
opendir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opennameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ourIP	.symtab	0x805e838	4	OBJECT	<unknown>	DEFAULT	11
p.2427	.symtab	0x8058024	0	OBJECT	<unknown>	DEFAULT	10
pids	.symtab	0x805e83c	4	OBJECT	<unknown>	DEFAULT	11
poll	.symtab	0x80534c0	54	FUNC	<unknown>	DEFAULT	2
poll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prctl	.symtab	0x804c794	63	FUNC	<unknown>	DEFAULT	2
prctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prefix.4371	.symtab	0x8056105	12	OBJECT	<unknown>	DEFAULT	4
print	.symtab	0x804887f	722	FUNC	<unknown>	DEFAULT	2
printchar	.symtab	0x8048624	66	FUNC	<unknown>	DEFAULT	2
printi	.symtab	0x8048740	319	FUNC	<unknown>	DEFAULT	2
prints	.symtab	0x8048666	218	FUNC	<unknown>	DEFAULT	2
processCmd	.symtab	0x804a7e5	3475	FUNC	<unknown>	DEFAULT	2
qual_chars	.symtab	0x8057082	18	OBJECT	<unknown>	DEFAULT	4
qual_chars.4377	.symtab	0x8056118	20	OBJECT	<unknown>	DEFAULT	4
raise	.symtab	0x8053224	24	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x804f864	5	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand_cmwc	.symtab	0x80481fb	192	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x804f86c	72	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x8056d20	40	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x804fa45	94	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randtbl	.symtab	0x80584c0	128	OBJECT	<unknown>	DEFAULT	10
rawmemchr	.symtab	0x80539c8	99	FUNC	<unknown>	DEFAULT	2
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read	.symtab	0x804c7d4	54	FUNC	<unknown>	DEFAULT	2
read.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read_etc_hosts_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
readdir	.symtab	0x804ca90	132	FUNC	<unknown>	DEFAULT	2
readdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recv	.symtab	0x804e878	51	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recvLine	.symtab	0x8048cb6	449	FUNC	<unknown>	DEFAULT	2
sbrk	.symtab	0x8050a98	78	FUNC	<unknown>	DEFAULT	2
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sc_getc	.symtab	0x8051e16	16	FUNC	<unknown>	DEFAULT	2
scan_getwc	.symtab	0x80516ac	152	FUNC	<unknown>	DEFAULT	2
select	.symtab	0x804c80c	63	FUNC	<unknown>	DEFAULT	2
select.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send	.symtab	0x804e8ac	51	FUNC	<unknown>	DEFAULT	2
send.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sendHTTPtwo	.symtab	0x804a592	431	FUNC	<unknown>	DEFAULT	2
sendto	.symtab	0x804e8e0	67	FUNC	<unknown>	DEFAULT	2
sendto.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsid	.symtab	0x804c84c	38	FUNC	<unknown>	DEFAULT	2
setsid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsockopt	.symtab	0x804e924	59	FUNC	<unknown>	DEFAULT	2
setsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate	.symtab	0x804f8b4	93	FUNC	<unknown>	DEFAULT	2
setstate_r	.symtab	0x804f9ac	153	FUNC	<unknown>	DEFAULT	2
sigaction	.symtab	0x805055f	218	FUNC	<unknown>	DEFAULT	2
sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
signal	.symtab	0x804e98c	175	FUNC	<unknown>	DEFAULT	2
signal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigprocmask	.symtab	0x8050ae8	85	FUNC	<unknown>	DEFAULT	2
sigprocmask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigsetops.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sleep	.symtab	0x804ffd8	393	FUNC	<unknown>	DEFAULT	2
sleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
snprintf	.symtab	0x804cc44	33	FUNC	<unknown>	DEFAULT	2
snprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket	.symtab	0x804e960	43	FUNC	<unknown>	DEFAULT	2
socket.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket_connect	.symtab	0x8049d77	254	FUNC	<unknown>	DEFAULT	2
sockprintf	.symtab	0x8048b51	196	FUNC	<unknown>	DEFAULT	2
spec_allowed	.symtab	0x80570b4	16	OBJECT	<unknown>	DEFAULT	4
spec_and_mask.4376	.symtab	0x805612c	16	OBJECT	<unknown>	DEFAULT	4
spec_base	.symtab	0x80570c4	15	OBJECT	<unknown>	DEFAULT	4
spec_base.4370	.symtab	0x8056111	7	OBJECT	<unknown>	DEFAULT	4
spec_chars	.symtab	0x8057094	23	OBJECT	<unknown>	DEFAULT	4
spec_chars.4373	.symtab	0x8056155	21	OBJECT	<unknown>	DEFAULT	4
spec_flags	.symtab	0x805707e	4	OBJECT	<unknown>	DEFAULT	4
spec_flags.4372	.symtab	0x805616a	8	OBJECT	<unknown>	DEFAULT	4
spec_or_mask.4375	.symtab	0x805613c	16	OBJECT	<unknown>	DEFAULT	4
spec_ranges	.symtab	0x80570ab	8	OBJECT	<unknown>	DEFAULT	4
spec_ranges.4374	.symtab	0x805614c	9	OBJECT	<unknown>	DEFAULT	4
sprintf	.symtab	0x804cc68	31	FUNC	<unknown>	DEFAULT	2
sprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
srand	.symtab	0x804f968	67	FUNC	<unknown>	DEFAULT	2
srandom	.symtab	0x804f968	67	FUNC	<unknown>	DEFAULT	2
srandom_r	.symtab	0x804faa3	154	FUNC	<unknown>	DEFAULT	2
static_id	.symtab	0x805855c	2	OBJECT	<unknown>	DEFAULT	10
static_ns	.symtab	0x805e820	4	OBJECT	<unknown>	DEFAULT	11
stderr	.symtab	0x8058300	4	OBJECT	<unknown>	DEFAULT	10
stdin	.symtab	0x80582f8	4	OBJECT	<unknown>	DEFAULT	10
stdout	.symtab	0x80582fc	4	OBJECT	<unknown>	DEFAULT	10
strcasecmp	.symtab	0x80545bc	54	FUNC	<unknown>	DEFAULT	2
strcasecmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchr	.symtab	0x804e0d4	30	FUNC	<unknown>	DEFAULT	2
strchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcmp	.symtab	0x804e0f4	29	FUNC	<unknown>	DEFAULT	2
strcmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcoll	.symtab	0x804e0f4	29	FUNC	<unknown>	DEFAULT	2
strcpy	.symtab	0x804e114	27	FUNC	<unknown>	DEFAULT	2
strcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strdup	.symtab	0x8053a60	54	FUNC	<unknown>	DEFAULT	2
strdup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strerror_r	.symtab	0x804e250	182	FUNC	<unknown>	DEFAULT	2
strlen	.symtab	0x804e130	19	FUNC	<unknown>	DEFAULT	2
strlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncat	.symtab	0x8053998	46	FUNC	<unknown>	DEFAULT	2
strncat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncpy	.symtab	0x805264c	38	FUNC	<unknown>	DEFAULT	2
strncpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strnlen	.symtab	0x804e144	25	FUNC	<unknown>	DEFAULT	2
strnlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strpbrk	.symtab	0x80527a4	39	FUNC	<unknown>	DEFAULT	2
strpbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strspn	.symtab	0x8053a2c	50	FUNC	<unknown>	DEFAULT	2
strspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strstr	.symtab	0x804e160	206	FUNC	<unknown>	DEFAULT	2
strstr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtoimax	.symtab	0x804fd50	26	FUNC	<unknown>	DEFAULT	2
strtok	.symtab	0x804e320	25	FUNC	<unknown>	DEFAULT	2
strtok.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok_r	.symtab	0x8052748	89	FUNC	<unknown>	DEFAULT	2
strtok_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtol	.symtab	0x804fbfc	26	FUNC	<unknown>	DEFAULT	2
strtol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtoll	.symtab	0x804fd50	26	FUNC	<unknown>	DEFAULT	2
strtoll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtoq	.symtab	0x804fd50	26	FUNC	<unknown>	DEFAULT	2
sysconf	.symtab	0x8050164	325	FUNC	<unknown>	DEFAULT	2
sysconf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcgetattr	.symtab	0x804e35c	112	FUNC	<unknown>	DEFAULT	2
tcgetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcpcsum	.symtab	0x8049226	184	FUNC	<unknown>	DEFAULT	2
time	.symtab	0x804c874	46	FUNC	<unknown>	DEFAULT	2
time.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tolower	.symtab	0x805459c	29	FUNC	<unknown>	DEFAULT	2
tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
toupper	.symtab	0x804c90c	29	FUNC	<unknown>	DEFAULT	2
toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
trim	.symtab	0x8048579	171	FUNC	<unknown>	DEFAULT	2
type_codes	.symtab	0x8056172	24	OBJECT	<unknown>	DEFAULT	4
type_sizes	.symtab	0x805618a	12	OBJECT	<unknown>	DEFAULT	4
ungetc	.symtab	0x8053618	214	FUNC	<unknown>	DEFAULT	2
ungetc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
unknown.1330	.symtab	0x8056196	14	OBJECT	<unknown>	DEFAULT	4
unsafe_state	.symtab	0x8058498	28	OBJECT	<unknown>	DEFAULT	10
useragents	.symtab	0x8058030	28	OBJECT	<unknown>	DEFAULT	10
usleep	.symtab	0x80502ac	48	FUNC	<unknown>	DEFAULT	2
usleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
vfscanf	.symtab	0x8051744	1746	FUNC	<unknown>	DEFAULT	2
vfscanf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
vseattack	.symtab	0x8049f0c	1239	FUNC	<unknown>	DEFAULT	2
vsnprintf	.symtab	0x804cc88	176	FUNC	<unknown>	DEFAULT	2
vsnprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wait4	.symtab	0x8050b40	59	FUNC	<unknown>	DEFAULT	2
wait4.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
waitpid	.symtab	0x804c8a4	26	FUNC	<unknown>	DEFAULT	2
waitpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcrtomb	.symtab	0x8050c94	69	FUNC	<unknown>	DEFAULT	2
wcrtomb.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsnrtombs	.symtab	0x8050cfc	133	FUNC	<unknown>	DEFAULT	2
wcsnrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsrtombs	.symtab	0x8050cdc	30	FUNC	<unknown>	DEFAULT	2
wcsrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
whitelist_pid_count	.symtab	0x805c5c4	4	OBJECT	<unknown>	DEFAULT	11
whitelist_size	.symtab	0x8055a90	4	OBJECT	<unknown>	DEFAULT	4
whitelisted_pids	.symtab	0x805c5c0	0	OBJECT	<unknown>	DEFAULT	11
whitelisted_processes	.symtab	0x8058060	648	OBJECT	<unknown>	DEFAULT	10
write	.symtab	0x804c8c0	54	FUNC	<unknown>	DEFAULT	2
write.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
xdigits.3285	.symtab	0x8057474	17	OBJECT	<unknown>	DEFAULT	4
xstatconv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-09T08:27:55.948648+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56202	89.33.192.138	6581	TCP
2025-01-09T08:28:05.363813+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56204	89.33.192.138	6581	TCP
2025-01-09T08:28:06.830131+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56206	89.33.192.138	6581	TCP
2025-01-09T08:28:13.768714+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56208	89.33.192.138	6581	TCP
2025-01-09T08:28:15.218673+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56210	89.33.192.138	6581	TCP
2025-01-09T08:28:19.155836+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56212	89.33.192.138	6581	TCP
2025-01-09T08:28:32.585467+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56214	89.33.192.138	6581	TCP
2025-01-09T08:28:46.024212+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56216	89.33.192.138	6581	TCP
2025-01-09T08:28:47.467534+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56218	89.33.192.138	6581	TCP
2025-01-09T08:28:48.924596+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56220	89.33.192.138	6581	TCP
2025-01-09T08:28:55.842157+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56222	89.33.192.138	6581	TCP
2025-01-09T08:28:57.279939+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56224	89.33.192.138	6581	TCP
2025-01-09T08:29:01.205689+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56226	89.33.192.138	6581	TCP
2025-01-09T08:29:08.123605+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56228	89.33.192.138	6581	TCP
2025-01-09T08:29:27.027663+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56230	89.33.192.138	6581	TCP
2025-01-09T08:29:28.487766+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56232	89.33.192.138	6581	TCP
2025-01-09T08:29:29.940294+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56234	89.33.192.138	6581	TCP
2025-01-09T08:29:31.396326+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56236	89.33.192.138	6581	TCP
2025-01-09T08:29:32.846475+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56238	89.33.192.138	6581	TCP
2025-01-09T08:29:34.295879+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56240	89.33.192.138	6581	TCP
2025-01-09T08:29:35.777190+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56242	89.33.192.138	6581	TCP
2025-01-09T08:29:37.217068+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56244	89.33.192.138	6581	TCP
2025-01-09T08:29:38.656216+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56246	89.33.192.138	6581	TCP
2025-01-09T08:29:40.093757+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56248	89.33.192.138	6581	TCP
2025-01-09T08:29:41.548778+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56250	89.33.192.138	6581	TCP
2025-01-09T08:29:43.001678+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56252	89.33.192.138	6581	TCP
2025-01-09T08:29:44.443182+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56254	89.33.192.138	6581	TCP
2025-01-09T08:29:45.909651+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56256	89.33.192.138	6581	TCP
2025-01-09T08:29:47.359024+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56258	89.33.192.138	6581	TCP
2025-01-09T08:29:48.796597+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56260	89.33.192.138	6581	TCP
2025-01-09T08:29:50.251450+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56262	89.33.192.138	6581	TCP
2025-01-09T08:29:51.703379+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56264	89.33.192.138	6581	TCP
2025-01-09T08:29:53.140353+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56266	89.33.192.138	6581	TCP
2025-01-09T08:29:54.578211+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56268	89.33.192.138	6581	TCP
2025-01-09T08:29:56.033221+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56270	89.33.192.138	6581	TCP
2025-01-09T08:29:57.486403+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56272	89.33.192.138	6581	TCP
2025-01-09T08:29:58.940442+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56274	89.33.192.138	6581	TCP
2025-01-09T08:30:00.410951+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56276	89.33.192.138	6581	TCP
2025-01-09T08:30:01.843864+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56278	89.33.192.138	6581	TCP
2025-01-09T08:30:03.298821+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56280	89.33.192.138	6581	TCP
2025-01-09T08:30:04.771741+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56282	89.33.192.138	6581	TCP
2025-01-09T08:30:06.229179+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56284	89.33.192.138	6581	TCP
2025-01-09T08:30:07.672562+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56286	89.33.192.138	6581	TCP
2025-01-09T08:30:09.109734+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56288	89.33.192.138	6581	TCP
2025-01-09T08:30:10.578676+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56290	89.33.192.138	6581	TCP
2025-01-09T08:30:12.016770+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56292	89.33.192.138	6581	TCP
2025-01-09T08:30:13.453239+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56294	89.33.192.138	6581	TCP
2025-01-09T08:30:14.927287+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56296	89.33.192.138	6581	TCP
2025-01-09T08:30:16.375652+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56298	89.33.192.138	6581	TCP
2025-01-09T08:30:17.812647+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56300	89.33.192.138	6581	TCP
2025-01-09T08:30:19.271682+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56302	89.33.192.138	6581	TCP
2025-01-09T08:30:20.720189+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56304	89.33.192.138	6581	TCP
2025-01-09T08:30:22.175194+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56306	89.33.192.138	6581	TCP
2025-01-09T08:30:23.647332+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56308	89.33.192.138	6581	TCP
2025-01-09T08:30:25.113179+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56310	89.33.192.138	6581	TCP
2025-01-09T08:30:26.563260+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56312	89.33.192.138	6581	TCP
2025-01-09T08:30:28.018003+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56314	89.33.192.138	6581	TCP
2025-01-09T08:30:29.475001+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56316	89.33.192.138	6581	TCP
2025-01-09T08:30:30.927016+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56318	89.33.192.138	6581	TCP
2025-01-09T08:30:32.429379+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56320	89.33.192.138	6581	TCP
2025-01-09T08:30:33.880720+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56322	89.33.192.138	6581	TCP
2025-01-09T08:30:35.313141+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56324	89.33.192.138	6581	TCP
2025-01-09T08:30:36.771353+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56326	89.33.192.138	6581	TCP
2025-01-09T08:30:38.224500+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56328	89.33.192.138	6581	TCP
2025-01-09T08:30:39.694590+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56330	89.33.192.138	6581	TCP
2025-01-09T08:30:41.141184+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56332	89.33.192.138	6581	TCP
2025-01-09T08:30:42.579928+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56334	89.33.192.138	6581	TCP
2025-01-09T08:30:44.037102+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56336	89.33.192.138	6581	TCP
2025-01-09T08:30:45.509210+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56338	89.33.192.138	6581	TCP
2025-01-09T08:30:46.955973+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56340	89.33.192.138	6581	TCP
2025-01-09T08:30:48.410918+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56342	89.33.192.138	6581	TCP
2025-01-09T08:30:49.853166+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56344	89.33.192.138	6581	TCP
2025-01-09T08:30:51.318334+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56346	89.33.192.138	6581	TCP
2025-01-09T08:30:52.769002+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56348	89.33.192.138	6581	TCP
2025-01-09T08:30:54.204221+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56350	89.33.192.138	6581	TCP
2025-01-09T08:30:55.695893+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56352	89.33.192.138	6581	TCP
2025-01-09T08:30:57.144173+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56354	89.33.192.138	6581	TCP
2025-01-09T08:30:58.580708+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56356	89.33.192.138	6581	TCP
2025-01-09T08:31:00.025069+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56358	89.33.192.138	6581	TCP
2025-01-09T08:31:01.474188+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56360	89.33.192.138	6581	TCP
2025-01-09T08:31:02.942107+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56362	89.33.192.138	6581	TCP
2025-01-09T08:31:04.409467+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56364	89.33.192.138	6581	TCP
2025-01-09T08:31:05.862892+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56366	89.33.192.138	6581	TCP
2025-01-09T08:31:07.319286+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56368	89.33.192.138	6581	TCP
2025-01-09T08:31:08.773151+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56370	89.33.192.138	6581	TCP
2025-01-09T08:31:10.223683+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56372	89.33.192.138	6581	TCP
2025-01-09T08:31:11.660814+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56374	89.33.192.138	6581	TCP
2025-01-09T08:31:13.117576+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56376	89.33.192.138	6581	TCP
2025-01-09T08:31:14.585358+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56378	89.33.192.138	6581	TCP
2025-01-09T08:31:16.035475+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56380	89.33.192.138	6581	TCP
2025-01-09T08:31:17.493748+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56382	89.33.192.138	6581	TCP
2025-01-09T08:31:18.963212+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56384	89.33.192.138	6581	TCP
2025-01-09T08:31:20.432021+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56386	89.33.192.138	6581	TCP
2025-01-09T08:31:21.879501+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56388	89.33.192.138	6581	TCP
2025-01-09T08:31:23.332807+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56390	89.33.192.138	6581	TCP
2025-01-09T08:31:24.770387+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56392	89.33.192.138	6581	TCP
2025-01-09T08:31:26.207662+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56394	89.33.192.138	6581	TCP
2025-01-09T08:31:27.663801+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56396	89.33.192.138	6581	TCP
2025-01-09T08:31:29.124407+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.14	56398	89.33.192.138	6581	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 9, 2025 08:27:55.943574905 CET	56202	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:27:55.948523045 CET	6581	56202	89.33.192.138	192.168.2.14
Jan 9, 2025 08:27:55.948585033 CET	56202	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:27:55.948647976 CET	56202	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:27:55.953485966 CET	6581	56202	89.33.192.138	192.168.2.14
Jan 9, 2025 08:28:05.357413054 CET	6581	56202	89.33.192.138	192.168.2.14
Jan 9, 2025 08:28:05.357724905 CET	56202	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:28:05.357769012 CET	56204	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:28:05.363706112 CET	6581	56202	89.33.192.138	192.168.2.14
Jan 9, 2025 08:28:05.363719940 CET	6581	56204	89.33.192.138	192.168.2.14
Jan 9, 2025 08:28:05.363775969 CET	56204	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:28:05.363812923 CET	56204	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:28:05.369235039 CET	6581	56204	89.33.192.138	192.168.2.14
Jan 9, 2025 08:28:06.824337006 CET	6581	56204	89.33.192.138	192.168.2.14
Jan 9, 2025 08:28:06.824528933 CET	56204	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:28:06.824574947 CET	56206	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:28:06.829997063 CET	6581	56204	89.33.192.138	192.168.2.14
Jan 9, 2025 08:28:06.830010891 CET	6581	56206	89.33.192.138	192.168.2.14
Jan 9, 2025 08:28:06.830112934 CET	56206	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:28:06.830131054 CET	56206	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:28:06.836035013 CET	6581	56206	89.33.192.138	192.168.2.14
Jan 9, 2025 08:28:13.763431072 CET	6581	56206	89.33.192.138	192.168.2.14
Jan 9, 2025 08:28:13.763695955 CET	56206	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:28:13.763782024 CET	56208	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:28:13.768486023 CET	6581	56206	89.33.192.138	192.168.2.14
Jan 9, 2025 08:28:13.768556118 CET	6581	56208	89.33.192.138	192.168.2.14
Jan 9, 2025 08:28:13.768650055 CET	56208	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:28:13.768713951 CET	56208	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:28:13.773734093 CET	6581	56208	89.33.192.138	192.168.2.14
Jan 9, 2025 08:28:15.213536978 CET	6581	56208	89.33.192.138	192.168.2.14
Jan 9, 2025 08:28:15.213716984 CET	56208	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:28:15.213752985 CET	56210	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:28:15.218535900 CET	6581	56208	89.33.192.138	192.168.2.14
Jan 9, 2025 08:28:15.218588114 CET	6581	56210	89.33.192.138	192.168.2.14
Jan 9, 2025 08:28:15.218648911 CET	56210	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:28:15.218672991 CET	56210	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:28:15.223455906 CET	6581	56210	89.33.192.138	192.168.2.14
Jan 9, 2025 08:28:19.150734901 CET	6581	56210	89.33.192.138	192.168.2.14
Jan 9, 2025 08:28:19.150875092 CET	56210	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:28:19.150881052 CET	56212	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:28:19.155729055 CET	6581	56210	89.33.192.138	192.168.2.14
Jan 9, 2025 08:28:19.155744076 CET	6581	56212	89.33.192.138	192.168.2.14
Jan 9, 2025 08:28:19.155814886 CET	56212	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:28:19.155836105 CET	56212	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:28:19.160600901 CET	6581	56212	89.33.192.138	192.168.2.14
Jan 9, 2025 08:28:32.580071926 CET	6581	56212	89.33.192.138	192.168.2.14
Jan 9, 2025 08:28:32.580313921 CET	56212	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:28:32.580373049 CET	56214	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:28:32.585335016 CET	6581	56212	89.33.192.138	192.168.2.14
Jan 9, 2025 08:28:32.585375071 CET	6581	56214	89.33.192.138	192.168.2.14
Jan 9, 2025 08:28:32.585433960 CET	56214	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:28:32.585467100 CET	56214	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:28:32.590305090 CET	6581	56214	89.33.192.138	192.168.2.14
Jan 9, 2025 08:28:46.019017935 CET	6581	56214	89.33.192.138	192.168.2.14
Jan 9, 2025 08:28:46.019136906 CET	56214	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:28:46.019164085 CET	56216	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:28:46.024036884 CET	6581	56214	89.33.192.138	192.168.2.14
Jan 9, 2025 08:28:46.024050951 CET	6581	56216	89.33.192.138	192.168.2.14
Jan 9, 2025 08:28:46.024194956 CET	56216	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:28:46.024211884 CET	56216	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:28:46.029009104 CET	6581	56216	89.33.192.138	192.168.2.14
Jan 9, 2025 08:28:47.462280035 CET	6581	56216	89.33.192.138	192.168.2.14
Jan 9, 2025 08:28:47.462488890 CET	56216	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:28:47.462587118 CET	56218	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:28:47.467282057 CET	6581	56216	89.33.192.138	192.168.2.14
Jan 9, 2025 08:28:47.467365980 CET	6581	56218	89.33.192.138	192.168.2.14
Jan 9, 2025 08:28:47.467447042 CET	56218	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:28:47.467534065 CET	56218	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:28:47.472265005 CET	6581	56218	89.33.192.138	192.168.2.14
Jan 9, 2025 08:28:48.919356108 CET	6581	56218	89.33.192.138	192.168.2.14
Jan 9, 2025 08:28:48.919512033 CET	56218	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:28:48.919564962 CET	56220	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:28:48.924436092 CET	6581	56218	89.33.192.138	192.168.2.14
Jan 9, 2025 08:28:48.924448013 CET	6581	56220	89.33.192.138	192.168.2.14
Jan 9, 2025 08:28:48.924596071 CET	56220	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:28:48.924596071 CET	56220	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:28:48.929446936 CET	6581	56220	89.33.192.138	192.168.2.14
Jan 9, 2025 08:28:55.836848974 CET	6581	56220	89.33.192.138	192.168.2.14
Jan 9, 2025 08:28:55.837105036 CET	56220	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:28:55.837147951 CET	56222	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:28:55.842003107 CET	6581	56220	89.33.192.138	192.168.2.14
Jan 9, 2025 08:28:55.842016935 CET	6581	56222	89.33.192.138	192.168.2.14
Jan 9, 2025 08:28:55.842086077 CET	56222	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:28:55.842156887 CET	56222	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:28:55.846921921 CET	6581	56222	89.33.192.138	192.168.2.14
Jan 9, 2025 08:28:57.274698019 CET	6581	56222	89.33.192.138	192.168.2.14
Jan 9, 2025 08:28:57.274919987 CET	56222	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:28:57.274981976 CET	56224	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:28:57.279748917 CET	6581	56222	89.33.192.138	192.168.2.14
Jan 9, 2025 08:28:57.279803991 CET	6581	56224	89.33.192.138	192.168.2.14
Jan 9, 2025 08:28:57.279875040 CET	56224	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:28:57.279938936 CET	56224	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:28:57.284703016 CET	6581	56224	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:01.200520039 CET	6581	56224	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:01.200701952 CET	56224	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:01.200737000 CET	56226	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:01.205566883 CET	6581	56224	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:01.205579042 CET	6581	56226	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:01.205656052 CET	56226	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:01.205688953 CET	56226	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:01.210422993 CET	6581	56226	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:08.118516922 CET	6581	56226	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:08.118662119 CET	56226	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:08.118716002 CET	56228	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:08.123400927 CET	6581	56226	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:08.123503923 CET	6581	56228	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:08.123569012 CET	56228	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:08.123605013 CET	56228	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:08.128340006 CET	6581	56228	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:27.022404909 CET	6581	56228	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:27.022593975 CET	56228	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:27.022643089 CET	56230	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:27.027491093 CET	6581	56228	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:27.027507067 CET	6581	56230	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:27.027616978 CET	56230	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:27.027662992 CET	56230	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:27.032526970 CET	6581	56230	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:28.482322931 CET	6581	56230	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:28.482666016 CET	56230	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:28.482690096 CET	56232	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:28.487554073 CET	6581	56230	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:28.487566948 CET	6581	56232	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:28.487766027 CET	56232	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:28.487766027 CET	56232	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:28.492654085 CET	6581	56232	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:29.935069084 CET	6581	56232	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:29.935286999 CET	56232	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:29.935328960 CET	56234	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:29.940159082 CET	6581	56232	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:29.940171003 CET	6581	56234	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:29.940246105 CET	56234	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:29.940294027 CET	56234	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:29.945030928 CET	6581	56234	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:31.391096115 CET	6581	56234	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:31.391299963 CET	56234	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:31.391334057 CET	56236	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:31.396189928 CET	6581	56234	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:31.396225929 CET	6581	56236	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:31.396296978 CET	56236	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:31.396326065 CET	56236	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:31.401092052 CET	6581	56236	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:32.841018915 CET	6581	56236	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:32.841342926 CET	56236	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:32.841342926 CET	56238	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:32.846324921 CET	6581	56236	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:32.846340895 CET	6581	56238	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:32.846441984 CET	56238	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:32.846474886 CET	56238	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:32.851305008 CET	6581	56238	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:34.290445089 CET	6581	56238	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:34.290714025 CET	56238	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:34.290733099 CET	56240	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:34.295725107 CET	6581	56238	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:34.295739889 CET	6581	56240	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:34.295845985 CET	56240	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:34.295878887 CET	56240	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:34.300646067 CET	6581	56240	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:35.771955013 CET	6581	56240	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:35.772180080 CET	56240	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:35.772222996 CET	56242	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:35.776979923 CET	6581	56240	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:35.777034998 CET	6581	56242	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:35.777138948 CET	56242	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:35.777189970 CET	56242	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:35.781928062 CET	6581	56242	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:37.211740971 CET	6581	56242	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:37.211927891 CET	56242	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:37.211952925 CET	56244	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:37.216876030 CET	6581	56242	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:37.216905117 CET	6581	56244	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:37.217045069 CET	56244	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:37.217067957 CET	56244	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:37.222035885 CET	6581	56244	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:38.650631905 CET	6581	56244	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:38.651006937 CET	56244	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:38.651029110 CET	56246	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:38.656014919 CET	6581	56244	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:38.656032085 CET	6581	56246	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:38.656117916 CET	56246	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:38.656215906 CET	56246	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:38.660959959 CET	6581	56246	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:40.088249922 CET	6581	56246	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:40.088555098 CET	56246	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:40.088630915 CET	56248	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:40.093400955 CET	6581	56246	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:40.093491077 CET	6581	56248	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:40.093641996 CET	56248	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:40.093756914 CET	56248	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:40.098501921 CET	6581	56248	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:41.543209076 CET	6581	56248	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:41.543657064 CET	56248	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:41.543803930 CET	56250	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:41.548480988 CET	6581	56248	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:41.548614025 CET	6581	56250	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:41.548703909 CET	56250	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:41.548778057 CET	56250	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:41.553508997 CET	6581	56250	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:42.996202946 CET	6581	56250	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:42.996514082 CET	56250	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:42.996623039 CET	56252	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:43.001418114 CET	6581	56250	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:43.001471043 CET	6581	56252	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:43.001621962 CET	56252	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:43.001677990 CET	56252	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:43.006437063 CET	6581	56252	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:44.431533098 CET	6581	56252	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:44.431972027 CET	56252	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:44.432060957 CET	56254	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:44.442962885 CET	6581	56252	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:44.443005085 CET	6581	56254	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:44.443104029 CET	56254	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:44.443181992 CET	56254	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:44.457612991 CET	6581	56254	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:45.902806997 CET	6581	56254	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:45.903168917 CET	56254	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:45.903213024 CET	56256	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:45.909528017 CET	6581	56254	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:45.909545898 CET	6581	56256	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:45.909610987 CET	56256	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:45.909651041 CET	56256	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:45.914489985 CET	6581	56256	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:47.353621006 CET	6581	56256	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:47.354000092 CET	56256	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:47.354053974 CET	56258	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:47.358824968 CET	6581	56256	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:47.358838081 CET	6581	56258	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:47.358949900 CET	56258	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:47.359024048 CET	56258	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:47.363892078 CET	6581	56258	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:48.791107893 CET	6581	56258	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:48.791424036 CET	56258	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:48.791465998 CET	56260	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:48.796359062 CET	6581	56258	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:48.796371937 CET	6581	56260	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:48.796556950 CET	56260	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:48.796597004 CET	56260	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:48.801402092 CET	6581	56260	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:50.246229887 CET	6581	56260	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:50.246437073 CET	56260	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:50.246468067 CET	56262	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:50.251324892 CET	6581	56260	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:50.251339912 CET	6581	56262	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:50.251450062 CET	56262	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:50.251450062 CET	56262	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:50.256288052 CET	6581	56262	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:51.698189020 CET	6581	56262	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:51.698362112 CET	56262	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:51.698405981 CET	56264	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:51.703130960 CET	6581	56262	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:51.703206062 CET	6581	56264	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:51.703308105 CET	56264	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:51.703378916 CET	56264	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:51.708188057 CET	6581	56264	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:53.134908915 CET	6581	56264	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:53.135292053 CET	56264	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:53.135415077 CET	56266	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:53.140104055 CET	6581	56264	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:53.140203953 CET	6581	56266	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:53.140352964 CET	56266	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:53.140352964 CET	56266	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:53.145169973 CET	6581	56266	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:54.572729111 CET	6581	56266	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:54.573015928 CET	56266	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:54.573118925 CET	56268	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:54.577868938 CET	6581	56266	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:54.577980042 CET	6581	56268	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:54.578103065 CET	56268	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:54.578211069 CET	56268	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:54.582967997 CET	6581	56268	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:56.027853966 CET	6581	56268	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:56.028076887 CET	56268	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:56.028153896 CET	56270	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:56.033015013 CET	6581	56268	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:56.033027887 CET	6581	56270	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:56.033162117 CET	56270	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:56.033221006 CET	56270	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:56.038017035 CET	6581	56270	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:57.480964899 CET	6581	56270	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:57.481319904 CET	56270	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:57.481374979 CET	56272	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:57.486211061 CET	6581	56270	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:57.486223936 CET	6581	56272	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:57.486336946 CET	56272	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:57.486402988 CET	56272	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:57.491163969 CET	6581	56272	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:58.934695005 CET	6581	56272	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:58.934927940 CET	56272	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:58.934962034 CET	56274	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:58.940174103 CET	6581	56272	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:58.940325022 CET	6581	56274	89.33.192.138	192.168.2.14
Jan 9, 2025 08:29:58.940406084 CET	56274	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:58.940442085 CET	56274	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:29:58.945450068 CET	6581	56274	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:00.405570984 CET	6581	56274	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:00.405816078 CET	56274	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:00.405858994 CET	56276	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:00.410782099 CET	6581	56274	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:00.410795927 CET	6581	56276	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:00.410906076 CET	56276	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:00.410950899 CET	56276	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:00.415730953 CET	6581	56276	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:01.838396072 CET	6581	56276	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:01.838758945 CET	56276	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:01.838758945 CET	56278	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:01.843739986 CET	6581	56276	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:01.843754053 CET	6581	56278	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:01.843822956 CET	56278	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:01.843863964 CET	56278	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:01.848628998 CET	6581	56278	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:03.293550968 CET	6581	56278	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:03.293782949 CET	56278	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:03.293840885 CET	56280	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:03.298667908 CET	6581	56278	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:03.298681021 CET	6581	56280	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:03.298763990 CET	56280	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:03.298820972 CET	56280	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:03.303559065 CET	6581	56280	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:04.766474962 CET	6581	56280	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:04.766683102 CET	56280	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:04.766735077 CET	56282	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:04.771627903 CET	6581	56280	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:04.771641016 CET	6581	56282	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:04.771707058 CET	56282	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:04.771740913 CET	56282	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:04.778070927 CET	6581	56282	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:06.217807055 CET	6581	56282	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:06.217988968 CET	56282	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:06.218010902 CET	56284	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:06.229011059 CET	6581	56282	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:06.229027987 CET	6581	56284	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:06.229149103 CET	56284	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:06.229178905 CET	56284	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:06.240545034 CET	6581	56284	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:07.667351007 CET	6581	56284	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:07.667560101 CET	56284	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:07.667603970 CET	56286	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:07.672431946 CET	6581	56284	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:07.672446012 CET	6581	56286	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:07.672523022 CET	56286	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:07.672561884 CET	56286	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:07.677427053 CET	6581	56286	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:09.104368925 CET	6581	56286	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:09.104572058 CET	56286	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:09.104594946 CET	56288	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:09.109493017 CET	6581	56286	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:09.109512091 CET	6581	56288	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:09.109652042 CET	56288	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:09.109734058 CET	56288	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:09.114500999 CET	6581	56288	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:10.573410034 CET	6581	56288	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:10.573605061 CET	56288	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:10.573653936 CET	56290	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:10.578500032 CET	6581	56288	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:10.578512907 CET	6581	56290	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:10.578623056 CET	56290	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:10.578675985 CET	56290	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:10.583417892 CET	6581	56290	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:12.011416912 CET	6581	56290	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:12.011643887 CET	56290	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:12.011702061 CET	56292	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:12.016530991 CET	6581	56290	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:12.016562939 CET	6581	56292	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:12.016670942 CET	56292	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:12.016769886 CET	56292	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:12.021672010 CET	6581	56292	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:13.447920084 CET	6581	56292	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:13.448090076 CET	56292	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:13.448133945 CET	56294	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:13.453073025 CET	6581	56292	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:13.453087091 CET	6581	56294	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:13.453223944 CET	56294	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:13.453238964 CET	56294	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:13.458065987 CET	6581	56294	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:14.921909094 CET	6581	56294	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:14.922204971 CET	56294	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:14.922260046 CET	56296	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:14.927143097 CET	6581	56294	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:14.927160025 CET	6581	56296	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:14.927241087 CET	56296	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:14.927287102 CET	56296	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:14.932142019 CET	6581	56296	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:16.370426893 CET	6581	56296	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:16.370641947 CET	56296	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:16.370676994 CET	56298	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:16.375516891 CET	6581	56296	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:16.375530958 CET	6581	56298	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:16.375624895 CET	56298	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:16.375652075 CET	56298	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:16.380484104 CET	6581	56298	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:17.807554007 CET	6581	56298	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:17.807691097 CET	56298	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:17.807734013 CET	56300	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:17.812496901 CET	6581	56298	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:17.812558889 CET	6581	56300	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:17.812613964 CET	56300	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:17.812647104 CET	56300	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:17.817394018 CET	6581	56300	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:19.266443968 CET	6581	56300	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:19.266598940 CET	56300	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:19.266598940 CET	56302	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:19.271564007 CET	6581	56300	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:19.271579981 CET	6581	56302	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:19.271661997 CET	56302	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:19.271682024 CET	56302	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:19.276508093 CET	6581	56302	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:20.714865923 CET	6581	56302	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:20.715065956 CET	56302	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:20.715079069 CET	56304	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:20.720036030 CET	6581	56302	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:20.720060110 CET	6581	56304	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:20.720153093 CET	56304	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:20.720189095 CET	56304	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:20.724975109 CET	6581	56304	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:22.170013905 CET	6581	56304	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:22.170176983 CET	56304	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:22.170224905 CET	56306	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:22.175081015 CET	6581	56304	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:22.175098896 CET	6581	56306	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:22.175156116 CET	56306	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:22.175194025 CET	56306	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:22.179976940 CET	6581	56306	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:23.641993046 CET	6581	56306	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:23.642261028 CET	56306	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:23.642335892 CET	56308	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:23.647152901 CET	6581	56306	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:23.647166014 CET	6581	56308	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:23.647270918 CET	56308	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:23.647331953 CET	56308	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:23.652098894 CET	6581	56308	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:25.107856989 CET	6581	56308	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:25.108134031 CET	56308	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:25.108194113 CET	56310	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:25.112984896 CET	6581	56308	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:25.112994909 CET	6581	56310	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:25.113089085 CET	56310	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:25.113178968 CET	56310	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:25.117979050 CET	6581	56310	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:26.557893038 CET	6581	56310	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:26.558274984 CET	56310	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:26.558326006 CET	56312	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:26.563085079 CET	6581	56310	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:26.563108921 CET	6581	56312	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:26.563199997 CET	56312	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:26.563260078 CET	56312	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:26.568108082 CET	6581	56312	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:28.012825012 CET	6581	56312	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:28.013025999 CET	56312	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:28.013082027 CET	56314	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:28.017843962 CET	6581	56312	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:28.017903090 CET	6581	56314	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:28.017962933 CET	56314	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:28.018002987 CET	56314	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:28.022850990 CET	6581	56314	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:29.469764948 CET	6581	56314	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:29.469929934 CET	56314	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:29.469953060 CET	56316	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:29.474873066 CET	6581	56314	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:29.474889994 CET	6581	56316	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:29.474975109 CET	56316	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:29.475001097 CET	56316	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:29.479746103 CET	6581	56316	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:30.921968937 CET	6581	56316	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:30.922115088 CET	56316	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:30.922146082 CET	56318	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:30.926917076 CET	6581	56316	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:30.926928043 CET	6581	56318	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:30.926983118 CET	56318	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:30.927016020 CET	56318	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:30.931759119 CET	6581	56318	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:32.424207926 CET	6581	56318	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:32.424382925 CET	56318	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:32.424427032 CET	56320	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:32.429169893 CET	6581	56318	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:32.429220915 CET	6581	56320	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:32.429362059 CET	56320	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:32.429378986 CET	56320	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:32.434209108 CET	6581	56320	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:33.875459909 CET	6581	56320	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:33.875693083 CET	56320	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:33.875786066 CET	56322	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:33.880465031 CET	6581	56320	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:33.880556107 CET	6581	56322	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:33.880664110 CET	56322	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:33.880719900 CET	56322	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:33.885533094 CET	6581	56322	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:35.307974100 CET	6581	56322	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:35.308136940 CET	56322	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:35.308178902 CET	56324	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:35.312975883 CET	6581	56322	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:35.312988997 CET	6581	56324	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:35.313141108 CET	56324	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:35.313141108 CET	56324	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:35.318001032 CET	6581	56324	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:36.766107082 CET	6581	56324	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:36.766412973 CET	56324	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:36.766442060 CET	56326	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:36.771241903 CET	6581	56324	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:36.771254063 CET	6581	56326	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:36.771327019 CET	56326	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:36.771353006 CET	56326	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:36.776118040 CET	6581	56326	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:38.219228983 CET	6581	56326	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:38.219446898 CET	56326	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:38.219484091 CET	56328	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:38.224337101 CET	6581	56326	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:38.224354029 CET	6581	56328	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:38.224478006 CET	56328	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:38.224499941 CET	56328	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:38.229335070 CET	6581	56328	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:39.689352036 CET	6581	56328	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:39.689631939 CET	56328	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:39.689685106 CET	56330	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:39.694478989 CET	6581	56328	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:39.694492102 CET	6581	56330	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:39.694590092 CET	56330	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:39.694590092 CET	56330	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:39.699424982 CET	6581	56330	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:41.136117935 CET	6581	56330	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:41.136251926 CET	56330	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:41.136317968 CET	56332	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:41.141030073 CET	6581	56330	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:41.141063929 CET	6581	56332	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:41.141141891 CET	56332	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:41.141184092 CET	56332	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:41.145977020 CET	6581	56332	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:42.574858904 CET	6581	56332	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:42.574985027 CET	56332	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:42.574985027 CET	56334	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:42.579833984 CET	6581	56332	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:42.579848051 CET	6581	56334	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:42.579926968 CET	56334	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:42.579927921 CET	56334	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:42.584698915 CET	6581	56334	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:44.031863928 CET	6581	56334	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:44.032047987 CET	56334	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:44.032094955 CET	56336	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:44.036982059 CET	6581	56334	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:44.036995888 CET	6581	56336	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:44.037070036 CET	56336	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:44.037101984 CET	56336	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:44.041960001 CET	6581	56336	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:45.500305891 CET	6581	56336	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:45.500613928 CET	56336	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:45.500613928 CET	56338	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:45.509067059 CET	6581	56336	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:45.509088039 CET	6581	56338	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:45.509195089 CET	56338	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:45.509210110 CET	56338	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:45.516772985 CET	6581	56338	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:46.950732946 CET	6581	56338	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:46.950990915 CET	56340	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:46.951001883 CET	56338	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:46.955857038 CET	6581	56338	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:46.955868959 CET	6581	56340	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:46.955938101 CET	56340	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:46.955972910 CET	56340	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:46.960844040 CET	6581	56340	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:48.405534029 CET	6581	56340	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:48.405760050 CET	56340	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:48.405796051 CET	56342	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:48.410772085 CET	6581	56340	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:48.410784960 CET	6581	56342	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:48.410887003 CET	56342	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:48.410917997 CET	56342	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:48.415709019 CET	6581	56342	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:49.847862959 CET	6581	56342	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:49.848169088 CET	56344	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:49.848170042 CET	56342	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:49.853003025 CET	6581	56344	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:49.853018999 CET	6581	56342	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:49.853125095 CET	56344	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:49.853166103 CET	56344	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:49.857902050 CET	6581	56344	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:51.313194036 CET	6581	56344	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:51.313442945 CET	56346	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:51.313458920 CET	56344	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:51.318232059 CET	6581	56346	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:51.318245888 CET	6581	56344	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:51.318320036 CET	56346	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:51.318334103 CET	56346	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:51.323079109 CET	6581	56346	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:52.763465881 CET	6581	56346	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:52.763905048 CET	56346	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:52.764029026 CET	56348	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:52.768699884 CET	6581	56346	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:52.768815041 CET	6581	56348	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:52.768904924 CET	56348	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:52.769001961 CET	56348	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:52.773823023 CET	6581	56348	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:54.198888063 CET	6581	56348	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:54.199183941 CET	56348	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:54.199248075 CET	56350	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:54.204046965 CET	6581	56348	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:54.204061031 CET	6581	56350	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:54.204138994 CET	56350	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:54.204221010 CET	56350	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:54.209002018 CET	6581	56350	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:55.690310955 CET	6581	56350	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:55.690850973 CET	56350	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:55.690958023 CET	56352	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:55.695657015 CET	6581	56350	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:55.695732117 CET	6581	56352	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:55.695825100 CET	56352	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:55.695893049 CET	56352	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:55.700664043 CET	6581	56352	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:57.138371944 CET	6581	56352	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:57.139039993 CET	56352	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:57.139095068 CET	56354	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:57.143944025 CET	6581	56352	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:57.143966913 CET	6581	56354	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:57.144072056 CET	56354	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:57.144172907 CET	56354	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:57.148993969 CET	6581	56354	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:58.575241089 CET	6581	56354	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:58.575567961 CET	56354	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:58.575680017 CET	56356	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:58.580396891 CET	6581	56354	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:58.580543041 CET	6581	56356	89.33.192.138	192.168.2.14
Jan 9, 2025 08:30:58.580672026 CET	56356	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:58.580708027 CET	56356	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:30:58.585478067 CET	6581	56356	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:00.019567966 CET	6581	56356	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:00.019984007 CET	56356	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:00.020077944 CET	56358	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:00.024897099 CET	6581	56356	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:00.024913073 CET	6581	56358	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:00.025001049 CET	56358	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:00.025068998 CET	56358	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:00.029829025 CET	6581	56358	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:01.468765974 CET	6581	56358	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:01.469046116 CET	56358	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:01.469124079 CET	56360	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:01.473997116 CET	6581	56358	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:01.474016905 CET	6581	56360	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:01.474143982 CET	56360	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:01.474188089 CET	56360	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:01.478954077 CET	6581	56360	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:02.936626911 CET	6581	56360	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:02.936944008 CET	56360	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:02.936989069 CET	56362	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:02.941927910 CET	6581	56360	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:02.941941977 CET	6581	56362	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:02.942035913 CET	56362	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:02.942106962 CET	56362	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:02.946945906 CET	6581	56362	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:04.404155970 CET	6581	56362	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:04.404493093 CET	56362	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:04.404551983 CET	56364	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:04.409292936 CET	6581	56362	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:04.409359932 CET	6581	56364	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:04.409446955 CET	56364	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:04.409466982 CET	56364	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:04.414175987 CET	6581	56364	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:05.857695103 CET	6581	56364	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:05.857918024 CET	56364	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:05.857956886 CET	56366	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:05.862725973 CET	6581	56364	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:05.862745047 CET	6581	56366	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:05.862865925 CET	56366	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:05.862891912 CET	56366	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:05.867680073 CET	6581	56366	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:07.313911915 CET	6581	56366	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:07.314244986 CET	56366	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:07.314287901 CET	56368	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:07.319119930 CET	6581	56366	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:07.319133997 CET	6581	56368	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:07.319233894 CET	56368	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:07.319286108 CET	56368	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:07.324078083 CET	6581	56368	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:08.767910004 CET	6581	56368	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:08.768110991 CET	56368	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:08.768160105 CET	56370	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:08.773030043 CET	6581	56368	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:08.773042917 CET	6581	56370	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:08.773118973 CET	56370	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:08.773150921 CET	56370	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:08.777955055 CET	6581	56370	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:10.218082905 CET	6581	56370	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:10.218616962 CET	56370	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:10.218699932 CET	56372	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:10.223418951 CET	6581	56370	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:10.223526001 CET	6581	56372	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:10.223683119 CET	56372	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:10.223683119 CET	56372	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:10.228494883 CET	6581	56372	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:11.655221939 CET	6581	56372	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:11.655816078 CET	56372	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:11.655885935 CET	56374	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:11.660617113 CET	6581	56372	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:11.660630941 CET	6581	56374	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:11.660696983 CET	56374	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:11.660814047 CET	56374	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:11.665551901 CET	6581	56374	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:13.112047911 CET	6581	56374	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:13.112499952 CET	56376	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:13.112505913 CET	56374	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:13.117358923 CET	6581	56374	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:13.117371082 CET	6581	56376	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:13.117575884 CET	56376	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:13.117575884 CET	56376	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:13.122358084 CET	6581	56376	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:14.579740047 CET	6581	56376	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:14.580261946 CET	56376	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:14.580261946 CET	56378	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:14.585176945 CET	6581	56376	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:14.585191965 CET	6581	56378	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:14.585357904 CET	56378	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:14.585357904 CET	56378	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:14.591306925 CET	6581	56378	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:16.030101061 CET	6581	56378	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:16.030436039 CET	56378	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:16.030483961 CET	56380	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:16.035339117 CET	6581	56378	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:16.035351992 CET	6581	56380	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:16.035409927 CET	56380	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:16.035475016 CET	56380	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:16.040230036 CET	6581	56380	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:17.486774921 CET	6581	56380	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:17.487138987 CET	56380	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:17.487200975 CET	56382	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:17.493558884 CET	6581	56380	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:17.493573904 CET	6581	56382	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:17.493700027 CET	56382	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:17.493747950 CET	56382	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:17.499392033 CET	6581	56382	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:18.958051920 CET	6581	56382	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:18.958235979 CET	56382	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:18.958264112 CET	56384	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:18.963068962 CET	6581	56382	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:18.963082075 CET	6581	56384	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:18.963177919 CET	56384	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:18.963212013 CET	56384	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:18.967963934 CET	6581	56384	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:20.426618099 CET	6581	56384	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:20.426995039 CET	56384	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:20.427083015 CET	56386	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:20.431809902 CET	6581	56384	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:20.431857109 CET	6581	56386	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:20.431940079 CET	56386	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:20.432020903 CET	56386	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:20.436861992 CET	6581	56386	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:21.874278069 CET	6581	56386	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:21.874469042 CET	56386	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:21.874545097 CET	56388	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:21.879357100 CET	6581	56386	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:21.879378080 CET	6581	56388	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:21.879437923 CET	56388	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:21.879501104 CET	56388	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:21.884258986 CET	6581	56388	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:23.327619076 CET	6581	56388	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:23.327796936 CET	56388	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:23.327845097 CET	56388	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:23.327924013 CET	56390	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:23.332626104 CET	6581	56388	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:23.332681894 CET	6581	56390	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:23.332736969 CET	56390	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:23.332807064 CET	56390	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:23.337583065 CET	6581	56390	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:24.765089035 CET	6581	56390	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:24.765281916 CET	56390	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:24.765362024 CET	56392	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:24.770153999 CET	6581	56390	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:24.770234108 CET	6581	56392	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:24.770320892 CET	56392	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:24.770386934 CET	56392	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:24.775268078 CET	6581	56392	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:26.202310085 CET	6581	56392	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:26.202500105 CET	56392	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:26.202544928 CET	56394	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:26.207489014 CET	6581	56392	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:26.207542896 CET	6581	56394	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:26.207617998 CET	56394	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:26.207662106 CET	56394	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:26.212465048 CET	6581	56394	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:27.657499075 CET	6581	56394	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:27.657804966 CET	56394	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:27.657838106 CET	56396	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:27.663098097 CET	6581	56394	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:27.663671017 CET	6581	56396	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:27.663762093 CET	56396	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:27.663800955 CET	56396	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:27.669333935 CET	6581	56396	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:29.119242907 CET	6581	56396	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:29.119374037 CET	56396	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:29.119406939 CET	56398	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:29.124293089 CET	6581	56396	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:29.124308109 CET	6581	56398	89.33.192.138	192.168.2.14
Jan 9, 2025 08:31:29.124381065 CET	56398	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:29.124407053 CET	56398	6581	192.168.2.14	89.33.192.138
Jan 9, 2025 08:31:29.129270077 CET	6581	56398	89.33.192.138	192.168.2.14

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 9, 2025 08:30:41.656966925 CET	40902	53	192.168.2.14	8.8.8.8
Jan 9, 2025 08:30:41.657021046 CET	34544	53	192.168.2.14	8.8.8.8
Jan 9, 2025 08:30:41.663743019 CET	53	34544	8.8.8.8	192.168.2.14
Jan 9, 2025 08:30:41.664097071 CET	53	40902	8.8.8.8	192.168.2.14

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 9, 2025 08:30:41.656966925 CET	192.168.2.14	8.8.8.8	0x9a4d	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 08:30:41.657021046 CET	192.168.2.14	8.8.8.8	0xb694	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 9, 2025 08:30:41.664097071 CET	8.8.8.8	192.168.2.14	0x9a4d	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false
Jan 9, 2025 08:30:41.664097071 CET	8.8.8.8	192.168.2.14	0x9a4d	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: ssi.elf PID: 5491, Parent PID: 5414

General

Start time (UTC):	07:27:55
Start date (UTC):	09/01/2025
Path:	/tmp/ssi.elf
Arguments:	/tmp/ssi.elf
File size:	95982 bytes
MD5 hash:	30694d958a9e2308817e320f254df07a

Chronological Activities

Analysis Process: ssi.elf PID: 5492, Parent PID: 5491

General

Start time (UTC):	07:27:55
Start date (UTC):	09/01/2025
Path:	/tmp/ssi.elf
Arguments:	-
File size:	95982 bytes
MD5 hash:	30694d958a9e2308817e320f254df07a

Chronological Activities

Analysis Process: ssi.elf PID: 5493, Parent PID: 5492

General

Start time (UTC):	07:27:55
Start date (UTC):	09/01/2025
Path:	/tmp/ssi.elf
Arguments:	-
File size:	95982 bytes
MD5 hash:	30694d958a9e2308817e320f254df07a

Description:	Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping or `net view` using Net .
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report ssi.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Threatname: Gafgyt

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: ssi.elf PID: 5491, Parent PID: 5414

General

Chronological Activities

Analysis Process: ssi.elf PID: 5492, Parent PID: 5491

General

Chronological Activities

Analysis Process: ssi.elf PID: 5493, Parent PID: 5492

General

Linux Analysis Report
ssi.elf