Edit tour

Linux Analysis Report
ss.elf

Overview

General Information

Sample name:	ss.elf
Analysis ID:	1586485
MD5:	d7612a30f87510c9dc2a7058b535e086
SHA1:	f8e29c34a4d608a42b6ee5b0e4155c02ef4a163d
SHA256:	9a9dabc7e7049bbe769862a4f3ddfc65b6ba294a048d41b95588a8a6dd68c56e
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai, Gafgyt

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Detected Mirai

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Gafgyt

Contains symbols with names commonly found in malware

Machine Learning detection for sample

Opens /proc/net/* files useful for finding connected devices and routers

Detected TCP or UDP traffic on non-standard ports

Sample contains strings that are user agent strings indicative of HTTP manipulation

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1586485
Start date and time:	2025-01-09 08:27:21 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	ss.elf
Detection:	MAL
Classification:	mal100.spre.troj.linELF@0/0@2/0

Runtime Messages

Command:	/tmp/ss.elf
PID:	5545
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

ss.elf (PID: 5545, Parent: 5470, MD5: d7612a30f87510c9dc2a7058b535e086) Arguments: /tmp/ss.elf

ss.elf New Fork (PID: 5546, Parent: 5545)

ss.elf New Fork (PID: 5547, Parent: 5546)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
ss.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
ss.elf	Linux_Trojan_Gafgyt_c573932b	unknown	unknown	0x7eb:$a: 83 7D 18 00 74 22 8B 45 1C 83 E0 02 85 C0 74 18 83 EC 08 6A 2D FF
ss.elf	Linux_Trojan_Gafgyt_6122acdf	unknown	unknown	0x570:$a: E8 B0 00 FC 8B 7D E8 F2 AE 89 C8 F7 D0 48 48 89 45 F8 EB 03 FF
ss.elf	Linux_Trojan_Gafgyt_7167d08f	unknown	unknown	0x888:$a: 0C 8A 00 3C 2D 75 13 FF 45 0C C7 45 E4 01 00 00 00 EB 07 FF
ss.elf	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0x76d4:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83

Memory Dumps

Source	Rule	Description	Author	Strings
5545.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Gafgyt_c573932b	unknown	unknown	0x7eb:$a: 83 7D 18 00 74 22 8B 45 1C 83 E0 02 85 C0 74 18 83 EC 08 6A 2D FF
5545.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Gafgyt_6122acdf	unknown	unknown	0x570:$a: E8 B0 00 FC 8B 7D E8 F2 AE 89 C8 F7 D0 48 48 89 45 F8 EB 03 FF
5545.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Gafgyt_7167d08f	unknown	unknown	0x888:$a: 0C 8A 00 3C 2D 75 13 FF 45 0C C7 45 E4 01 00 00 00 EB 07 FF
5546.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Gafgyt_c573932b	unknown	unknown	0x7eb:$a: 83 7D 18 00 74 22 8B 45 1C 83 E0 02 85 C0 74 18 83 EC 08 6A 2D FF
5546.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Gafgyt_6122acdf	unknown	unknown	0x570:$a: E8 B0 00 FC 8B 7D E8 F2 AE 89 C8 F7 D0 48 48 89 45 F8 EB 03 FF
5546.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Gafgyt_7167d08f	unknown	unknown	0x888:$a: 0C 8A 00 3C 2D 75 13 FF 45 0C C7 45 E4 01 00 00 00 EB 07 FF
5546.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0x76d4:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
5545.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0x76d4:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
Click to see the 3 entries

Suricata Signatures

ETPRO MALWARE ELF/Mirai Variant CnC Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-09T08:28:01.698611+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38228	89.33.192.138	6581	TCP
2025-01-09T08:28:03.139565+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38230	89.33.192.138	6581	TCP
2025-01-09T08:28:04.593289+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38232	89.33.192.138	6581	TCP
2025-01-09T08:28:06.046356+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38234	89.33.192.138	6581	TCP
2025-01-09T08:28:19.459745+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38236	89.33.192.138	6581	TCP
2025-01-09T08:28:38.366435+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38238	89.33.192.138	6581	TCP
2025-01-09T08:28:47.764167+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38240	89.33.192.138	6581	TCP
2025-01-09T08:28:49.201594+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38242	89.33.192.138	6581	TCP
2025-01-09T08:29:10.601554+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38244	89.33.192.138	6581	TCP
2025-01-09T08:29:12.046992+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38246	89.33.192.138	6581	TCP
2025-01-09T08:29:25.493975+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38248	89.33.192.138	6581	TCP
2025-01-09T08:29:26.956247+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38250	89.33.192.138	6581	TCP
2025-01-09T08:29:28.407856+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38252	89.33.192.138	6581	TCP
2025-01-09T08:29:29.861728+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38254	89.33.192.138	6581	TCP
2025-01-09T08:29:31.311811+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38256	89.33.192.138	6581	TCP
2025-01-09T08:29:32.769118+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38258	89.33.192.138	6581	TCP
2025-01-09T08:29:34.218175+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38260	89.33.192.138	6581	TCP
2025-01-09T08:29:35.655974+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38262	89.33.192.138	6581	TCP
2025-01-09T08:29:37.093029+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38264	89.33.192.138	6581	TCP
2025-01-09T08:29:38.548168+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38266	89.33.192.138	6581	TCP
2025-01-09T08:29:40.000116+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38268	89.33.192.138	6581	TCP
2025-01-09T08:29:41.458546+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38270	89.33.192.138	6581	TCP
2025-01-09T08:29:42.927972+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38272	89.33.192.138	6581	TCP
2025-01-09T08:29:44.407959+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38274	89.33.192.138	6581	TCP
2025-01-09T08:29:45.859881+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38276	89.33.192.138	6581	TCP
2025-01-09T08:29:47.333764+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38278	89.33.192.138	6581	TCP
2025-01-09T08:29:48.784126+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38280	89.33.192.138	6581	TCP
2025-01-09T08:29:50.234080+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38282	89.33.192.138	6581	TCP
2025-01-09T08:29:51.690925+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38284	89.33.192.138	6581	TCP
2025-01-09T08:29:53.141549+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38286	89.33.192.138	6581	TCP
2025-01-09T08:29:54.614964+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38288	89.33.192.138	6581	TCP
2025-01-09T08:29:56.060979+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38290	89.33.192.138	6581	TCP
2025-01-09T08:29:57.535081+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38292	89.33.192.138	6581	TCP
2025-01-09T08:29:58.984744+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38294	89.33.192.138	6581	TCP
2025-01-09T08:30:00.421255+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38296	89.33.192.138	6581	TCP
2025-01-09T08:30:01.878992+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38298	89.33.192.138	6581	TCP
2025-01-09T08:30:03.328549+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38300	89.33.192.138	6581	TCP
2025-01-09T08:30:04.786483+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38302	89.33.192.138	6581	TCP
2025-01-09T08:30:06.246296+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38304	89.33.192.138	6581	TCP
2025-01-09T08:30:07.708098+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38306	89.33.192.138	6581	TCP
2025-01-09T08:30:09.156325+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38308	89.33.192.138	6581	TCP
2025-01-09T08:30:10.611437+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38310	89.33.192.138	6581	TCP
2025-01-09T08:30:12.047360+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38312	89.33.192.138	6581	TCP
2025-01-09T08:30:13.506452+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38314	89.33.192.138	6581	TCP
2025-01-09T08:30:14.953471+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38316	89.33.192.138	6581	TCP
2025-01-09T08:30:16.410393+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38318	89.33.192.138	6581	TCP
2025-01-09T08:30:17.879435+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38320	89.33.192.138	6581	TCP
2025-01-09T08:30:19.332442+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38322	89.33.192.138	6581	TCP
2025-01-09T08:30:20.782335+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38324	89.33.192.138	6581	TCP
2025-01-09T08:30:22.238810+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38326	89.33.192.138	6581	TCP
2025-01-09T08:30:23.690058+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38328	89.33.192.138	6581	TCP
2025-01-09T08:30:25.125737+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38330	89.33.192.138	6581	TCP
2025-01-09T08:30:26.582536+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38332	89.33.192.138	6581	TCP
2025-01-09T08:30:28.031416+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38334	89.33.192.138	6581	TCP
2025-01-09T08:30:29.488326+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38336	89.33.192.138	6581	TCP
2025-01-09T08:30:30.944791+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38338	89.33.192.138	6581	TCP
2025-01-09T08:30:32.407763+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38340	89.33.192.138	6581	TCP
2025-01-09T08:30:33.846476+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38342	89.33.192.138	6581	TCP
2025-01-09T08:30:35.301220+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38344	89.33.192.138	6581	TCP
2025-01-09T08:30:36.754146+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38346	89.33.192.138	6581	TCP
2025-01-09T08:30:38.209764+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38348	89.33.192.138	6581	TCP
2025-01-09T08:30:39.659936+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38350	89.33.192.138	6581	TCP
2025-01-09T08:30:41.113814+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38352	89.33.192.138	6581	TCP
2025-01-09T08:30:42.549425+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38354	89.33.192.138	6581	TCP
2025-01-09T08:30:44.009800+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38356	89.33.192.138	6581	TCP
2025-01-09T08:30:45.458629+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38358	89.33.192.138	6581	TCP
2025-01-09T08:30:46.910433+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38360	89.33.192.138	6581	TCP
2025-01-09T08:30:48.346000+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38362	89.33.192.138	6581	TCP
2025-01-09T08:30:49.850304+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38364	89.33.192.138	6581	TCP
2025-01-09T08:30:51.299641+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38366	89.33.192.138	6581	TCP
2025-01-09T08:30:52.771846+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38368	89.33.192.138	6581	TCP
2025-01-09T08:30:54.242658+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38370	89.33.192.138	6581	TCP
2025-01-09T08:30:55.692406+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38372	89.33.192.138	6581	TCP
2025-01-09T08:30:57.144648+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38374	89.33.192.138	6581	TCP
2025-01-09T08:30:58.599633+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38376	89.33.192.138	6581	TCP
2025-01-09T08:31:00.033597+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38378	89.33.192.138	6581	TCP
2025-01-09T08:31:01.488732+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38380	89.33.192.138	6581	TCP
2025-01-09T08:31:02.942342+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38382	89.33.192.138	6581	TCP
2025-01-09T08:31:04.413236+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38384	89.33.192.138	6581	TCP
2025-01-09T08:31:05.864498+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38386	89.33.192.138	6581	TCP
2025-01-09T08:31:07.344842+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38388	89.33.192.138	6581	TCP
2025-01-09T08:31:08.802876+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38390	89.33.192.138	6581	TCP
2025-01-09T08:31:10.256349+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38392	89.33.192.138	6581	TCP
2025-01-09T08:31:11.708944+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38394	89.33.192.138	6581	TCP
2025-01-09T08:31:13.144588+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38396	89.33.192.138	6581	TCP
2025-01-09T08:31:14.602115+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38398	89.33.192.138	6581	TCP
2025-01-09T08:31:16.053596+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38400	89.33.192.138	6581	TCP
2025-01-09T08:31:17.507138+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38402	89.33.192.138	6581	TCP
2025-01-09T08:31:18.960211+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38404	89.33.192.138	6581	TCP
2025-01-09T08:31:20.423196+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38406	89.33.192.138	6581	TCP
2025-01-09T08:31:21.864867+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38408	89.33.192.138	6581	TCP
2025-01-09T08:31:23.338209+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38410	89.33.192.138	6581	TCP
2025-01-09T08:31:24.789600+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38412	89.33.192.138	6581	TCP
2025-01-09T08:31:26.240888+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38414	89.33.192.138	6581	TCP
2025-01-09T08:31:27.709790+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38416	89.33.192.138	6581	TCP
2025-01-09T08:31:29.163103+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38418	89.33.192.138	6581	TCP
2025-01-09T08:31:30.612926+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38420	89.33.192.138	6581	TCP
2025-01-09T08:31:32.070891+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38422	89.33.192.138	6581	TCP
2025-01-09T08:31:33.522354+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38424	89.33.192.138	6581	TCP
2025-01-09T08:31:34.984267+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.15	38426	89.33.192.138	6581	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: ss.elf

Avira: detected

Found malware configuration

Source: ss.elf

Malware Configuration Extractor: Gafgyt {"C2 url": "89.33.192.138:6581"}

Multi AV Scanner detection for submitted file

Source: ss.elf	Virustotal: Detection: 62%			Perma Link
Source: ss.elf	ReversingLabs: Detection: 68%

Machine Learning detection for sample

Source: ss.elf

Joe Sandbox ML: detected

Spreading

Opens /proc/net/* files useful for finding connected devices and routers

Source: /tmp/ss.elf (PID: 5545)

Opens: /proc/net/route

Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38234 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38258 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38248 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38228 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38266 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38240 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38272 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38278 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38242 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38238 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38284 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38294 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38286 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38246 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38290 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38260 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38322 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38330 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38320 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38250 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38328 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38252 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38270 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38314 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38362 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38236 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38298 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38372 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38332 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38326 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38402 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38420 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38256 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38344 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38342 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38318 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38388 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38422 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38374 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38312 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38348 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38244 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38386 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38276 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38302 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38392 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38396 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38308 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38232 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38408 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38282 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38336 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38380 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38368 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38356 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38382 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38360 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38426 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38324 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38274 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38304 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38352 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38358 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38416 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38378 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38264 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38350 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38334 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38340 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38288 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38366 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38410 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38370 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38384 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38310 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38390 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38292 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38354 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38230 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38400 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38262 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38254 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38414 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38376 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38300 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38406 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38268 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38306 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38316 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38338 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38424 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38418 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38412 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38280 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38296 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38404 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38398 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38346 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38394 -> 89.33.192.138:6581
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.15:38364 -> 89.33.192.138:6581

Source: global traffic

TCP traffic: 192.168.2.15:38228 -> 89.33.192.138:6581

Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

System Summary

Malicious sample detected (through community Yara rule)

Source: ss.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_c573932b Author: unknown
Source: ss.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_6122acdf Author: unknown
Source: ss.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_7167d08f Author: unknown
Source: ss.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 5545.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_c573932b Author: unknown
Source: 5545.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6122acdf Author: unknown
Source: 5545.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_7167d08f Author: unknown
Source: 5546.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_c573932b Author: unknown
Source: 5546.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6122acdf Author: unknown
Source: 5546.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_7167d08f Author: unknown
Source: 5546.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 5545.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown

Contains symbols with names commonly found in malware

Source: ELF static info symbol of initial sample

Name: vseattack

Source: ss.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_c573932b reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 18a3025ebb8af46605970ee8d7d18214854b86200001d576553e102cb71df266, id = c573932b-9b3f-4ab7-a6b6-32dcc7473790, last_modified = 2021-09-16
Source: ss.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_6122acdf os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 283275705c729be23d7dc75056388ecae00390bd25ee7b66b0cfc9b85feee212, id = 6122acdf-1eef-45ea-83ea-699d21c2dc20, last_modified = 2021-09-16
Source: ss.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_7167d08f reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = b9df4ab322a2a329168f684b07b7b05ee3d03165c5b9050a4710eae7aeca6cd9, id = 7167d08f-bfeb-4d78-9783-3a1df2ef0ed3, last_modified = 2021-09-16
Source: ss.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 5545.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_c573932b reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 18a3025ebb8af46605970ee8d7d18214854b86200001d576553e102cb71df266, id = c573932b-9b3f-4ab7-a6b6-32dcc7473790, last_modified = 2021-09-16
Source: 5545.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6122acdf os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 283275705c729be23d7dc75056388ecae00390bd25ee7b66b0cfc9b85feee212, id = 6122acdf-1eef-45ea-83ea-699d21c2dc20, last_modified = 2021-09-16
Source: 5545.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_7167d08f reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = b9df4ab322a2a329168f684b07b7b05ee3d03165c5b9050a4710eae7aeca6cd9, id = 7167d08f-bfeb-4d78-9783-3a1df2ef0ed3, last_modified = 2021-09-16
Source: 5546.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_c573932b reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 18a3025ebb8af46605970ee8d7d18214854b86200001d576553e102cb71df266, id = c573932b-9b3f-4ab7-a6b6-32dcc7473790, last_modified = 2021-09-16
Source: 5546.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6122acdf os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 283275705c729be23d7dc75056388ecae00390bd25ee7b66b0cfc9b85feee212, id = 6122acdf-1eef-45ea-83ea-699d21c2dc20, last_modified = 2021-09-16
Source: 5546.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_7167d08f reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = b9df4ab322a2a329168f684b07b7b05ee3d03165c5b9050a4710eae7aeca6cd9, id = 7167d08f-bfeb-4d78-9783-3a1df2ef0ed3, last_modified = 2021-09-16
Source: 5546.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 5545.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26

Source: classification engine

Classification label: mal100.spre.troj.linELF@0/0@2/0

Source: ss.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/i386/crt1.S
Source: ss.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/i386/crti.S
Source: ss.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/i386/crtn.S
Source: ss.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/i386/mmap.S

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match

File source: ss.elf, type: SAMPLE

Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.71 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36

Remote Access Functionality

Detected Mirai

Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin

Yara detected Gafgyt

Source: Yara match

File source: ss.elf, type: SAMPLE

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	OS Credential Dumping	1 Remote System Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

Threatname: Gafgyt

{"C2 url": "89.33.192.138:6581"}

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
ss.elf	62%	Virustotal		Browse
ss.elf	68%	ReversingLabs	Linux.Trojan.Gafgyt
ss.elf	100%	Avira	EXP/ELF.Mirai.Z
ss.elf	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.25	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
89.33.192.138:6581	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
89.33.192.138	unknown	Romania		9009	M247GB	true

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
89.33.192.138	ssl.elf	Get hash	malicious	Gafgyt	Browse
	sss.elf	Get hash	malicious	Gafgyt	Browse
	ssb.elf	Get hash	malicious	Gafgyt	Browse
	ssx.elf	Get hash	malicious	Gafgyt	Browse
	ssg.elf	Get hash	malicious	Mirai, Gafgyt	Browse
	ssp.elf	Get hash	malicious	Gafgyt	Browse
	ssc.elf	Get hash	malicious	Gafgyt	Browse
	sst.elf	Get hash	malicious	Gafgyt	Browse
	ssy.elf	Get hash	malicious	Gafgyt	Browse
	ssd.elf	Get hash	malicious	Gafgyt	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	sss.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.25
	ssb.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.24
	ssg.elf	Get hash	malicious	Mirai, Gafgyt	Browse	162.213.35.24
	ssp.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.25
	ssc.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.24
	ssy.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.25
	ssd.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.25
	ssh.elf	Get hash	malicious	Mirai, Gafgyt	Browse	162.213.35.24
	Fantazy.mips.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	watchdog.elf	Get hash	malicious	Xmrig	Browse	162.213.35.25

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
M247GB	ssl.elf	Get hash	malicious	Gafgyt	Browse	89.33.192.138
	sss.elf	Get hash	malicious	Gafgyt	Browse	89.33.192.138
	ssb.elf	Get hash	malicious	Gafgyt	Browse	89.33.192.138
	ssx.elf	Get hash	malicious	Gafgyt	Browse	89.33.192.138
	ssg.elf	Get hash	malicious	Mirai, Gafgyt	Browse	89.33.192.138
	ssp.elf	Get hash	malicious	Gafgyt	Browse	89.33.192.138
	ssc.elf	Get hash	malicious	Gafgyt	Browse	89.33.192.138
	sst.elf	Get hash	malicious	Gafgyt	Browse	89.33.192.138
	ssy.elf	Get hash	malicious	Gafgyt	Browse	89.33.192.138
	ssd.elf	Get hash	malicious	Gafgyt	Browse	89.33.192.138

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	6.4254814212696125
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	ss.elf
File size:	92'046 bytes
MD5:	d7612a30f87510c9dc2a7058b535e086
SHA1:	f8e29c34a4d608a42b6ee5b0e4155c02ef4a163d
SHA256:	9a9dabc7e7049bbe769862a4f3ddfc65b6ba294a048d41b95588a8a6dd68c56e
SHA512:	2255ef5c6fce4040da8c897672af78b000a41be93b182ee1558ce042886831866ae07f51bfc4fbf633ba953ccdae5945dc30ef6b6edf8fcd32887e94aa10b446
SSDEEP:	1536:oTfepUvU5S1awHRoZJfeeYI+s8LCw9HbQfzgeVJYCuAAxcW7efTcgZvYV:oToUvU52HRoZpeevbFWOUeVgxcW7ef45
TLSH:	A5934B46BB41CAB3D18316B616E75B210132F97B1A1BDF49F32C7CF49A560C8B623B58
File Content Preview:	.ELF....................d...4...D.......4. ...(.........................................................\|l..........Q.td............................U..S............h........[]...$.............U......=@....t..5...................u........t....h.p..........

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8048164
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	69188
Section Header Size:	40
Number of Section Headers:	25
Header String Table Index:	22

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x8048094	0x94	0x1c	0x0	0x6	AX	0	0	1
.text	PROGBITS	0x80480b0	0xb0	0xc338	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x80543e8	0xc3e8	0x17	0x0	0x6	AX	0	0	1
.rodata	PROGBITS	0x8054400	0xc400	0x2ca2	0x0	0x2	A	0	0	32
.eh_frame	PROGBITS	0x80570a4	0xf0a4	0x4	0x0	0x2	A	0	0	4
.ctors	PROGBITS	0x80580a8	0xf0a8	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x80580b0	0xf0b0	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x80580b8	0xf0b8	0x4	0x0	0x3	WA	0	0	4
.got.plt	PROGBITS	0x80580bc	0xf0bc	0xc	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x80580e0	0xf0e0	0x560	0x0	0x3	WA	0	0	32
.bss	NOBITS	0x8058640	0xf640	0x66e4	0x0	0x3	WA	0	0	32
.comment	PROGBITS	0x0	0xf640	0xca8	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x102e8	0x20	0x0	0x0		0	0	1
.debug_pubnames	PROGBITS	0x0	0x10308	0x1f	0x0	0x0		0	0	1
.debug_info	PROGBITS	0x0	0x10327	0x340	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x10667	0x164	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x107cb	0xc8	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x10894	0x34	0x0	0x0		0	0	4
.debug_str	PROGBITS	0x0	0x108c8	0x13e	0x1	0x30	MS	0	0	1
.debug_loc	PROGBITS	0x0	0x10a06	0x2f9	0x0	0x0		0	0	1
.debug_ranges	PROGBITS	0x0	0x10cff	0x60	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x10d5f	0xe5	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x1122c	0x30b0	0x10	0x0		24	296	4
.strtab	STRTAB	0x0	0x142dc	0x24b2	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8048000	0x8048000	0xf0a8	0xf0a8	6.6445	0x5	R E	0x1000	.init .text .fini .rodata .eh_frame
LOAD	0xf0a8	0x80580a8	0x80580a8	0x598	0x6c7c	4.5124	0x6	RW	0x1000	.ctors .dtors .jcr .got.plt .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x8048094	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80480b0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x80543e8	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x8054400	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x80570a4	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x80580a8	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x80580b0	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x80580b8	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x80580bc	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x80580e0	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x8058640	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	19
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	20
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	21
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	22
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	23
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	24
C.111.5152	.symtab	0x80548c0	96	OBJECT	<unknown>	DEFAULT	4
Q	.symtab	0x8058680	16384	OBJECT	<unknown>	DEFAULT	11
SendHTTPHex	.symtab	0x804a1f1	351	FUNC	<unknown>	DEFAULT	2
SendSTDHEX	.symtab	0x8049a9b	292	FUNC	<unknown>	DEFAULT	2
SendUDP	.symtab	0x8049221	815	FUNC	<unknown>	DEFAULT	2
_GLOBAL_OFFSET_TABLE_	.symtab	0x80580bc	0	OBJECT	<unknown>	HIDDEN	9
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x80580ac	0	OBJECT	<unknown>	DEFAULT	6
__CTOR_LIST__	.symtab	0x80580a8	0	OBJECT	<unknown>	DEFAULT	6
__C_ctype_b	.symtab	0x80583a8	4	OBJECT	<unknown>	DEFAULT	10
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x80556e0	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x8058638	4	OBJECT	<unknown>	DEFAULT	10
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x8056d60	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x80583b0	4	OBJECT	<unknown>	DEFAULT	10
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x80559e0	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x80580b4	0	OBJECT	<unknown>	DEFAULT	7
__DTOR_LIST__	.symtab	0x80580b0	0	OBJECT	<unknown>	DEFAULT	7
__EH_FRAME_BEGIN__	.symtab	0x80570a4	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x80570a4	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x80583a8	4	OBJECT	<unknown>	HIDDEN	10
__GI___C_ctype_b_data	.symtab	0x80556e0	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_tolower	.symtab	0x8058638	4	OBJECT	<unknown>	HIDDEN	10
__GI___C_ctype_tolower_data	.symtab	0x8056d60	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_toupper	.symtab	0x80583b0	4	OBJECT	<unknown>	HIDDEN	10
__GI___C_ctype_toupper_data	.symtab	0x80559e0	768	OBJECT	<unknown>	HIDDEN	4
__GI___ctype_b	.symtab	0x80583ac	4	OBJECT	<unknown>	HIDDEN	10
__GI___ctype_tolower	.symtab	0x805863c	4	OBJECT	<unknown>	HIDDEN	10
__GI___ctype_toupper	.symtab	0x80583b4	4	OBJECT	<unknown>	HIDDEN	10
__GI___errno_location	.symtab	0x804c7f4	6	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x8052160	220	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x804dec4	29	FUNC	<unknown>	HIDDEN	2
__GI___h_errno_location	.symtab	0x80508e0	6	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x804c1f8	87	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl64	.symtab	0x804c250	63	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x804c410	75	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x804ff30	63	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x804ffa7	64	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x804dee4	183	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x804c290	40	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x804f3b8	273	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x804f850	20	FUNC	<unknown>	HIDDEN	2
__GI_atol	.symtab	0x804f850	20	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x80530ac	54	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0x804c2ec	46	FUNC	<unknown>	HIDDEN	2
__GI_clock_getres	.symtab	0x8050314	50	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x804c31c	46	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0x804c60c	112	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x804e478	43	FUNC	<unknown>	HIDDEN	2
__GI_errno	.symtab	0x805e8c0	4	OBJECT	<unknown>	HIDDEN	11
__GI_exit	.symtab	0x804fbc4	103	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x804c7fc	265	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x804c1f8	87	FUNC	<unknown>	HIDDEN	2
__GI_fcntl64	.symtab	0x804c250	63	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x804dad8	321	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x8052160	220	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x804d990	98	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x804dc1c	105	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x804c908	24	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x804c34c	38	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x804dc88	51	FUNC	<unknown>	HIDDEN	2
__GI_fscanf	.symtab	0x804d970	30	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x8053238	27	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x8053324	227	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x8050348	72	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x804dcbc	116	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x8052160	220	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x8050514	37	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x805053c	38	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x8050564	38	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x805058c	38	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname	.symtab	0x804e114	48	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x804e144	818	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x80505b4	19	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x804c374	38	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x80505c8	50	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x804e4a4	43	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x80505fc	38	FUNC	<unknown>	HIDDEN	2
__GI_h_errno	.symtab	0x805e8c4	4	OBJECT	<unknown>	HIDDEN	11
__GI_inet_addr	.symtab	0x804e0ec	37	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x8052408	148	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa	.symtab	0x804e0d7	21	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa_r	.symtab	0x804e088	79	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x8053a10	462	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x805373e	458	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x804f7a2	171	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x804c39c	63	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x804dfd0	29	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x804c3dc	50	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x8050624	95	FUNC	<unknown>	HIDDEN	2
__GI_mbrtowc	.symtab	0x8053134	111	FUNC	<unknown>	HIDDEN	2
__GI_mbsnrtowcs	.symtab	0x80531a4	145	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x805223c	35	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x804dd30	39	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x8052260	39	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x80522b0	33	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x80522d4	176	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x804dd58	21	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x8050288	27	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x8050684	50	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x80506b8	50	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x804c410	75	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0x804c67c	241	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x80530fc	54	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x8052e60	24	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x804f4d4	72	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x804f6ad	95	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x80535e8	99	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x804c4b4	54	FUNC	<unknown>	HIDDEN	2
__GI_readdir	.symtab	0x804c770	132	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x804e50c	51	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x80506ec	78	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x804c4ec	63	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x804e540	51	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x804e574	67	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x804c52c	38	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x804e5b8	59	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x804f614	153	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x80501af	217	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x804e620	175	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x805073c	85	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x804fc2c	393	FUNC	<unknown>	HIDDEN	2
__GI_snprintf	.symtab	0x804c920	33	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x804e5f4	43	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x804c944	31	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x804f70c	150	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x80541d8	54	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x804dd70	30	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x804dd90	29	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x804dd90	29	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x804ddb0	27	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x8053680	54	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x804ddcc	19	FUNC	<unknown>	HIDDEN	2
__GI_strncat	.symtab	0x80535b8	46	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x8052288	38	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x804dde0	25	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x80523e0	39	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x805364c	50	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x804ddfc	198	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x804dfb4	25	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x8052384	89	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x804f864	26	FUNC	<unknown>	HIDDEN	2
__GI_strtoll	.symtab	0x804f9ac	26	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x804fdb8	325	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x804dff0	112	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x804c554	46	FUNC	<unknown>	HIDDEN	2
__GI_tolower	.symtab	0x80541b8	29	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x804c5ec	29	FUNC	<unknown>	HIDDEN	2
__GI_ungetc	.symtab	0x8053254	207	FUNC	<unknown>	HIDDEN	2
__GI_vfscanf	.symtab	0x80513ac	1722	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x804c964	178	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x8050794	59	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x804c584	26	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x80508e8	68	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x805094c	134	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x805092c	30	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x804c5a0	54	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x80580b8	0	OBJECT	<unknown>	DEFAULT	8
__JCR_LIST__	.symtab	0x80580b8	0	OBJECT	<unknown>	DEFAULT	8
__app_fini	.symtab	0x805e8b4	4	OBJECT	<unknown>	HIDDEN	11
__atexit_lock	.symtab	0x8058600	24	OBJECT	<unknown>	DEFAULT	10
__bsd_signal	.symtab	0x804e620	175	FUNC	<unknown>	HIDDEN	2
__bss_start	.symtab	0x8058640	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x804ff73	52	FUNC	<unknown>	DEFAULT	2
__ctype_b	.symtab	0x80583ac	4	OBJECT	<unknown>	DEFAULT	10
__ctype_tolower	.symtab	0x805863c	4	OBJECT	<unknown>	DEFAULT	10
__ctype_toupper	.symtab	0x80583b4	4	OBJECT	<unknown>	DEFAULT	10
__curbrk	.symtab	0x805e8e4	4	OBJECT	<unknown>	HIDDEN	11
__data_start	.symtab	0x80580e8	0	NOTYPE	<unknown>	DEFAULT	10
__decode_answer	.symtab	0x8053db4	249	FUNC	<unknown>	HIDDEN	2
__decode_dotted	.symtab	0x80542a0	215	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x8053c94	171	FUNC	<unknown>	HIDDEN	2
__deregister_frame_info_bases	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__divdi3	.symtab	0x804c060	407	FUNC	<unknown>	DEFAULT	2
__dns_lookup	.symtab	0x805249c	1876	FUNC	<unknown>	HIDDEN	2
__do_global_ctors_aux	.symtab	0x80543c0	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x80480c0	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x80580e0	0	OBJECT	<unknown>	HIDDEN	10
__encode_dotted	.symtab	0x8054210	144	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x8053be0	177	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x8053d40	83	FUNC	<unknown>	HIDDEN	2
__environ	.symtab	0x805e8ac	4	OBJECT	<unknown>	DEFAULT	11
__errno_location	.symtab	0x804c7f4	6	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x805e8a4	4	OBJECT	<unknown>	HIDDEN	11
__fgetc_unlocked	.symtab	0x8052160	220	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x80580a8	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fini_array_start	.symtab	0x80580a8	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__get_hosts_byname_r	.symtab	0x8052e34	44	FUNC	<unknown>	HIDDEN	2
__get_pc_thunk_bx	.symtab	0x80480b0	0	FUNC	<unknown>	HIDDEN	2
__getdents	.symtab	0x8050390	111	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x8050400	276	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x80505b4	19	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x804dec4	29	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__h_errno_location	.symtab	0x80508e0	6	FUNC	<unknown>	DEFAULT	2
__h_errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__init_array_end	.symtab	0x80580a8	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__init_array_start	.symtab	0x80580a8	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__init_scan_cookie	.symtab	0x8051a78	72	FUNC	<unknown>	HIDDEN	2
__length_dotted	.symtab	0x8054378	65	FUNC	<unknown>	HIDDEN	2
__length_question	.symtab	0x8053d94	30	FUNC	<unknown>	HIDDEN	2
__libc_close	.symtab	0x804c31c	46	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x804e478	43	FUNC	<unknown>	DEFAULT	2
__libc_creat	.symtab	0x804c45b	25	FUNC	<unknown>	DEFAULT	2
__libc_fcntl	.symtab	0x804c1f8	87	FUNC	<unknown>	DEFAULT	2
__libc_fcntl64	.symtab	0x804c250	63	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x804c34c	38	FUNC	<unknown>	DEFAULT	2
__libc_getpid	.symtab	0x804c374	38	FUNC	<unknown>	DEFAULT	2
__libc_lseek64	.symtab	0x8050624	95	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0x80506b8	50	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x804c410	75	FUNC	<unknown>	DEFAULT	2
__libc_poll	.symtab	0x80530fc	54	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x804c4b4	54	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x804e50c	51	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x804c4ec	63	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x804e540	51	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x804e574	67	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x80501af	217	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x805e8a8	4	OBJECT	<unknown>	DEFAULT	11
__libc_waitpid	.symtab	0x804c584	26	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x804c5a0	54	FUNC	<unknown>	DEFAULT	2
__malloc_consolidate	.symtab	0x804f051	424	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x804e734	38	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x8058510	24	OBJECT	<unknown>	DEFAULT	10
__malloc_state	.symtab	0x805e980	888	OBJECT	<unknown>	DEFAULT	11
__malloc_trim	.symtab	0x804efc4	141	FUNC	<unknown>	DEFAULT	2
__nameserver	.symtab	0x805ed08	12	OBJECT	<unknown>	HIDDEN	11
__nameservers	.symtab	0x805ed14	4	OBJECT	<unknown>	HIDDEN	11
__open_etc_hosts	.symtab	0x8053eb0	49	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x8052bf0	579	FUNC	<unknown>	HIDDEN	2
__pagesize	.symtab	0x805e8b0	4	OBJECT	<unknown>	DEFAULT	11
__preinit_array_end	.symtab	0x80580a8	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__preinit_array_start	.symtab	0x80580a8	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__psfs_do_numeric	.symtab	0x8051cf4	1129	FUNC	<unknown>	HIDDEN	2
__psfs_do_numeric.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__psfs_parse_spec	.symtab	0x8051b34	447	FUNC	<unknown>	HIDDEN	2
__psfs_parse_spec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__pthread_initialize_minimal	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0x804ff6f	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x804ff6f	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x804ff6f	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x804ff6f	3	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x804ff6f	3	FUNC	<unknown>	DEFAULT	2
__pthread_return_void	.symtab	0x804ff72	1	FUNC	<unknown>	DEFAULT	2
__raise	.symtab	0x8052e60	24	FUNC	<unknown>	HIDDEN	2
__read_etc_hosts_r	.symtab	0x8053ee1	724	FUNC	<unknown>	HIDDEN	2
__register_frame_info_bases	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__resolv_lock	.symtab	0x8058620	24	OBJECT	<unknown>	DEFAULT	10
__restore	.symtab	0x80501a7	0	NOTYPE	<unknown>	DEFAULT	2
__restore_rt	.symtab	0x80501a0	0	NOTYPE	<unknown>	DEFAULT	2
__rtld_fini	.symtab	0x805e8b8	4	OBJECT	<unknown>	HIDDEN	11
__scan_cookie.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__scan_getc	.symtab	0x8051ac0	80	FUNC	<unknown>	HIDDEN	2
__scan_ungetc	.symtab	0x8051b10	36	FUNC	<unknown>	HIDDEN	2
__searchdomain	.symtab	0x805ecf8	16	OBJECT	<unknown>	HIDDEN	11
__searchdomains	.symtab	0x805ed18	4	OBJECT	<unknown>	HIDDEN	11
__sigaddset	.symtab	0x804e6f4	32	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x804e714	32	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x804e6d0	36	FUNC	<unknown>	DEFAULT	2
__socketcall	.symtab	0x80502a4	50	FUNC	<unknown>	HIDDEN	2
__socketcall.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__stdin	.symtab	0x80583c4	4	OBJECT	<unknown>	DEFAULT	10
__stdio_READ	.symtab	0x8053408	68	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x80509d4	126	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x805344c	168	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x8050a54	240	FUNC	<unknown>	HIDDEN	2
__stdio_init_mutex	.symtab	0x804cca9	23	FUNC	<unknown>	HIDDEN	2
__stdio_mutex_initializer.3991	.symtab	0x8055ce0	24	OBJECT	<unknown>	DEFAULT	4
__stdio_rfill	.symtab	0x80534f4	40	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x8053584	51	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x805351c	101	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x8050b44	158	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x804cd48	43	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x80583c8	4	OBJECT	<unknown>	DEFAULT	10
__strtofpmax	.symtab	0x8052e78	541	FUNC	<unknown>	HIDDEN	2
__strtofpmax.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_error	.symtab	0x80530e4	21	FUNC	<unknown>	HIDDEN	2
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_rt_sigaction	.symtab	0x80502d8	59	FUNC	<unknown>	HIDDEN	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uClibc_fini	.symtab	0x804ff30	63	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x804ffa7	64	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x804ffe7	441	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x8058618	4	OBJECT	<unknown>	HIDDEN	10
__xpg_strerror_r	.symtab	0x804dee4	183	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__xstat64_conv	.symtab	0x80507d0	146	FUNC	<unknown>	HIDDEN	2
__xstat_conv	.symtab	0x8050862	125	FUNC	<unknown>	HIDDEN	2
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_charpad	.symtab	0x804cd74	54	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_dl_aux_init	.symtab	0x8053098	18	FUNC	<unknown>	DEFAULT	2
_dl_phdr	.symtab	0x805ed1c	4	OBJECT	<unknown>	DEFAULT	11
_dl_phnum	.symtab	0x805ed20	4	OBJECT	<unknown>	DEFAULT	11
_edata	.symtab	0x8058640	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x805ed24	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_errno	.symtab	0x805e8c0	4	OBJECT	<unknown>	DEFAULT	11
_exit	.symtab	0x804c290	40	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x80543e8	3	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x805c6a0	8192	OBJECT	<unknown>	DEFAULT	11
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x804cdaa	106	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x8050d50	1476	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_h_errno	.symtab	0x805e8c4	4	OBJECT	<unknown>	DEFAULT	11
_init	.symtab	0x8048094	3	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x8050be4	86	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_init	.symtab	0x804d3bc	111	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x804d5a9	966	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x804d42c	66	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x804d470	271	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x804d580	41	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x804ff72	1	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x804ff72	1	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_sigintr	.symtab	0x805e900	128	OBJECT	<unknown>	HIDDEN	11
_start	.symtab	0x8048164	34	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x804ca18	559	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x804cc48	97	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x80583cc	4	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_add_lock	.symtab	0x80583d0	24	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_dec_use	.symtab	0x804d9f4	228	FUNC	<unknown>	DEFAULT	2
_stdio_openlist_del_count	.symtab	0x805c68c	4	OBJECT	<unknown>	DEFAULT	11
_stdio_openlist_del_lock	.symtab	0x80583e8	24	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_use_count	.symtab	0x805c688	4	OBJECT	<unknown>	DEFAULT	11
_stdio_streams	.symtab	0x8058420	240	OBJECT	<unknown>	DEFAULT	10
_stdio_term	.symtab	0x804ccc0	136	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x8058400	4	OBJECT	<unknown>	DEFAULT	10
_stdlib_strto_l	.symtab	0x804f880	277	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdlib_strto_ll	.symtab	0x804f9c8	508	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_ll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x8050c3c	61	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x8055dc0	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x8050c7c	209	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x804ce14	1448	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x804f3b8	273	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
access	.symtab	0x804c2b8	50	FUNC	<unknown>	DEFAULT	2
access.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
advanced_kill_process	.symtab	0x804bd8b	51	FUNC	<unknown>	DEFAULT	2
atoi	.symtab	0x804f850	20	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x804f850	20	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
atoll	.symtab	0x804f998	20	FUNC	<unknown>	DEFAULT	2
atoll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bcopy	.symtab	0x804df9c	21	FUNC	<unknown>	DEFAULT	2
bcopy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
been_there_done_that	.symtab	0x805e8a0	1	OBJECT	<unknown>	DEFAULT	11
been_there_done_that.2832	.symtab	0x805e8bc	1	OBJECT	<unknown>	DEFAULT	11
bot.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
brk	.symtab	0x80530ac	54	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x804e620	175	FUNC	<unknown>	DEFAULT	2
buf.2658	.symtab	0x805e6a4	16	OBJECT	<unknown>	DEFAULT	11
buf.4993	.symtab	0x805e6c0	460	OBJECT	<unknown>	DEFAULT	11
c	.symtab	0x8058110	4	OBJECT	<unknown>	DEFAULT	10
calloc	.symtab	0x804eed0	244	FUNC	<unknown>	DEFAULT	2
calloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
change_process_name_based_on_port	.symtab	0x804be47	158	FUNC	<unknown>	DEFAULT	2
chdir	.symtab	0x804c2ec	46	FUNC	<unknown>	DEFAULT	2
chdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
check_and_kill_processes	.symtab	0x804bee5	366	FUNC	<unknown>	DEFAULT	2
clock_getres	.symtab	0x8050314	50	FUNC	<unknown>	DEFAULT	2
clock_getres.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x804c31c	46	FUNC	<unknown>	DEFAULT	2
close.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
closedir	.symtab	0x804c60c	112	FUNC	<unknown>	DEFAULT	2
closedir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
commServer	.symtab	0x80580ec	4	OBJECT	<unknown>	DEFAULT	10
completed.2429	.symtab	0x8058640	1	OBJECT	<unknown>	DEFAULT	11
connect	.symtab	0x804e478	43	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connectTimeout	.symtab	0x8048d6c	456	FUNC	<unknown>	DEFAULT	2
creat	.symtab	0x804c45b	25	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
csum	.symtab	0x8049040	168	FUNC	<unknown>	DEFAULT	2
currentServer	.symtab	0x805810c	4	OBJECT	<unknown>	DEFAULT	10
data_start	.symtab	0x80580e8	0	NOTYPE	<unknown>	DEFAULT	10
decodea.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decpt_str	.symtab	0x8056c7c	2	OBJECT	<unknown>	DEFAULT	4
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dnslookup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ	.symtab	0x805e8ac	4	OBJECT	<unknown>	DEFAULT	11
errno	.symtab	0x805e8c0	4	OBJECT	<unknown>	DEFAULT	11
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x804fbc4	103	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x8056be0	156	OBJECT	<unknown>	DEFAULT	4
fclose	.symtab	0x804c7fc	265	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x804c1f8	87	FUNC	<unknown>	DEFAULT	2
fcntl64	.symtab	0x804c250	63	FUNC	<unknown>	DEFAULT	2
fdgets	.symtab	0x80482e7	104	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x804dad8	321	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x8052160	220	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x804d990	98	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x804dc1c	105	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fmt	.symtab	0x8056bbc	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x804c908	24	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0x804c34c	38	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs_unlocked	.symtab	0x804dc88	51	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x8048110	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x804f1f9	412	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fscanf	.symtab	0x804d970	30	FUNC	<unknown>	DEFAULT	2
fscanf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x8053238	27	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x8053238	27	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x8053324	227	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fstat	.symtab	0x8050348	72	FUNC	<unknown>	DEFAULT	2
fstat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ftcp	.symtab	0x8049550	1355	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked	.symtab	0x804dcbc	116	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getArch	.symtab	0x804a4af	10	FUNC	<unknown>	DEFAULT	2
getHost	.symtab	0x8048b3e	59	FUNC	<unknown>	DEFAULT	2
getOurIP	.symtab	0x804834f	521	FUNC	<unknown>	DEFAULT	2
getPortz	.symtab	0x804a4b9	146	FUNC	<unknown>	DEFAULT	2
getRandomIP	.symtab	0x80482b7	48	FUNC	<unknown>	DEFAULT	2
get_hosts_byname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
get_process_name	.symtab	0x804bbf3	233	FUNC	<unknown>	DEFAULT	2
get_process_start_time	.symtab	0x804ba0b	488	FUNC	<unknown>	DEFAULT	2
getc_unlocked	.symtab	0x8052160	220	FUNC	<unknown>	DEFAULT	2
getdents.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdents64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdtablesize	.symtab	0x8050514	37	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x805053c	38	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x8050564	38	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x805058c	38	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname	.symtab	0x804e114	48	FUNC	<unknown>	DEFAULT	2
gethostbyname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r	.symtab	0x804e144	818	FUNC	<unknown>	DEFAULT	2
gethostbyname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpagesize	.symtab	0x80505b4	19	FUNC	<unknown>	DEFAULT	2
getpagesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x804c374	38	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x80505c8	50	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockname	.symtab	0x804e4a4	43	FUNC	<unknown>	DEFAULT	2
getsockname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x804e4d0	59	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x80505fc	38	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gotIP	.symtab	0x8058664	4	OBJECT	<unknown>	DEFAULT	11
h.4992	.symtab	0x805e88c	20	OBJECT	<unknown>	DEFAULT	11
h_errno	.symtab	0x805e8c4	4	OBJECT	<unknown>	DEFAULT	11
htonl	.symtab	0x804e06c	7	FUNC	<unknown>	DEFAULT	2
htons	.symtab	0x804e060	12	FUNC	<unknown>	DEFAULT	2
i.4243	.symtab	0x8058114	4	OBJECT	<unknown>	DEFAULT	10
index	.symtab	0x804dd70	30	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x804e0ec	37	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x8052408	148	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa	.symtab	0x804e0d7	21	FUNC	<unknown>	DEFAULT	2
inet_ntoa.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa_r	.symtab	0x804e088	79	FUNC	<unknown>	DEFAULT	2
inet_ntop	.symtab	0x8053a10	462	FUNC	<unknown>	DEFAULT	2
inet_ntop4	.symtab	0x8053908	264	FUNC	<unknown>	DEFAULT	2
inet_pton	.symtab	0x805373e	458	FUNC	<unknown>	DEFAULT	2
inet_pton4	.symtab	0x80536b8	134	FUNC	<unknown>	DEFAULT	2
initConnection	.symtab	0x804b2b5	309	FUNC	<unknown>	DEFAULT	2
init_rand	.symtab	0x8048188	111	FUNC	<unknown>	DEFAULT	2
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initstate	.symtab	0x804f579	87	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x804f7a2	171	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x804c39c	63	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
is_digit	.symtab	0x804b9d0	59	FUNC	<unknown>	DEFAULT	2
is_port_open	.symtab	0x804bdbe	137	FUNC	<unknown>	DEFAULT	2
is_whitelisted	.symtab	0x804bcdc	124	FUNC	<unknown>	DEFAULT	2
isatty	.symtab	0x804dfd0	29	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isspace	.symtab	0x804c5d8	17	FUNC	<unknown>	DEFAULT	2
isspace.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0x804c3dc	50	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill_process	.symtab	0x804bd58	51	FUNC	<unknown>	DEFAULT	2
killer.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
killer_main	.symtab	0x804c053	13	FUNC	<unknown>	DEFAULT	2
lengthd.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lengthq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/i386/crt1.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/i386/crti.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/i386/crtn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/i386/mmap.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libgcc2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
listFork	.symtab	0x8048f34	268	FUNC	<unknown>	DEFAULT	2
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x8050624	95	FUNC	<unknown>	DEFAULT	2
macAddress	.symtab	0x8058670	6	OBJECT	<unknown>	DEFAULT	11
main	.symtab	0x804b3ea	1509	FUNC	<unknown>	DEFAULT	2
mainCommSock	.symtab	0x8058660	4	OBJECT	<unknown>	DEFAULT	11
makeIPPacket	.symtab	0x80491a3	126	FUNC	<unknown>	DEFAULT	2
makeRandomStr	.symtab	0x8048b79	103	FUNC	<unknown>	DEFAULT	2
makevsepacket	.symtab	0x8049ca0	141	FUNC	<unknown>	DEFAULT	2
malloc	.symtab	0x804e75a	1908	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
malloc_trim	.symtab	0x804f395	34	FUNC	<unknown>	DEFAULT	2
mbrtowc	.symtab	0x8053134	111	FUNC	<unknown>	DEFAULT	2
mbrtowc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mbsnrtowcs	.symtab	0x80531a4	145	FUNC	<unknown>	DEFAULT	2
mbsnrtowcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mbstate.2606	.symtab	0x805e8e8	8	OBJECT	<unknown>	DEFAULT	11
mbstate.2606	.symtab	0x805e8f0	8	OBJECT	<unknown>	DEFAULT	11
memchr	.symtab	0x805223c	35	FUNC	<unknown>	DEFAULT	2
memchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memcpy	.symtab	0x804dd30	39	FUNC	<unknown>	DEFAULT	2
memcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memmove	.symtab	0x8052260	39	FUNC	<unknown>	DEFAULT	2
memmove.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mempcpy	.symtab	0x80522b0	33	FUNC	<unknown>	DEFAULT	2
mempcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memrchr	.symtab	0x80522d4	176	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x804dd58	21	FUNC	<unknown>	DEFAULT	2
memset.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mmap	.symtab	0x8050288	27	FUNC	<unknown>	DEFAULT	2
munmap	.symtab	0x8050684	50	FUNC	<unknown>	DEFAULT	2
munmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mylock	.symtab	0x8058528	24	OBJECT	<unknown>	DEFAULT	10
mylock	.symtab	0x8058540	24	OBJECT	<unknown>	DEFAULT	10
mylock	.symtab	0x805e8c8	24	OBJECT	<unknown>	DEFAULT	11
nan_inf_str.2175	.symtab	0x8056d30	21	OBJECT	<unknown>	DEFAULT	4
nan_inf_str.4374	.symtab	0x8056cd9	11	OBJECT	<unknown>	DEFAULT	4
nanosleep	.symtab	0x80506b8	50	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
next_start.1109	.symtab	0x805e6a0	4	OBJECT	<unknown>	DEFAULT	11
nil_string	.symtab	0x8056cd3	6	OBJECT	<unknown>	DEFAULT	4
ntohl	.symtab	0x804e07f	7	FUNC	<unknown>	DEFAULT	2
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0x804e073	12	FUNC	<unknown>	DEFAULT	2
ntop.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
numpids	.symtab	0x8058668	8	OBJECT	<unknown>	DEFAULT	11
object.2482	.symtab	0x8058644	24	OBJECT	<unknown>	DEFAULT	11
open	.symtab	0x804c410	75	FUNC	<unknown>	DEFAULT	2
open.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opendir	.symtab	0x804c67c	241	FUNC	<unknown>	DEFAULT	2
opendir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opennameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ourIP	.symtab	0x805e8f8	4	OBJECT	<unknown>	DEFAULT	11
p.2427	.symtab	0x80580e4	0	OBJECT	<unknown>	DEFAULT	10
pids	.symtab	0x805e8fc	4	OBJECT	<unknown>	DEFAULT	11
poll	.symtab	0x80530fc	54	FUNC	<unknown>	DEFAULT	2
poll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prctl	.symtab	0x804c474	63	FUNC	<unknown>	DEFAULT	2
prctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prefix.4202	.symtab	0x8055d05	12	OBJECT	<unknown>	DEFAULT	4
print	.symtab	0x804883d	584	FUNC	<unknown>	DEFAULT	2
printchar	.symtab	0x8048607	58	FUNC	<unknown>	DEFAULT	2
printi	.symtab	0x8048718	293	FUNC	<unknown>	DEFAULT	2
prints	.symtab	0x8048641	215	FUNC	<unknown>	DEFAULT	2
processCmd	.symtab	0x804a54b	3434	FUNC	<unknown>	DEFAULT	2
qual_chars	.symtab	0x8056c82	18	OBJECT	<unknown>	DEFAULT	4
qual_chars.4208	.symtab	0x8055d18	20	OBJECT	<unknown>	DEFAULT	4
raise	.symtab	0x8052e60	24	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x804f4cc	5	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand_cmwc	.symtab	0x80481f7	192	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x804f4d4	72	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x8056920	40	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x804f6ad	95	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randtbl	.symtab	0x8058580	128	OBJECT	<unknown>	DEFAULT	10
rawmemchr	.symtab	0x80535e8	99	FUNC	<unknown>	DEFAULT	2
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read	.symtab	0x804c4b4	54	FUNC	<unknown>	DEFAULT	2
read.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read_etc_hosts_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
readdir	.symtab	0x804c770	132	FUNC	<unknown>	DEFAULT	2
readdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recv	.symtab	0x804e50c	51	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recvLine	.symtab	0x8048be0	396	FUNC	<unknown>	DEFAULT	2
sbrk	.symtab	0x80506ec	78	FUNC	<unknown>	DEFAULT	2
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sc_getc	.symtab	0x8051a66	16	FUNC	<unknown>	DEFAULT	2
scan_getwc	.symtab	0x8051314	152	FUNC	<unknown>	DEFAULT	2
select	.symtab	0x804c4ec	63	FUNC	<unknown>	DEFAULT	2
select.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send	.symtab	0x804e540	51	FUNC	<unknown>	DEFAULT	2
send.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sendHTTPtwo	.symtab	0x804a350	351	FUNC	<unknown>	DEFAULT	2
sendto	.symtab	0x804e574	67	FUNC	<unknown>	DEFAULT	2
sendto.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsid	.symtab	0x804c52c	38	FUNC	<unknown>	DEFAULT	2
setsid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsockopt	.symtab	0x804e5b8	59	FUNC	<unknown>	DEFAULT	2
setsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate	.symtab	0x804f51c	93	FUNC	<unknown>	DEFAULT	2
setstate_r	.symtab	0x804f614	153	FUNC	<unknown>	DEFAULT	2
sigaction	.symtab	0x80501af	217	FUNC	<unknown>	DEFAULT	2
sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
signal	.symtab	0x804e620	175	FUNC	<unknown>	DEFAULT	2
signal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigprocmask	.symtab	0x805073c	85	FUNC	<unknown>	DEFAULT	2
sigprocmask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigsetops.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sleep	.symtab	0x804fc2c	393	FUNC	<unknown>	DEFAULT	2
sleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
snprintf	.symtab	0x804c920	33	FUNC	<unknown>	DEFAULT	2
snprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket	.symtab	0x804e5f4	43	FUNC	<unknown>	DEFAULT	2
socket.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket_connect	.symtab	0x8049bbf	225	FUNC	<unknown>	DEFAULT	2
sockprintf	.symtab	0x8048a85	185	FUNC	<unknown>	DEFAULT	2
spec_allowed	.symtab	0x8056cb4	16	OBJECT	<unknown>	DEFAULT	4
spec_and_mask.4207	.symtab	0x8055d2c	16	OBJECT	<unknown>	DEFAULT	4
spec_base	.symtab	0x8056cc4	15	OBJECT	<unknown>	DEFAULT	4
spec_base.4201	.symtab	0x8055d11	7	OBJECT	<unknown>	DEFAULT	4
spec_chars	.symtab	0x8056c94	23	OBJECT	<unknown>	DEFAULT	4
spec_chars.4204	.symtab	0x8055d55	21	OBJECT	<unknown>	DEFAULT	4
spec_flags	.symtab	0x8056c7e	4	OBJECT	<unknown>	DEFAULT	4
spec_flags.4203	.symtab	0x8055d6a	8	OBJECT	<unknown>	DEFAULT	4
spec_or_mask.4206	.symtab	0x8055d3c	16	OBJECT	<unknown>	DEFAULT	4
spec_ranges	.symtab	0x8056cab	8	OBJECT	<unknown>	DEFAULT	4
spec_ranges.4205	.symtab	0x8055d4c	9	OBJECT	<unknown>	DEFAULT	4
sprintf	.symtab	0x804c944	31	FUNC	<unknown>	DEFAULT	2
sprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
srand	.symtab	0x804f5d0	67	FUNC	<unknown>	DEFAULT	2
srandom	.symtab	0x804f5d0	67	FUNC	<unknown>	DEFAULT	2
srandom_r	.symtab	0x804f70c	150	FUNC	<unknown>	DEFAULT	2
static_id	.symtab	0x805861c	2	OBJECT	<unknown>	DEFAULT	10
static_ns	.symtab	0x805e8e0	4	OBJECT	<unknown>	DEFAULT	11
stderr	.symtab	0x80583c0	4	OBJECT	<unknown>	DEFAULT	10
stdin	.symtab	0x80583b8	4	OBJECT	<unknown>	DEFAULT	10
stdout	.symtab	0x80583bc	4	OBJECT	<unknown>	DEFAULT	10
strcasecmp	.symtab	0x80541d8	54	FUNC	<unknown>	DEFAULT	2
strcasecmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchr	.symtab	0x804dd70	30	FUNC	<unknown>	DEFAULT	2
strchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcmp	.symtab	0x804dd90	29	FUNC	<unknown>	DEFAULT	2
strcmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcoll	.symtab	0x804dd90	29	FUNC	<unknown>	DEFAULT	2
strcpy	.symtab	0x804ddb0	27	FUNC	<unknown>	DEFAULT	2
strcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strdup	.symtab	0x8053680	54	FUNC	<unknown>	DEFAULT	2
strdup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strerror_r	.symtab	0x804dee4	183	FUNC	<unknown>	DEFAULT	2
strlen	.symtab	0x804ddcc	19	FUNC	<unknown>	DEFAULT	2
strlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncat	.symtab	0x80535b8	46	FUNC	<unknown>	DEFAULT	2
strncat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncpy	.symtab	0x8052288	38	FUNC	<unknown>	DEFAULT	2
strncpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strnlen	.symtab	0x804dde0	25	FUNC	<unknown>	DEFAULT	2
strnlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strpbrk	.symtab	0x80523e0	39	FUNC	<unknown>	DEFAULT	2
strpbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strspn	.symtab	0x805364c	50	FUNC	<unknown>	DEFAULT	2
strspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strstr	.symtab	0x804ddfc	198	FUNC	<unknown>	DEFAULT	2
strstr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtoimax	.symtab	0x804f9ac	26	FUNC	<unknown>	DEFAULT	2
strtok	.symtab	0x804dfb4	25	FUNC	<unknown>	DEFAULT	2
strtok.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok_r	.symtab	0x8052384	89	FUNC	<unknown>	DEFAULT	2
strtok_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtol	.symtab	0x804f864	26	FUNC	<unknown>	DEFAULT	2
strtol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtoll	.symtab	0x804f9ac	26	FUNC	<unknown>	DEFAULT	2
strtoll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtoq	.symtab	0x804f9ac	26	FUNC	<unknown>	DEFAULT	2
sysconf	.symtab	0x804fdb8	325	FUNC	<unknown>	DEFAULT	2
sysconf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcgetattr	.symtab	0x804dff0	112	FUNC	<unknown>	DEFAULT	2
tcgetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcpcsum	.symtab	0x80490e8	187	FUNC	<unknown>	DEFAULT	2
time	.symtab	0x804c554	46	FUNC	<unknown>	DEFAULT	2
time.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tolower	.symtab	0x80541b8	29	FUNC	<unknown>	DEFAULT	2
tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
toupper	.symtab	0x804c5ec	29	FUNC	<unknown>	DEFAULT	2
toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
trim	.symtab	0x8048558	175	FUNC	<unknown>	DEFAULT	2
type_codes	.symtab	0x8055d72	24	OBJECT	<unknown>	DEFAULT	4
type_sizes	.symtab	0x8055d8a	12	OBJECT	<unknown>	DEFAULT	4
ungetc	.symtab	0x8053254	207	FUNC	<unknown>	DEFAULT	2
ungetc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
unknown.1161	.symtab	0x8055d96	14	OBJECT	<unknown>	DEFAULT	4
unsafe_state	.symtab	0x8058558	28	OBJECT	<unknown>	DEFAULT	10
useragents	.symtab	0x80580f0	28	OBJECT	<unknown>	DEFAULT	10
usleep	.symtab	0x804ff00	48	FUNC	<unknown>	DEFAULT	2
usleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
vfscanf	.symtab	0x80513ac	1722	FUNC	<unknown>	DEFAULT	2
vfscanf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
vseattack	.symtab	0x8049d2d	1220	FUNC	<unknown>	DEFAULT	2
vsnprintf	.symtab	0x804c964	178	FUNC	<unknown>	DEFAULT	2
vsnprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wait4	.symtab	0x8050794	59	FUNC	<unknown>	DEFAULT	2
wait4.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
waitpid	.symtab	0x804c584	26	FUNC	<unknown>	DEFAULT	2
waitpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcrtomb	.symtab	0x80508e8	68	FUNC	<unknown>	DEFAULT	2
wcrtomb.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsnrtombs	.symtab	0x805094c	134	FUNC	<unknown>	DEFAULT	2
wcsnrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsrtombs	.symtab	0x805092c	30	FUNC	<unknown>	DEFAULT	2
wcsrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
whitelist_pid_count	.symtab	0x805c684	4	OBJECT	<unknown>	DEFAULT	11
whitelist_size	.symtab	0x8055690	4	OBJECT	<unknown>	DEFAULT	4
whitelisted_pids	.symtab	0x805c680	0	OBJECT	<unknown>	DEFAULT	11
whitelisted_processes	.symtab	0x8058120	648	OBJECT	<unknown>	DEFAULT	10
write	.symtab	0x804c5a0	54	FUNC	<unknown>	DEFAULT	2
write.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
xdigits.3116	.symtab	0x8057074	17	OBJECT	<unknown>	DEFAULT	4
xstatconv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-09T08:28:01.698611+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38228	89.33.192.138	6581	TCP
2025-01-09T08:28:03.139565+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38230	89.33.192.138	6581	TCP
2025-01-09T08:28:04.593289+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38232	89.33.192.138	6581	TCP
2025-01-09T08:28:06.046356+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38234	89.33.192.138	6581	TCP
2025-01-09T08:28:19.459745+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38236	89.33.192.138	6581	TCP
2025-01-09T08:28:38.366435+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38238	89.33.192.138	6581	TCP
2025-01-09T08:28:47.764167+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38240	89.33.192.138	6581	TCP
2025-01-09T08:28:49.201594+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38242	89.33.192.138	6581	TCP
2025-01-09T08:29:10.601554+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38244	89.33.192.138	6581	TCP
2025-01-09T08:29:12.046992+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38246	89.33.192.138	6581	TCP
2025-01-09T08:29:25.493975+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38248	89.33.192.138	6581	TCP
2025-01-09T08:29:26.956247+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38250	89.33.192.138	6581	TCP
2025-01-09T08:29:28.407856+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38252	89.33.192.138	6581	TCP
2025-01-09T08:29:29.861728+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38254	89.33.192.138	6581	TCP
2025-01-09T08:29:31.311811+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38256	89.33.192.138	6581	TCP
2025-01-09T08:29:32.769118+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38258	89.33.192.138	6581	TCP
2025-01-09T08:29:34.218175+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38260	89.33.192.138	6581	TCP
2025-01-09T08:29:35.655974+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38262	89.33.192.138	6581	TCP
2025-01-09T08:29:37.093029+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38264	89.33.192.138	6581	TCP
2025-01-09T08:29:38.548168+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38266	89.33.192.138	6581	TCP
2025-01-09T08:29:40.000116+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38268	89.33.192.138	6581	TCP
2025-01-09T08:29:41.458546+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38270	89.33.192.138	6581	TCP
2025-01-09T08:29:42.927972+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38272	89.33.192.138	6581	TCP
2025-01-09T08:29:44.407959+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38274	89.33.192.138	6581	TCP
2025-01-09T08:29:45.859881+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38276	89.33.192.138	6581	TCP
2025-01-09T08:29:47.333764+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38278	89.33.192.138	6581	TCP
2025-01-09T08:29:48.784126+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38280	89.33.192.138	6581	TCP
2025-01-09T08:29:50.234080+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38282	89.33.192.138	6581	TCP
2025-01-09T08:29:51.690925+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38284	89.33.192.138	6581	TCP
2025-01-09T08:29:53.141549+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38286	89.33.192.138	6581	TCP
2025-01-09T08:29:54.614964+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38288	89.33.192.138	6581	TCP
2025-01-09T08:29:56.060979+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38290	89.33.192.138	6581	TCP
2025-01-09T08:29:57.535081+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38292	89.33.192.138	6581	TCP
2025-01-09T08:29:58.984744+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38294	89.33.192.138	6581	TCP
2025-01-09T08:30:00.421255+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38296	89.33.192.138	6581	TCP
2025-01-09T08:30:01.878992+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38298	89.33.192.138	6581	TCP
2025-01-09T08:30:03.328549+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38300	89.33.192.138	6581	TCP
2025-01-09T08:30:04.786483+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38302	89.33.192.138	6581	TCP
2025-01-09T08:30:06.246296+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38304	89.33.192.138	6581	TCP
2025-01-09T08:30:07.708098+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38306	89.33.192.138	6581	TCP
2025-01-09T08:30:09.156325+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38308	89.33.192.138	6581	TCP
2025-01-09T08:30:10.611437+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38310	89.33.192.138	6581	TCP
2025-01-09T08:30:12.047360+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38312	89.33.192.138	6581	TCP
2025-01-09T08:30:13.506452+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38314	89.33.192.138	6581	TCP
2025-01-09T08:30:14.953471+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38316	89.33.192.138	6581	TCP
2025-01-09T08:30:16.410393+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38318	89.33.192.138	6581	TCP
2025-01-09T08:30:17.879435+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38320	89.33.192.138	6581	TCP
2025-01-09T08:30:19.332442+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38322	89.33.192.138	6581	TCP
2025-01-09T08:30:20.782335+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38324	89.33.192.138	6581	TCP
2025-01-09T08:30:22.238810+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38326	89.33.192.138	6581	TCP
2025-01-09T08:30:23.690058+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38328	89.33.192.138	6581	TCP
2025-01-09T08:30:25.125737+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38330	89.33.192.138	6581	TCP
2025-01-09T08:30:26.582536+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38332	89.33.192.138	6581	TCP
2025-01-09T08:30:28.031416+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38334	89.33.192.138	6581	TCP
2025-01-09T08:30:29.488326+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38336	89.33.192.138	6581	TCP
2025-01-09T08:30:30.944791+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38338	89.33.192.138	6581	TCP
2025-01-09T08:30:32.407763+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38340	89.33.192.138	6581	TCP
2025-01-09T08:30:33.846476+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38342	89.33.192.138	6581	TCP
2025-01-09T08:30:35.301220+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38344	89.33.192.138	6581	TCP
2025-01-09T08:30:36.754146+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38346	89.33.192.138	6581	TCP
2025-01-09T08:30:38.209764+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38348	89.33.192.138	6581	TCP
2025-01-09T08:30:39.659936+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38350	89.33.192.138	6581	TCP
2025-01-09T08:30:41.113814+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38352	89.33.192.138	6581	TCP
2025-01-09T08:30:42.549425+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38354	89.33.192.138	6581	TCP
2025-01-09T08:30:44.009800+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38356	89.33.192.138	6581	TCP
2025-01-09T08:30:45.458629+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38358	89.33.192.138	6581	TCP
2025-01-09T08:30:46.910433+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38360	89.33.192.138	6581	TCP
2025-01-09T08:30:48.346000+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38362	89.33.192.138	6581	TCP
2025-01-09T08:30:49.850304+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38364	89.33.192.138	6581	TCP
2025-01-09T08:30:51.299641+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38366	89.33.192.138	6581	TCP
2025-01-09T08:30:52.771846+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38368	89.33.192.138	6581	TCP
2025-01-09T08:30:54.242658+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38370	89.33.192.138	6581	TCP
2025-01-09T08:30:55.692406+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38372	89.33.192.138	6581	TCP
2025-01-09T08:30:57.144648+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38374	89.33.192.138	6581	TCP
2025-01-09T08:30:58.599633+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38376	89.33.192.138	6581	TCP
2025-01-09T08:31:00.033597+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38378	89.33.192.138	6581	TCP
2025-01-09T08:31:01.488732+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38380	89.33.192.138	6581	TCP
2025-01-09T08:31:02.942342+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38382	89.33.192.138	6581	TCP
2025-01-09T08:31:04.413236+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38384	89.33.192.138	6581	TCP
2025-01-09T08:31:05.864498+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38386	89.33.192.138	6581	TCP
2025-01-09T08:31:07.344842+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38388	89.33.192.138	6581	TCP
2025-01-09T08:31:08.802876+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38390	89.33.192.138	6581	TCP
2025-01-09T08:31:10.256349+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38392	89.33.192.138	6581	TCP
2025-01-09T08:31:11.708944+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38394	89.33.192.138	6581	TCP
2025-01-09T08:31:13.144588+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38396	89.33.192.138	6581	TCP
2025-01-09T08:31:14.602115+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38398	89.33.192.138	6581	TCP
2025-01-09T08:31:16.053596+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38400	89.33.192.138	6581	TCP
2025-01-09T08:31:17.507138+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38402	89.33.192.138	6581	TCP
2025-01-09T08:31:18.960211+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38404	89.33.192.138	6581	TCP
2025-01-09T08:31:20.423196+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38406	89.33.192.138	6581	TCP
2025-01-09T08:31:21.864867+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38408	89.33.192.138	6581	TCP
2025-01-09T08:31:23.338209+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38410	89.33.192.138	6581	TCP
2025-01-09T08:31:24.789600+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38412	89.33.192.138	6581	TCP
2025-01-09T08:31:26.240888+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38414	89.33.192.138	6581	TCP
2025-01-09T08:31:27.709790+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38416	89.33.192.138	6581	TCP
2025-01-09T08:31:29.163103+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38418	89.33.192.138	6581	TCP
2025-01-09T08:31:30.612926+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38420	89.33.192.138	6581	TCP
2025-01-09T08:31:32.070891+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38422	89.33.192.138	6581	TCP
2025-01-09T08:31:33.522354+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38424	89.33.192.138	6581	TCP
2025-01-09T08:31:34.984267+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.15	38426	89.33.192.138	6581	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 9, 2025 08:28:01.693443060 CET	38228	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:28:01.698430061 CET	6581	38228	89.33.192.138	192.168.2.15
Jan 9, 2025 08:28:01.698548079 CET	38228	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:28:01.698611021 CET	38228	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:28:01.703495026 CET	6581	38228	89.33.192.138	192.168.2.15
Jan 9, 2025 08:28:03.134259939 CET	6581	38228	89.33.192.138	192.168.2.15
Jan 9, 2025 08:28:03.134491920 CET	38228	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:28:03.134541035 CET	38230	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:28:03.139426947 CET	6581	38228	89.33.192.138	192.168.2.15
Jan 9, 2025 08:28:03.139441013 CET	6581	38230	89.33.192.138	192.168.2.15
Jan 9, 2025 08:28:03.139512062 CET	38230	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:28:03.139564991 CET	38230	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:28:03.144454956 CET	6581	38230	89.33.192.138	192.168.2.15
Jan 9, 2025 08:28:04.587209940 CET	6581	38230	89.33.192.138	192.168.2.15
Jan 9, 2025 08:28:04.587368965 CET	38230	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:28:04.587403059 CET	38232	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:28:04.593194962 CET	6581	38230	89.33.192.138	192.168.2.15
Jan 9, 2025 08:28:04.593209028 CET	6581	38232	89.33.192.138	192.168.2.15
Jan 9, 2025 08:28:04.593259096 CET	38232	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:28:04.593288898 CET	38232	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:28:04.598975897 CET	6581	38232	89.33.192.138	192.168.2.15
Jan 9, 2025 08:28:06.041110039 CET	6581	38232	89.33.192.138	192.168.2.15
Jan 9, 2025 08:28:06.041292906 CET	38232	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:28:06.041332006 CET	38234	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:28:06.046262980 CET	6581	38232	89.33.192.138	192.168.2.15
Jan 9, 2025 08:28:06.046279907 CET	6581	38234	89.33.192.138	192.168.2.15
Jan 9, 2025 08:28:06.046318054 CET	38234	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:28:06.046355963 CET	38234	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:28:06.051800013 CET	6581	38234	89.33.192.138	192.168.2.15
Jan 9, 2025 08:28:19.454484940 CET	6581	38234	89.33.192.138	192.168.2.15
Jan 9, 2025 08:28:19.454632044 CET	38234	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:28:19.454657078 CET	38236	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:28:19.459589005 CET	6581	38234	89.33.192.138	192.168.2.15
Jan 9, 2025 08:28:19.459608078 CET	6581	38236	89.33.192.138	192.168.2.15
Jan 9, 2025 08:28:19.459733009 CET	38236	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:28:19.459744930 CET	38236	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:28:19.464570045 CET	6581	38236	89.33.192.138	192.168.2.15
Jan 9, 2025 08:28:38.361038923 CET	6581	38236	89.33.192.138	192.168.2.15
Jan 9, 2025 08:28:38.361408949 CET	38236	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:28:38.361485958 CET	38238	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:28:38.366209030 CET	6581	38236	89.33.192.138	192.168.2.15
Jan 9, 2025 08:28:38.366276026 CET	6581	38238	89.33.192.138	192.168.2.15
Jan 9, 2025 08:28:38.366333961 CET	38238	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:28:38.366435051 CET	38238	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:28:38.372102976 CET	6581	38238	89.33.192.138	192.168.2.15
Jan 9, 2025 08:28:47.758831978 CET	6581	38238	89.33.192.138	192.168.2.15
Jan 9, 2025 08:28:47.759175062 CET	38238	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:28:47.759232998 CET	38240	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:28:47.763982058 CET	6581	38238	89.33.192.138	192.168.2.15
Jan 9, 2025 08:28:47.764031887 CET	6581	38240	89.33.192.138	192.168.2.15
Jan 9, 2025 08:28:47.764117002 CET	38240	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:28:47.764167070 CET	38240	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:28:47.768903971 CET	6581	38240	89.33.192.138	192.168.2.15
Jan 9, 2025 08:28:49.196139097 CET	6581	38240	89.33.192.138	192.168.2.15
Jan 9, 2025 08:28:49.196633101 CET	38240	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:28:49.196707010 CET	38242	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:28:49.201417923 CET	6581	38240	89.33.192.138	192.168.2.15
Jan 9, 2025 08:28:49.201452017 CET	6581	38242	89.33.192.138	192.168.2.15
Jan 9, 2025 08:28:49.201575994 CET	38242	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:28:49.201594114 CET	38242	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:28:49.206376076 CET	6581	38242	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:10.596210957 CET	6581	38242	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:10.596450090 CET	38242	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:10.596487999 CET	38244	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:10.601402998 CET	6581	38242	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:10.601417065 CET	6581	38244	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:10.601522923 CET	38244	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:10.601553917 CET	38244	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:10.606378078 CET	6581	38244	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:12.041590929 CET	6581	38244	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:12.041917086 CET	38244	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:12.041966915 CET	38246	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:12.046833038 CET	6581	38244	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:12.046850920 CET	6581	38246	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:12.046958923 CET	38246	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:12.046992064 CET	38246	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:12.051799059 CET	6581	38246	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:25.488724947 CET	6581	38246	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:25.489011049 CET	38246	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:25.489034891 CET	38248	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:25.493830919 CET	6581	38246	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:25.493844032 CET	6581	38248	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:25.493961096 CET	38248	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:25.493974924 CET	38248	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:25.498795033 CET	6581	38248	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:26.951036930 CET	6581	38248	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:26.951237917 CET	38248	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:26.951287985 CET	38250	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:26.956099033 CET	6581	38248	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:26.956110001 CET	6581	38250	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:26.956196070 CET	38250	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:26.956247091 CET	38250	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:26.961024046 CET	6581	38250	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:28.402651072 CET	6581	38250	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:28.402911901 CET	38250	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:28.402951956 CET	38252	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:28.407727003 CET	6581	38250	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:28.407738924 CET	6581	38252	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:28.407813072 CET	38252	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:28.407855988 CET	38252	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:28.412712097 CET	6581	38252	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:29.856385946 CET	6581	38252	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:29.856626987 CET	38252	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:29.856652975 CET	38254	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:29.861582994 CET	6581	38252	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:29.861602068 CET	6581	38254	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:29.861706018 CET	38254	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:29.861727953 CET	38254	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:29.866826057 CET	6581	38254	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:31.306622982 CET	6581	38254	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:31.306791067 CET	38254	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:31.306833982 CET	38256	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:31.311692953 CET	6581	38254	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:31.311706066 CET	6581	38256	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:31.311779976 CET	38256	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:31.311810970 CET	38256	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:31.316639900 CET	6581	38256	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:32.763809919 CET	6581	38256	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:32.764105082 CET	38256	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:32.764168978 CET	38258	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:32.768918037 CET	6581	38256	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:32.768930912 CET	6581	38258	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:32.769041061 CET	38258	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:32.769118071 CET	38258	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:32.773889065 CET	6581	38258	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:34.212933064 CET	6581	38258	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:34.213206053 CET	38258	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:34.213258028 CET	38260	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:34.217959881 CET	6581	38258	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:34.218045950 CET	6581	38260	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:34.218120098 CET	38260	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:34.218174934 CET	38260	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:34.224242926 CET	6581	38260	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:35.650549889 CET	6581	38260	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:35.650876045 CET	38260	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:35.650926113 CET	38262	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:35.655826092 CET	6581	38260	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:35.655839920 CET	6581	38262	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:35.655973911 CET	38262	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:35.655973911 CET	38262	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:35.660923958 CET	6581	38262	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:37.087759018 CET	6581	38262	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:37.088011026 CET	38262	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:37.088025093 CET	38264	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:37.092870951 CET	6581	38262	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:37.092914104 CET	6581	38264	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:37.092997074 CET	38264	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:37.093029022 CET	38264	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:37.097753048 CET	6581	38264	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:38.542884111 CET	6581	38264	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:38.543118954 CET	38264	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:38.543148041 CET	38266	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:38.547940969 CET	6581	38264	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:38.547962904 CET	6581	38266	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:38.548150063 CET	38266	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:38.548167944 CET	38266	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:38.552961111 CET	6581	38266	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:39.994641066 CET	6581	38266	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:39.994995117 CET	38266	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:39.995073080 CET	38268	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:39.999913931 CET	6581	38266	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:39.999957085 CET	6581	38268	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:40.000075102 CET	38268	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:40.000116110 CET	38268	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:40.004955053 CET	6581	38268	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:41.451257944 CET	6581	38268	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:41.451826096 CET	38268	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:41.451889992 CET	38270	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:41.458359003 CET	6581	38268	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:41.458372116 CET	6581	38270	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:41.458498955 CET	38270	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:41.458545923 CET	38270	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:41.463908911 CET	6581	38270	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:42.922333956 CET	6581	38270	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:42.922739983 CET	38270	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:42.922821045 CET	38272	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:42.927736044 CET	6581	38270	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:42.927779913 CET	6581	38272	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:42.927913904 CET	38272	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:42.927972078 CET	38272	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:42.932740927 CET	6581	38272	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:44.396485090 CET	6581	38272	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:44.396678925 CET	38272	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:44.396720886 CET	38274	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:44.407706976 CET	6581	38272	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:44.407722950 CET	6581	38274	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:44.407958984 CET	38274	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:44.407958984 CET	38274	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:44.418926954 CET	6581	38274	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:45.853789091 CET	6581	38274	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:45.854022980 CET	38274	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:45.854041100 CET	38276	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:45.859756947 CET	6581	38274	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:45.859774113 CET	6581	38276	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:45.859843016 CET	38276	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:45.859880924 CET	38276	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:45.865122080 CET	6581	38276	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:47.328175068 CET	6581	38276	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:47.328705072 CET	38276	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:47.328784943 CET	38278	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:47.333571911 CET	6581	38276	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:47.333585978 CET	6581	38278	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:47.333692074 CET	38278	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:47.333764076 CET	38278	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:47.338525057 CET	6581	38278	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:48.778796911 CET	6581	38278	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:48.778996944 CET	38278	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:48.779022932 CET	38280	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:48.783997059 CET	6581	38278	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:48.784009933 CET	6581	38280	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:48.784092903 CET	38280	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:48.784126043 CET	38280	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:48.788945913 CET	6581	38280	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:50.228790045 CET	6581	38280	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:50.229028940 CET	38280	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:50.229098082 CET	38282	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:50.233906984 CET	6581	38280	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:50.233920097 CET	6581	38282	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:50.234009981 CET	38282	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:50.234080076 CET	38282	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:50.238816023 CET	6581	38282	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:51.685652971 CET	6581	38282	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:51.685857058 CET	38282	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:51.685930967 CET	38284	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:51.690677881 CET	6581	38282	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:51.690807104 CET	6581	38284	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:51.690881014 CET	38284	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:51.690924883 CET	38284	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:51.695700884 CET	6581	38284	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:53.136368990 CET	6581	38284	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:53.136579990 CET	38284	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:53.136620998 CET	38286	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:53.141350985 CET	6581	38284	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:53.141460896 CET	6581	38286	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:53.141520977 CET	38286	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:53.141549110 CET	38286	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:53.146342993 CET	6581	38286	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:54.609457016 CET	6581	38286	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:54.609888077 CET	38286	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:54.609954119 CET	38288	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:54.614758015 CET	6581	38286	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:54.614820004 CET	6581	38288	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:54.614902973 CET	38288	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:54.614964008 CET	38288	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:54.619796991 CET	6581	38288	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:56.055788994 CET	6581	38288	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:56.056008101 CET	38288	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:56.056071043 CET	38290	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:56.060800076 CET	6581	38288	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:56.060852051 CET	6581	38290	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:56.060920954 CET	38290	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:56.060978889 CET	38290	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:56.065790892 CET	6581	38290	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:57.529932976 CET	6581	38290	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:57.530081034 CET	38290	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:57.530107975 CET	38292	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:57.534990072 CET	6581	38290	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:57.535006046 CET	6581	38292	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:57.535064936 CET	38292	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:57.535080910 CET	38292	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:57.539849043 CET	6581	38292	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:58.979196072 CET	6581	38292	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:58.979506969 CET	38292	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:58.979506969 CET	38294	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:58.984568119 CET	6581	38292	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:58.984582901 CET	6581	38294	89.33.192.138	192.168.2.15
Jan 9, 2025 08:29:58.984663010 CET	38294	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:58.984744072 CET	38294	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:29:58.989543915 CET	6581	38294	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:00.415976048 CET	6581	38294	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:00.416250944 CET	38294	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:00.416281939 CET	38296	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:00.421053886 CET	6581	38294	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:00.421087980 CET	6581	38296	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:00.421201944 CET	38296	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:00.421255112 CET	38296	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:00.425982952 CET	6581	38296	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:01.873929024 CET	6581	38296	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:01.874061108 CET	38296	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:01.874093056 CET	38298	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:01.878880024 CET	6581	38296	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:01.878901958 CET	6581	38298	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:01.878968000 CET	38298	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:01.878992081 CET	38298	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:01.883896112 CET	6581	38298	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:03.323266029 CET	6581	38298	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:03.323493958 CET	38298	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:03.323554039 CET	38300	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:03.328344107 CET	6581	38298	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:03.328429937 CET	6581	38300	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:03.328490973 CET	38300	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:03.328548908 CET	38300	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:03.333375931 CET	6581	38300	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:04.779716015 CET	6581	38300	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:04.779932022 CET	38300	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:04.779992104 CET	38302	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:04.786345005 CET	6581	38300	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:04.786359072 CET	6581	38302	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:04.786468983 CET	38302	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:04.786483049 CET	38302	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:04.792901993 CET	6581	38302	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:06.231252909 CET	6581	38302	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:06.231431007 CET	38302	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:06.231471062 CET	38304	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:06.246150970 CET	6581	38302	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:06.246165037 CET	6581	38304	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:06.246233940 CET	38304	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:06.246295929 CET	38304	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:06.257545948 CET	6581	38304	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:07.702169895 CET	6581	38304	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:07.702374935 CET	38304	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:07.702374935 CET	38306	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:07.707968950 CET	6581	38304	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:07.707988024 CET	6581	38306	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:07.708085060 CET	38306	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:07.708097935 CET	38306	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:07.713619947 CET	6581	38306	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:09.151092052 CET	6581	38306	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:09.151283979 CET	38306	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:09.151338100 CET	38308	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:09.156179905 CET	6581	38306	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:09.156196117 CET	6581	38308	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:09.156306028 CET	38308	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:09.156325102 CET	38308	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:09.161113977 CET	6581	38308	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:10.606183052 CET	6581	38308	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:10.606364965 CET	38308	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:10.606406927 CET	38310	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:10.611293077 CET	6581	38308	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:10.611304045 CET	6581	38310	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:10.611396074 CET	38310	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:10.611437082 CET	38310	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:10.616214037 CET	6581	38310	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:12.042182922 CET	6581	38310	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:12.042382956 CET	38310	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:12.042423964 CET	38312	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:12.047215939 CET	6581	38310	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:12.047270060 CET	6581	38312	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:12.047333002 CET	38312	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:12.047359943 CET	38312	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:12.052133083 CET	6581	38312	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:13.500916958 CET	6581	38312	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:13.501287937 CET	38312	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:13.501368046 CET	38314	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:13.506263018 CET	6581	38312	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:13.506278038 CET	6581	38314	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:13.506359100 CET	38314	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:13.506452084 CET	38314	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:13.511231899 CET	6581	38314	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:14.948263884 CET	6581	38314	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:14.948471069 CET	38316	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:14.948514938 CET	38314	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:14.953377008 CET	6581	38316	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:14.953389883 CET	6581	38314	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:14.953457117 CET	38316	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:14.953470945 CET	38316	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:14.958251953 CET	6581	38316	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:16.405092955 CET	6581	38316	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:16.405375004 CET	38316	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:16.405452967 CET	38318	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:16.410238981 CET	6581	38316	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:16.410269022 CET	6581	38318	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:16.410337925 CET	38318	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:16.410393000 CET	38318	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:16.415230036 CET	6581	38318	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:17.874087095 CET	6581	38318	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:17.874389887 CET	38318	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:17.874433994 CET	38320	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:17.879188061 CET	6581	38318	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:17.879309893 CET	6581	38320	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:17.879406929 CET	38320	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:17.879435062 CET	38320	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:17.884274006 CET	6581	38320	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:19.327024937 CET	6581	38320	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:19.327419043 CET	38320	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:19.327419043 CET	38322	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:19.332303047 CET	6581	38320	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:19.332317114 CET	6581	38322	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:19.332442045 CET	38322	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:19.332442045 CET	38322	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:19.337241888 CET	6581	38322	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:20.777102947 CET	6581	38322	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:20.777333975 CET	38322	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:20.777390003 CET	38324	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:20.782192945 CET	6581	38322	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:20.782248020 CET	6581	38324	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:20.782306910 CET	38324	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:20.782335043 CET	38324	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:20.787177086 CET	6581	38324	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:22.233582973 CET	6581	38324	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:22.233825922 CET	38324	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:22.233875990 CET	38326	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:22.238661051 CET	6581	38324	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:22.238675117 CET	6581	38326	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:22.238743067 CET	38326	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:22.238810062 CET	38326	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:22.243628979 CET	6581	38326	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:23.684861898 CET	6581	38326	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:23.685062885 CET	38326	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:23.685091972 CET	38328	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:23.689944029 CET	6581	38326	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:23.689955950 CET	6581	38328	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:23.690036058 CET	38328	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:23.690057993 CET	38328	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:23.694838047 CET	6581	38328	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:25.120261908 CET	6581	38328	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:25.120678902 CET	38328	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:25.120790958 CET	38330	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:25.125499964 CET	6581	38328	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:25.125614882 CET	6581	38330	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:25.125684023 CET	38330	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:25.125736952 CET	38330	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:25.130537987 CET	6581	38330	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:26.577276945 CET	6581	38330	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:26.577511072 CET	38330	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:26.577581882 CET	38332	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:26.582344055 CET	6581	38330	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:26.582413912 CET	6581	38332	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:26.582473040 CET	38332	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:26.582535982 CET	38332	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:26.587306023 CET	6581	38332	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:28.026185989 CET	6581	38332	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:28.026380062 CET	38332	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:28.026442051 CET	38334	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:28.031285048 CET	6581	38332	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:28.031296968 CET	6581	38334	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:28.031368017 CET	38334	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:28.031415939 CET	38334	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:28.036251068 CET	6581	38334	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:29.482935905 CET	6581	38334	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:29.483257055 CET	38334	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:29.483390093 CET	38336	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:29.488152027 CET	6581	38334	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:29.488182068 CET	6581	38336	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:29.488281012 CET	38336	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:29.488326073 CET	38336	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:29.493143082 CET	6581	38336	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:30.939239025 CET	6581	38336	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:30.939615011 CET	38336	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:30.939672947 CET	38338	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:30.944468021 CET	6581	38336	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:30.944479942 CET	6581	38338	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:30.944561958 CET	38338	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:30.944791079 CET	38338	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:30.949608088 CET	6581	38338	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:32.402451992 CET	6581	38338	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:32.402715921 CET	38338	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:32.402801037 CET	38340	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:32.407502890 CET	6581	38338	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:32.407618999 CET	6581	38340	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:32.407697916 CET	38340	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:32.407763004 CET	38340	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:32.412481070 CET	6581	38340	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:33.841093063 CET	6581	38340	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:33.841418028 CET	38340	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:33.841492891 CET	38342	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:33.846322060 CET	6581	38340	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:33.846335888 CET	6581	38342	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:33.846410990 CET	38342	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:33.846476078 CET	38342	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:33.851210117 CET	6581	38342	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:35.295856953 CET	6581	38342	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:35.296120882 CET	38342	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:35.296194077 CET	38344	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:35.301074028 CET	6581	38342	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:35.301099062 CET	6581	38344	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:35.301162004 CET	38344	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:35.301219940 CET	38344	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:35.306040049 CET	6581	38344	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:36.748517990 CET	6581	38344	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:36.749017000 CET	38344	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:36.749098063 CET	38346	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:36.753863096 CET	6581	38344	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:36.753998995 CET	6581	38346	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:36.754091024 CET	38346	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:36.754146099 CET	38346	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:36.758940935 CET	6581	38346	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:38.203926086 CET	6581	38346	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:38.204652071 CET	38346	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:38.204715967 CET	38348	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:38.209445953 CET	6581	38346	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:38.209568977 CET	6581	38348	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:38.209672928 CET	38348	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:38.209764004 CET	38348	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:38.214534044 CET	6581	38348	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:39.654660940 CET	6581	38348	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:39.654845953 CET	38348	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:39.654917002 CET	38350	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:39.659740925 CET	6581	38348	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:39.659754038 CET	6581	38350	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:39.659877062 CET	38350	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:39.659935951 CET	38350	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:39.664691925 CET	6581	38350	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:41.108334064 CET	6581	38350	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:41.108787060 CET	38350	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:41.108839989 CET	38352	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:41.113624096 CET	6581	38350	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:41.113636971 CET	6581	38352	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:41.113734007 CET	38352	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:41.113814116 CET	38352	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:41.118633986 CET	6581	38352	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:42.544063091 CET	6581	38352	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:42.544358015 CET	38352	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:42.544400930 CET	38354	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:42.549247026 CET	6581	38352	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:42.549262047 CET	6581	38354	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:42.549343109 CET	38354	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:42.549424887 CET	38354	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:42.554177046 CET	6581	38354	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:44.004414082 CET	6581	38354	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:44.004584074 CET	38354	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:44.004617929 CET	38356	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:44.009591103 CET	6581	38354	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:44.009608030 CET	6581	38356	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:44.009758949 CET	38356	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:44.009799957 CET	38356	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:44.014602900 CET	6581	38356	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:45.450171947 CET	6581	38356	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:45.450447083 CET	38356	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:45.450540066 CET	38358	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:45.458455086 CET	6581	38356	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:45.458468914 CET	6581	38358	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:45.458575010 CET	38358	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:45.458628893 CET	38358	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:45.466902018 CET	6581	38358	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:46.905242920 CET	6581	38358	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:46.905358076 CET	38358	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:46.905433893 CET	38360	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:46.910264015 CET	6581	38358	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:46.910276890 CET	6581	38360	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:46.910367012 CET	38360	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:46.910433054 CET	38360	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:46.915174007 CET	6581	38360	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:48.340914965 CET	6581	38360	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:48.341061115 CET	38360	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:48.341061115 CET	38362	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:48.345911026 CET	6581	38360	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:48.345923901 CET	6581	38362	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:48.345999956 CET	38362	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:48.345999956 CET	38362	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:48.350919962 CET	6581	38362	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:49.845107079 CET	6581	38362	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:49.845293045 CET	38364	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:49.845300913 CET	38362	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:49.850132942 CET	6581	38362	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:49.850164890 CET	6581	38364	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:49.850303888 CET	38364	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:49.850303888 CET	38364	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:49.855077028 CET	6581	38364	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:51.294554949 CET	6581	38364	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:51.294687986 CET	38364	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:51.294733047 CET	38366	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:51.299544096 CET	6581	38364	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:51.299557924 CET	6581	38366	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:51.299618006 CET	38366	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:51.299640894 CET	38366	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:51.304419041 CET	6581	38366	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:52.766613007 CET	6581	38366	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:52.766930103 CET	38366	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:52.766948938 CET	38368	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:52.771739006 CET	6581	38366	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:52.771753073 CET	6581	38368	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:52.771816969 CET	38368	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:52.771846056 CET	38368	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:52.777404070 CET	6581	38368	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:54.236895084 CET	6581	38368	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:54.237061024 CET	38368	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:54.237091064 CET	38370	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:54.241878033 CET	6581	38368	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:54.241890907 CET	6581	38370	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:54.242657900 CET	38370	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:54.242657900 CET	38370	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:54.247450113 CET	6581	38370	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:55.687340975 CET	6581	38370	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:55.687484026 CET	38370	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:55.687541962 CET	38372	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:55.692256927 CET	6581	38370	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:55.692320108 CET	6581	38372	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:55.692378998 CET	38372	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:55.692405939 CET	38372	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:55.697139025 CET	6581	38372	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:57.139590979 CET	6581	38372	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:57.139775991 CET	38372	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:57.139818907 CET	38374	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:57.144526958 CET	6581	38372	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:57.144572973 CET	6581	38374	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:57.144620895 CET	38374	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:57.144648075 CET	38374	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:57.149430037 CET	6581	38374	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:58.594530106 CET	6581	38374	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:58.594670057 CET	38374	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:58.594715118 CET	38376	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:58.599518061 CET	6581	38374	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:58.599534035 CET	6581	38376	89.33.192.138	192.168.2.15
Jan 9, 2025 08:30:58.599611998 CET	38376	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:58.599632978 CET	38376	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:30:58.604408026 CET	6581	38376	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:00.028393030 CET	6581	38376	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:00.028606892 CET	38376	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:00.028637886 CET	38378	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:00.033463955 CET	6581	38376	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:00.033477068 CET	6581	38378	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:00.033569098 CET	38378	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:00.033596992 CET	38378	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:00.038364887 CET	6581	38378	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:01.483572960 CET	6581	38378	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:01.483746052 CET	38378	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:01.483772993 CET	38380	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:01.488626003 CET	6581	38378	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:01.488643885 CET	6581	38380	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:01.488698959 CET	38380	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:01.488732100 CET	38380	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:01.493510962 CET	6581	38380	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:02.937056065 CET	6581	38380	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:02.937320948 CET	38380	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:02.937400103 CET	38382	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:02.942054033 CET	6581	38380	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:02.942188978 CET	6581	38382	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:02.942261934 CET	38382	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:02.942342043 CET	38382	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:02.947190046 CET	6581	38382	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:04.407718897 CET	6581	38382	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:04.408054113 CET	38382	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:04.408144951 CET	38384	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:04.412811041 CET	6581	38382	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:04.412926912 CET	6581	38384	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:04.413165092 CET	38384	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:04.413235903 CET	38384	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:04.418062925 CET	6581	38384	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:05.859154940 CET	6581	38384	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:05.859411955 CET	38384	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:05.859436035 CET	38386	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:05.864294052 CET	6581	38384	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:05.864311934 CET	6581	38386	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:05.864453077 CET	38386	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:05.864497900 CET	38386	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:05.869229078 CET	6581	38386	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:07.326276064 CET	6581	38386	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:07.326596975 CET	38386	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:07.326622009 CET	38388	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:07.344732046 CET	6581	38386	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:07.344747066 CET	6581	38388	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:07.344818115 CET	38388	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:07.344841957 CET	38388	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:07.349648952 CET	6581	38388	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:08.797691107 CET	6581	38388	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:08.797938108 CET	38390	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:08.797938108 CET	38388	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:08.802759886 CET	6581	38390	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:08.802813053 CET	6581	38388	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:08.802824974 CET	38390	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:08.802875996 CET	38390	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:08.807626963 CET	6581	38390	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:10.251038074 CET	6581	38390	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:10.251276016 CET	38390	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:10.251319885 CET	38392	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:10.256114006 CET	6581	38390	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:10.256169081 CET	6581	38392	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:10.256294966 CET	38392	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:10.256349087 CET	38392	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:10.261457920 CET	6581	38392	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:11.703638077 CET	6581	38392	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:11.703946114 CET	38392	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:11.704005957 CET	38394	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:11.708798885 CET	6581	38392	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:11.708810091 CET	6581	38394	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:11.708913088 CET	38394	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:11.708944082 CET	38394	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:11.713747025 CET	6581	38394	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:13.139509916 CET	6581	38394	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:13.139652967 CET	38394	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:13.139678001 CET	38396	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:13.144494057 CET	6581	38394	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:13.144505978 CET	6581	38396	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:13.144556046 CET	38396	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:13.144587994 CET	38396	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:13.149369001 CET	6581	38396	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:14.595268011 CET	6581	38396	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:14.595554113 CET	38396	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:14.595554113 CET	38398	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:14.601936102 CET	6581	38396	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:14.601953030 CET	6581	38398	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:14.602031946 CET	38398	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:14.602114916 CET	38398	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:14.608576059 CET	6581	38398	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:16.048487902 CET	6581	38398	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:16.048609972 CET	38398	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:16.048645973 CET	38400	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:16.053368092 CET	6581	38398	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:16.053466082 CET	6581	38400	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:16.053565979 CET	38400	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:16.053596020 CET	38400	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:16.058326006 CET	6581	38400	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:17.501893997 CET	6581	38400	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:17.502166033 CET	38400	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:17.502202034 CET	38402	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:17.506978989 CET	6581	38400	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:17.506989956 CET	6581	38402	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:17.507075071 CET	38402	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:17.507138014 CET	38402	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:17.511847019 CET	6581	38402	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:18.954869986 CET	6581	38402	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:18.955208063 CET	38402	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:18.955240965 CET	38404	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:18.960097075 CET	6581	38402	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:18.960110903 CET	6581	38404	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:18.960180998 CET	38404	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:18.960211039 CET	38404	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:18.964953899 CET	6581	38404	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:20.417788029 CET	6581	38404	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:20.418034077 CET	38404	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:20.418113947 CET	38406	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:20.422939062 CET	6581	38404	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:20.423018932 CET	6581	38406	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:20.423084974 CET	38406	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:20.423196077 CET	38406	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:20.428014994 CET	6581	38406	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:21.859596014 CET	6581	38406	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:21.859787941 CET	38406	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:21.859818935 CET	38408	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:21.864694118 CET	6581	38406	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:21.864706993 CET	6581	38408	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:21.864866972 CET	38408	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:21.864866972 CET	38408	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:21.869652987 CET	6581	38408	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:23.332890987 CET	6581	38408	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:23.333240032 CET	38408	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:23.333292007 CET	38410	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:23.338028908 CET	6581	38408	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:23.338043928 CET	6581	38410	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:23.338176966 CET	38410	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:23.338208914 CET	38410	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:23.342993975 CET	6581	38410	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:24.784300089 CET	6581	38410	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:24.784512997 CET	38410	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:24.784564972 CET	38412	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:24.789381027 CET	6581	38410	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:24.789448023 CET	6581	38412	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:24.789534092 CET	38412	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:24.789599895 CET	38412	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:24.794368029 CET	6581	38412	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:26.235538006 CET	6581	38412	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:26.235753059 CET	38412	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:26.235797882 CET	38414	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:26.240703106 CET	6581	38412	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:26.240720034 CET	6581	38414	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:26.240840912 CET	38414	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:26.240888119 CET	38414	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:26.245677948 CET	6581	38414	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:27.704504967 CET	6581	38414	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:27.704673052 CET	38414	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:27.704682112 CET	38416	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:27.709561110 CET	6581	38414	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:27.709642887 CET	6581	38416	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:27.709772110 CET	38416	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:27.709789991 CET	38416	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:27.714675903 CET	6581	38416	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:29.157651901 CET	6581	38416	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:29.158046007 CET	38416	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:29.158145905 CET	38418	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:29.162872076 CET	6581	38416	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:29.162941933 CET	6581	38418	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:29.163012028 CET	38418	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:29.163103104 CET	38418	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:29.167875051 CET	6581	38418	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:30.607389927 CET	6581	38418	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:30.607825041 CET	38418	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:30.607842922 CET	38420	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:30.612757921 CET	6581	38418	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:30.612770081 CET	6581	38420	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:30.612853050 CET	38420	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:30.612926006 CET	38420	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:30.617713928 CET	6581	38420	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:32.065619946 CET	6581	38420	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:32.065840006 CET	38422	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:32.065840006 CET	38420	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:32.070770025 CET	6581	38422	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:32.070780993 CET	6581	38420	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:32.070842028 CET	38422	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:32.070890903 CET	38422	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:32.075661898 CET	6581	38422	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:33.516983986 CET	6581	38422	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:33.517226934 CET	38422	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:33.517263889 CET	38424	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:33.522139072 CET	6581	38422	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:33.522150993 CET	6581	38424	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:33.522274017 CET	38424	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:33.522353888 CET	38424	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:33.527205944 CET	6581	38424	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:34.979036093 CET	6581	38424	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:34.979259014 CET	38424	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:34.979358912 CET	38426	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:34.984078884 CET	6581	38424	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:34.984129906 CET	6581	38426	89.33.192.138	192.168.2.15
Jan 9, 2025 08:31:34.984189987 CET	38426	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:34.984266996 CET	38426	6581	192.168.2.15	89.33.192.138
Jan 9, 2025 08:31:34.988996983 CET	6581	38426	89.33.192.138	192.168.2.15

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 9, 2025 08:30:47.580184937 CET	52168	53	192.168.2.15	1.1.1.1
Jan 9, 2025 08:30:47.580265045 CET	59969	53	192.168.2.15	1.1.1.1
Jan 9, 2025 08:30:47.586889029 CET	53	59969	1.1.1.1	192.168.2.15
Jan 9, 2025 08:30:47.587276936 CET	53	52168	1.1.1.1	192.168.2.15

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 9, 2025 08:30:47.580184937 CET	192.168.2.15	1.1.1.1	0x826e	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 08:30:47.580265045 CET	192.168.2.15	1.1.1.1	0x8a91	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 9, 2025 08:30:47.587276936 CET	1.1.1.1	192.168.2.15	0x826e	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false
Jan 9, 2025 08:30:47.587276936 CET	1.1.1.1	192.168.2.15	0x826e	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: ss.elf PID: 5545, Parent PID: 5470

General

Start time (UTC):	07:28:00
Start date (UTC):	09/01/2025
Path:	/tmp/ss.elf
Arguments:	/tmp/ss.elf
File size:	92046 bytes
MD5 hash:	d7612a30f87510c9dc2a7058b535e086

Chronological Activities

Analysis Process: ss.elf PID: 5546, Parent PID: 5545

General

Start time (UTC):	07:28:00
Start date (UTC):	09/01/2025
Path:	/tmp/ss.elf
Arguments:	-
File size:	92046 bytes
MD5 hash:	d7612a30f87510c9dc2a7058b535e086

Chronological Activities

Analysis Process: ss.elf PID: 5547, Parent PID: 5546

General

Start time (UTC):	07:28:00
Start date (UTC):	09/01/2025
Path:	/tmp/ss.elf
Arguments:	-
File size:	92046 bytes
MD5 hash:	d7612a30f87510c9dc2a7058b535e086

Description:	Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping or `net view` using Net .
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report ss.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Threatname: Gafgyt

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: ss.elf PID: 5545, Parent PID: 5470

General

Chronological Activities

Analysis Process: ss.elf PID: 5546, Parent PID: 5545

General

Chronological Activities

Analysis Process: ss.elf PID: 5547, Parent PID: 5546

General

Linux Analysis Report
ss.elf