Edit tour

Linux Analysis Report
hidakibest.mpsl.elf

Overview

General Information

Sample name:	hidakibest.mpsl.elf
Analysis ID:	1601858
MD5:	464bfcb3b46453ec67ba3710acd72b8a
SHA1:	f27d549321f84f09cab761077b6e7834c0784e5d
SHA256:	2bf82579fb359cec6396e8acbfc89203f72f175820ab943c312b45a510fb6154
Tags:	elfuser-abuse_ch
Infos:

Detection

Gafgyt, Mirai

Score:	92
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Gafgyt

Yara detected Mirai

Opens /proc/net/* files useful for finding connected devices and routers

Detected TCP or UDP traffic on non-standard ports

Sample contains strings that are user agent strings indicative of HTTP manipulation

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1601858
Start date and time:	2025-01-29 01:12:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	hidakibest.mpsl.elf
Detection:	MAL
Classification:	mal92.spre.troj.linELF@0/0@2/0

Warnings

VT rate limit hit for: 146.19.24.68:4258

Runtime Messages

Command:	/tmp/hidakibest.mpsl.elf
PID:	5431
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

hidakibest.mpsl.elf (PID: 5431, Parent: 5355, MD5: 0d6f61f82cf2f781c6eb0661071d42d9) Arguments: /tmp/hidakibest.mpsl.elf

hidakibest.mpsl.elf New Fork (PID: 5433, Parent: 5431)

hidakibest.mpsl.elf New Fork (PID: 5435, Parent: 5433)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
hidakibest.mpsl.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
hidakibest.mpsl.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
hidakibest.mpsl.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x123e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x123fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12410:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12424:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12438:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1244c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12460:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12474:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12488:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1249c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x124b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x124c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x124d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x124ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12500:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12514:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12528:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1253c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12550:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12564:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12578:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
hidakibest.mpsl.elf	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x12398:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64

Memory Dumps

Source	Rule	Description	Author	Strings
5431.1.00007f4380400000.00007f4380415000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
5431.1.00007f4380400000.00007f4380415000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5431.1.00007f4380400000.00007f4380415000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x123e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x123fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12410:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12424:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12438:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1244c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12460:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12474:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12488:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1249c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x124b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x124c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x124d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x124ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12500:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12514:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12528:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1253c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12550:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12564:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12578:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5431.1.00007f4380400000.00007f4380415000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x12398:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
5433.1.00007f4380400000.00007f4380415000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
5433.1.00007f4380400000.00007f4380415000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5433.1.00007f4380400000.00007f4380415000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x123e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x123fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12410:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12424:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12438:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1244c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12460:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12474:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12488:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1249c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x124b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x124c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x124d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x124ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12500:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12514:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12528:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1253c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12550:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12564:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12578:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5433.1.00007f4380400000.00007f4380415000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x12398:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: hidakibest.mpsl.elf PID: 5431	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: hidakibest.mpsl.elf PID: 5431	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x7906:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x791a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x792e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7942:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7956:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x796a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x797e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7992:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x79a6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x79ba:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x79ce:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x79e2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x79f6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7a0a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7a1e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7a32:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7a46:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7a5a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7a6e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7a82:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7a96:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: hidakibest.mpsl.elf PID: 5431	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x78b9:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x7d2b:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: hidakibest.mpsl.elf PID: 5433	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: hidakibest.mpsl.elf PID: 5433	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x764c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7660:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7674:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7688:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x769c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x76b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x76c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x76d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x76ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7700:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7714:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7728:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x773c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7750:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7764:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7778:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x778c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x77a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x77b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x77c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x77dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: hidakibest.mpsl.elf PID: 5433	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x75ff:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x7a71:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Click to see the 9 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

• AV Detection
• Spreading
• Networking
• System Summary
• Malware Analysis System Evasion
• Stealing of Sensitive Information
• Remote Access Functionality

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: hidakibest.mpsl.elf

Avira: detected

Found malware configuration

Source: hidakibest.mpsl.elf

Malware Configuration Extractor: Gafgyt {"C2 url": "146.19.24.68:4258"}

Multi AV Scanner detection for submitted file

Source: hidakibest.mpsl.elf	Virustotal: Detection: 63%			Perma Link
Source: hidakibest.mpsl.elf	ReversingLabs: Detection: 63%

Spreading

Opens /proc/net/* files useful for finding connected devices and routers

Source: /tmp/hidakibest.mpsl.elf (PID: 5431)

Opens: /proc/net/route

Jump to behavior

Source: global traffic

TCP traffic: 192.168.2.13:60030 -> 146.19.24.68:4258

Source: unknown	TCP traffic detected without corresponding DNS query: 146.19.24.68
Source: unknown	TCP traffic detected without corresponding DNS query: 146.19.24.68
Source: unknown	TCP traffic detected without corresponding DNS query: 146.19.24.68
Source: unknown	TCP traffic detected without corresponding DNS query: 146.19.24.68
Source: unknown	TCP traffic detected without corresponding DNS query: 146.19.24.68
Source: unknown	TCP traffic detected without corresponding DNS query: 146.19.24.68
Source: unknown	TCP traffic detected without corresponding DNS query: 146.19.24.68
Source: unknown	TCP traffic detected without corresponding DNS query: 146.19.24.68
Source: unknown	TCP traffic detected without corresponding DNS query: 146.19.24.68
Source: unknown	TCP traffic detected without corresponding DNS query: 146.19.24.68
Source: unknown	TCP traffic detected without corresponding DNS query: 146.19.24.68
Source: unknown	TCP traffic detected without corresponding DNS query: 146.19.24.68
Source: unknown	TCP traffic detected without corresponding DNS query: 146.19.24.68
Source: unknown	TCP traffic detected without corresponding DNS query: 146.19.24.68
Source: unknown	TCP traffic detected without corresponding DNS query: 146.19.24.68
Source: unknown	TCP traffic detected without corresponding DNS query: 146.19.24.68
Source: unknown	TCP traffic detected without corresponding DNS query: 146.19.24.68
Source: unknown	TCP traffic detected without corresponding DNS query: 146.19.24.68
Source: unknown	TCP traffic detected without corresponding DNS query: 146.19.24.68
Source: unknown	TCP traffic detected without corresponding DNS query: 146.19.24.68
Source: unknown	TCP traffic detected without corresponding DNS query: 146.19.24.68
Source: unknown	TCP traffic detected without corresponding DNS query: 146.19.24.68
Source: unknown	TCP traffic detected without corresponding DNS query: 146.19.24.68
Source: unknown	TCP traffic detected without corresponding DNS query: 146.19.24.68
Source: unknown	TCP traffic detected without corresponding DNS query: 146.19.24.68
Source: unknown	TCP traffic detected without corresponding DNS query: 146.19.24.68
Source: unknown	TCP traffic detected without corresponding DNS query: 146.19.24.68
Source: unknown	TCP traffic detected without corresponding DNS query: 146.19.24.68
Source: unknown	TCP traffic detected without corresponding DNS query: 146.19.24.68
Source: unknown	TCP traffic detected without corresponding DNS query: 146.19.24.68
Source: unknown	TCP traffic detected without corresponding DNS query: 146.19.24.68
Source: unknown	TCP traffic detected without corresponding DNS query: 146.19.24.68
Source: unknown	TCP traffic detected without corresponding DNS query: 146.19.24.68
Source: unknown	TCP traffic detected without corresponding DNS query: 146.19.24.68
Source: unknown	TCP traffic detected without corresponding DNS query: 146.19.24.68
Source: unknown	TCP traffic detected without corresponding DNS query: 146.19.24.68
Source: unknown	TCP traffic detected without corresponding DNS query: 146.19.24.68
Source: unknown	TCP traffic detected without corresponding DNS query: 146.19.24.68
Source: unknown	TCP traffic detected without corresponding DNS query: 146.19.24.68
Source: unknown	TCP traffic detected without corresponding DNS query: 146.19.24.68
Source: unknown	TCP traffic detected without corresponding DNS query: 146.19.24.68
Source: unknown	TCP traffic detected without corresponding DNS query: 146.19.24.68
Source: unknown	TCP traffic detected without corresponding DNS query: 146.19.24.68
Source: unknown	TCP traffic detected without corresponding DNS query: 146.19.24.68
Source: unknown	TCP traffic detected without corresponding DNS query: 146.19.24.68
Source: unknown	TCP traffic detected without corresponding DNS query: 146.19.24.68
Source: unknown	TCP traffic detected without corresponding DNS query: 146.19.24.68
Source: unknown	TCP traffic detected without corresponding DNS query: 146.19.24.68
Source: unknown	TCP traffic detected without corresponding DNS query: 146.19.24.68
Source: unknown	TCP traffic detected without corresponding DNS query: 146.19.24.68

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

Source: hidakibest.mpsl.elf	String found in binary or memory: http://fast.no/support/crawler.asp)
Source: hidakibest.mpsl.elf	String found in binary or memory: http://feedback.redkolibri.com/
Source: hidakibest.mpsl.elf	String found in binary or memory: http://www.baidu.com/search/spider.htm)
Source: hidakibest.mpsl.elf	String found in binary or memory: http://www.baidu.com/search/spider.html)
Source: hidakibest.mpsl.elf	String found in binary or memory: http://www.billybobbot.com/crawler/)

System Summary

Malicious sample detected (through community Yara rule)

Source: hidakibest.mpsl.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: hidakibest.mpsl.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5431.1.00007f4380400000.00007f4380415000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5431.1.00007f4380400000.00007f4380415000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5433.1.00007f4380400000.00007f4380415000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5433.1.00007f4380400000.00007f4380415000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: hidakibest.mpsl.elf PID: 5431, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: hidakibest.mpsl.elf PID: 5431, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: hidakibest.mpsl.elf PID: 5433, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: hidakibest.mpsl.elf PID: 5433, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown

Source: hidakibest.mpsl.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: hidakibest.mpsl.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5431.1.00007f4380400000.00007f4380415000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5431.1.00007f4380400000.00007f4380415000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5433.1.00007f4380400000.00007f4380415000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5433.1.00007f4380400000.00007f4380415000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: hidakibest.mpsl.elf PID: 5431, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: hidakibest.mpsl.elf PID: 5431, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: hidakibest.mpsl.elf PID: 5433, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: hidakibest.mpsl.elf PID: 5433, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16

Source: classification engine

Classification label: mal92.spre.troj.linELF@0/0@2/0

Source: hidakibest.mpsl.elf	ELF static info symbol of initial sample: libc/string/mips/memcpy.S
Source: hidakibest.mpsl.elf	ELF static info symbol of initial sample: libc/string/mips/memset.S
Source: hidakibest.mpsl.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/mips/crt1.S
Source: hidakibest.mpsl.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/mips/crti.S
Source: hidakibest.mpsl.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/mips/crtn.S

Source: /tmp/hidakibest.mpsl.elf (PID: 5431)

Queries kernel information via 'uname':

Jump to behavior

Source: hidakibest.mpsl.elf, 5431.1.000056492e538000.000056492e5bf000.rw-.sdmp, hidakibest.mpsl.elf, 5433.1.000056492e538000.000056492e5bf000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/mipsel
Source: hidakibest.mpsl.elf, 5431.1.00007ffcc203e000.00007ffcc205f000.rw-.sdmp, hidakibest.mpsl.elf, 5433.1.00007ffcc203e000.00007ffcc205f000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-mipsel/tmp/hidakibest.mpsl.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/hidakibest.mpsl.elf
Source: hidakibest.mpsl.elf, 5431.1.000056492e538000.000056492e5bf000.rw-.sdmp, hidakibest.mpsl.elf, 5433.1.000056492e538000.000056492e5bf000.rw-.sdmp	Binary or memory string: T.IV!/etc/qemu-binfmt/mipsel
Source: hidakibest.mpsl.elf, 5431.1.00007ffcc203e000.00007ffcc205f000.rw-.sdmp, hidakibest.mpsl.elf, 5433.1.00007ffcc203e000.00007ffcc205f000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-mipsel

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match	File source: hidakibest.mpsl.elf, type: SAMPLE
Source: Yara match	File source: 5431.1.00007f4380400000.00007f4380415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5433.1.00007f4380400000.00007f4380415000.r-x.sdmp, type: MEMORY

Yara detected Mirai

Source: Yara match	File source: hidakibest.mpsl.elf, type: SAMPLE
Source: Yara match	File source: 5431.1.00007f4380400000.00007f4380415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5433.1.00007f4380400000.00007f4380415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: hidakibest.mpsl.elf PID: 5431, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: hidakibest.mpsl.elf PID: 5433, type: MEMORYSTR

Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36
Source: Initial sample	User agent string found: Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; rv:2.2) Gecko/20110201
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.2; U; ru) Presto/2.5.22 Version/10.51
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko
Source: Initial sample	User agent string found: Mozilla/5.0 (Android; Linux armv7l; rv:9.0) Gecko/20111216 Firefox/9.0 Fennec/9.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60
Source: Initial sample	User agent string found: Mozilla/5.0 (iPad; U; CPU OS 5_1 like Mac OS X) AppleWebKit/531.21.10 (KHTML, like Gecko) Version/4.0.4 Mobile/7B367 Safari/531.21.10 UCBrowser/3.4.3.532
Source: Initial sample	User agent string found: Mozilla/5.0 (Nintendo WiiU) AppleWebKit/536.30 (KHTML, like Gecko) NX/3.0.4.2.12 NintendoBrowser/4.3.1.11264.US
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:25.0) Gecko/20100101 Firefox/25.0
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; pl) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; en) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; ja) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; cn) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; fr) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20100101 Firefox/12.0
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; U; Linux x86_64; de; rv:1.9.2.8) Gecko/20100723 Ubuntu/10.04 (lucid) Firefox/3.6.8
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; rv:13.0) Gecko/20100101 Firefox/13.0.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:11.0) Gecko/20100101 Firefox/11.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:13.0) Gecko/20100101 Firefox/13.0.1
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.289 Version/12.01
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.02
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.0) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.112 Safari/535.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36

Remote Access Functionality

Yara detected Gafgyt

Source: Yara match	File source: hidakibest.mpsl.elf, type: SAMPLE
Source: Yara match	File source: 5431.1.00007f4380400000.00007f4380415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5433.1.00007f4380400000.00007f4380415000.r-x.sdmp, type: MEMORY

Yara detected Mirai

Source: Yara match	File source: hidakibest.mpsl.elf, type: SAMPLE
Source: Yara match	File source: 5431.1.00007f4380400000.00007f4380415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5433.1.00007f4380400000.00007f4380415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: hidakibest.mpsl.elf PID: 5431, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: hidakibest.mpsl.elf PID: 5433, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	1 Remote System Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

Threatname: Gafgyt

{
  "C2 url": "146.19.24.68:4258"
}

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
hidakibest.mpsl.elf	63%	Virustotal		Browse
hidakibest.mpsl.elf	63%	ReversingLabs	Linux.Trojan.Mirai
hidakibest.mpsl.elf	100%	Avira	EXP/ELF.Mirai.Z.A

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.25	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
146.19.24.68:4258	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://www.baidu.com/search/spider.html)	hidakibest.mpsl.elf	false	high
http://www.billybobbot.com/crawler/)	hidakibest.mpsl.elf	false	high
http://fast.no/support/crawler.asp)	hidakibest.mpsl.elf	false	high
http://feedback.redkolibri.com/	hidakibest.mpsl.elf	false	high
http://www.baidu.com/search/spider.htm)	hidakibest.mpsl.elf	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
146.19.24.68	unknown	France		7726	FITC-ASUS	true

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
146.19.24.68	hidakibest.mips.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	hidakibest.ppc.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	hidakibest.arm6.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	hidakibest.x86.elf	Get hash	malicious	Mirai, Gafgyt	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	hidakibest.ppc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.25
	hidakibest.arm6.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	hidakibest.x86.elf	Get hash	malicious	Mirai, Gafgyt	Browse	162.213.35.24
	sora.ppc.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	h.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	arm6.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	arc.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	s.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.25
	arm5.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	debug.dbg.elf	Get hash	malicious	Mirai, Moobot	Browse	162.213.35.25

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FITC-ASUS	hidakibest.mips.elf	Get hash	malicious	Gafgyt, Mirai	Browse	146.19.24.68
	hidakibest.ppc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	146.19.24.68
	hidakibest.arm6.elf	Get hash	malicious	Gafgyt, Mirai	Browse	146.19.24.68
	hidakibest.x86.elf	Get hash	malicious	Mirai, Gafgyt	Browse	146.19.24.68
	mpsl.elf	Get hash	malicious	Unknown	Browse	170.5.226.189
	https://svsteam.info/	Get hash	malicious	Unknown	Browse	146.19.233.209
	156.229.229.101-x86-2025-01-24T01_03_03.elf	Get hash	malicious	Mirai, Moobot	Browse	155.161.131.57
	sora.mips.elf	Get hash	malicious	Mirai	Browse	198.141.46.244
	sh4.elf	Get hash	malicious	Mirai, Moobot	Browse	170.87.133.27
	zte	Get hash	malicious	Unknown	Browse	199.83.20.11

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, not stripped
Entropy (8bit):	5.456442893823446
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	hidakibest.mpsl.elf
File size:	114'719 bytes
MD5:	464bfcb3b46453ec67ba3710acd72b8a
SHA1:	f27d549321f84f09cab761077b6e7834c0784e5d
SHA256:	2bf82579fb359cec6396e8acbfc89203f72f175820ab943c312b45a510fb6154
SHA512:	31fccec1e51663ccd118b096e6584661103a1660117e25ece460ed42a08c6b79fcb4e5a5c01b320430357b19a8bc38af2c44736eed44f78eec10d3555846f0ed
SSDEEP:	3072:7rfMt6MUEproqy5hY1zVKdwwzF9GhsRiAe:3vMzproqy5hYNVKdwwzF9GhsRiAe
TLSH:	B4B3E917FB61CEB7C85FCD730AAA4605108EA99756D46B6B73B4C96CE70694F08E3C80
File Content Preview:	.ELF......................@.4...4u......4. ...(........p......@...@...........................@...@..C...C...............C...CE..CE.8....q..........Q.td..................................................E....<D..'!......'.......................< ..'!... ..

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	MIPS R3000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x4002a0
Flags:	0x1007
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	4
Section Header Offset:	95540
Section Header Size:	40
Number of Section Headers:	21
Header String Table Index:	18

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.reginfo	MIPS_REGINFO	0x4000b4	0xb4	0x18	0x18	0x2	A	0	0	4
.init	PROGBITS	0x4000cc	0xcc	0x8c	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x400160	0x160	0x10620	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x410780	0x10780	0x5c	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x4107e0	0x107e0	0x3b34	0x0	0x2	A	0	0	16
.eh_frame	PROGBITS	0x414314	0x14314	0x4	0x0	0x2	A	0	0	4
.ctors	PROGBITS	0x454318	0x14318	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x454320	0x14320	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x454328	0x14328	0x4	0x0	0x3	WA	0	0	4
.data.rel.ro	PROGBITS	0x45432c	0x1432c	0x4d0	0x0	0x3	WA	0	0	4
.data	PROGBITS	0x454800	0x14800	0x520	0x0	0x3	WA	0	0	16
.got	PROGBITS	0x454d20	0x14d20	0x430	0x4	0x10000003	WAp	0	0	16
.sbss	NOBITS	0x455150	0x15150	0x18	0x0	0x10000003	WAp	0	0	4
.bss	NOBITS	0x455170	0x15150	0x63a4	0x0	0x3	WA	0	0	16
.comment	PROGBITS	0x0	0x15150	0xa68	0x0	0x0		0	0	1
.mdebug.abi32	PROGBITS	0xa68	0x15bb8	0x0	0x0	0x0		0	0	1
.pdr	PROGBITS	0x0	0x15bb8	0x18e0	0x0	0x0		0	0	4
.shstrtab	STRTAB	0x0	0x17498	0x9a	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x1787c	0x28f0	0x10	0x0		20	283	4
.strtab	STRTAB	0x0	0x1a16c	0x1eb3	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
<unknown>	0xb4	0x4000b4	0x4000b4	0x18	0x18	0.9834	0x4	R	0x4	.reginfo
LOAD	0x0	0x400000	0x400000	0x14318	0x14318	5.5009	0x5	R E	0x10000	.reginfo .init .text .fini .rodata .eh_frame
LOAD	0x14318	0x454318	0x454318	0xe38	0x71fc	4.4023	0x6	RW	0x10000	.ctors .dtors .jcr .data.rel.ro .data .got .sbss .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x4000b4	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x4000cc	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x400160	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x410780	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x4107e0	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x414314	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x454318	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x454320	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x454328	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x45432c	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x454800	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x454d20	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x455150	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x455170	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0xa68	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	19
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	20
C.72.4725	.symtab	0x45432c	104	OBJECT	<unknown>	DEFAULT	10
C.82.4830	.symtab	0x454394	1128	OBJECT	<unknown>	DEFAULT	10
Q	.symtab	0x4551a8	16384	OBJECT	<unknown>	DEFAULT	14
Randhex	.symtab	0x402c10	688	FUNC	<unknown>	DEFAULT	3
SendSTD	.symtab	0x402548	680	FUNC	<unknown>	DEFAULT	3
UDPRAW	.symtab	0x402a00	528	FUNC	<unknown>	DEFAULT	3
_GLOBAL_OFFSET_TABLE_	.symtab	0x454d20	0	OBJECT	<unknown>	DEFAULT	12
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x45431c	0	OBJECT	<unknown>	DEFAULT	7
__CTOR_LIST__	.symtab	0x454318	0	OBJECT	<unknown>	DEFAULT	7
__C_ctype_b	.symtab	0x454940	4	OBJECT	<unknown>	DEFAULT	11
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x412b80	768	OBJECT	<unknown>	DEFAULT	5
__C_ctype_tolower	.symtab	0x454cc0	4	OBJECT	<unknown>	DEFAULT	11
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x413eb0	768	OBJECT	<unknown>	DEFAULT	5
__C_ctype_toupper	.symtab	0x454950	4	OBJECT	<unknown>	DEFAULT	11
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x412e80	768	OBJECT	<unknown>	DEFAULT	5
__DTOR_END__	.symtab	0x454324	0	OBJECT	<unknown>	DEFAULT	8
__DTOR_LIST__	.symtab	0x454320	0	OBJECT	<unknown>	DEFAULT	8
__EH_FRAME_BEGIN__	.symtab	0x414314	0	OBJECT	<unknown>	DEFAULT	6
__FRAME_END__	.symtab	0x414314	0	OBJECT	<unknown>	DEFAULT	6
__GI___C_ctype_b	.symtab	0x454940	4	OBJECT	<unknown>	HIDDEN	11
__GI___C_ctype_b_data	.symtab	0x412b80	768	OBJECT	<unknown>	HIDDEN	5
__GI___C_ctype_tolower	.symtab	0x454cc0	4	OBJECT	<unknown>	HIDDEN	11
__GI___C_ctype_tolower_data	.symtab	0x413eb0	768	OBJECT	<unknown>	HIDDEN	5
__GI___C_ctype_toupper	.symtab	0x454950	4	OBJECT	<unknown>	HIDDEN	11
__GI___C_ctype_toupper_data	.symtab	0x412e80	768	OBJECT	<unknown>	HIDDEN	5
__GI___ctype_b	.symtab	0x454944	4	OBJECT	<unknown>	HIDDEN	11
__GI___ctype_tolower	.symtab	0x454cc4	4	OBJECT	<unknown>	HIDDEN	11
__GI___ctype_toupper	.symtab	0x454954	4	OBJECT	<unknown>	HIDDEN	11
__GI___errno_location	.symtab	0x406760	24	FUNC	<unknown>	HIDDEN	3
__GI___fgetc_unlocked	.symtab	0x4100d0	388	FUNC	<unknown>	HIDDEN	3
__GI___glibc_strerror_r	.symtab	0x4085c0	68	FUNC	<unknown>	HIDDEN	3
__GI___h_errno_location	.symtab	0x40b1d0	24	FUNC	<unknown>	HIDDEN	3
__GI___libc_fcntl	.symtab	0x406090	136	FUNC	<unknown>	HIDDEN	3
__GI___libc_fcntl64	.symtab	0x406120	104	FUNC	<unknown>	HIDDEN	3
__GI___libc_open	.symtab	0x406430	124	FUNC	<unknown>	HIDDEN	3
__GI___uClibc_fini	.symtab	0x40a7c0	196	FUNC	<unknown>	HIDDEN	3
__GI___uClibc_init	.symtab	0x40a91c	140	FUNC	<unknown>	HIDDEN	3
__GI___xpg_strerror_r	.symtab	0x408610	392	FUNC	<unknown>	HIDDEN	3
__GI__exit	.symtab	0x406190	80	FUNC	<unknown>	HIDDEN	3
__GI_abort	.symtab	0x40d950	428	FUNC	<unknown>	HIDDEN	3
__GI_atoi	.symtab	0x40a200	28	FUNC	<unknown>	HIDDEN	3
__GI_atol	.symtab	0x40a200	28	FUNC	<unknown>	HIDDEN	3
__GI_brk	.symtab	0x40db30	112	FUNC	<unknown>	HIDDEN	3
__GI_chdir	.symtab	0x4061e0	88	FUNC	<unknown>	HIDDEN	3
__GI_close	.symtab	0x406240	84	FUNC	<unknown>	HIDDEN	3
__GI_connect	.symtab	0x408ff0	84	FUNC	<unknown>	HIDDEN	3
__GI_errno	.symtab	0x45b410	4	OBJECT	<unknown>	HIDDEN	14
__GI_exit	.symtab	0x40a490	236	FUNC	<unknown>	HIDDEN	3
__GI_fclose	.symtab	0x40dc00	512	FUNC	<unknown>	HIDDEN	3
__GI_fcntl	.symtab	0x406090	136	FUNC	<unknown>	HIDDEN	3
__GI_fcntl64	.symtab	0x406120	104	FUNC	<unknown>	HIDDEN	3
__GI_fflush_unlocked	.symtab	0x40e790	628	FUNC	<unknown>	HIDDEN	3
__GI_fgetc_unlocked	.symtab	0x4100d0	388	FUNC	<unknown>	HIDDEN	3
__GI_fgets	.symtab	0x40e520	216	FUNC	<unknown>	HIDDEN	3
__GI_fgets_unlocked	.symtab	0x40ea10	268	FUNC	<unknown>	HIDDEN	3
__GI_fopen	.symtab	0x40de00	28	FUNC	<unknown>	HIDDEN	3
__GI_fork	.symtab	0x4062a0	84	FUNC	<unknown>	HIDDEN	3
__GI_fputs_unlocked	.symtab	0x407e30	128	FUNC	<unknown>	HIDDEN	3
__GI_fseek	.symtab	0x40de20	68	FUNC	<unknown>	HIDDEN	3
__GI_fseeko64	.symtab	0x40de70	388	FUNC	<unknown>	HIDDEN	3
__GI_fwrite_unlocked	.symtab	0x407eb0	280	FUNC	<unknown>	HIDDEN	3
__GI_getc_unlocked	.symtab	0x4100d0	388	FUNC	<unknown>	HIDDEN	3
__GI_getegid	.symtab	0x40ae60	88	FUNC	<unknown>	HIDDEN	3
__GI_geteuid	.symtab	0x40aec0	88	FUNC	<unknown>	HIDDEN	3
__GI_getgid	.symtab	0x40af20	84	FUNC	<unknown>	HIDDEN	3
__GI_gethostbyname	.symtab	0x408b10	116	FUNC	<unknown>	HIDDEN	3
__GI_gethostbyname_r	.symtab	0x408b90	1108	FUNC	<unknown>	HIDDEN	3
__GI_getpid	.symtab	0x406300	84	FUNC	<unknown>	HIDDEN	3
__GI_getsockname	.symtab	0x409050	84	FUNC	<unknown>	HIDDEN	3
__GI_getuid	.symtab	0x40af80	84	FUNC	<unknown>	HIDDEN	3
__GI_h_errno	.symtab	0x45b414	4	OBJECT	<unknown>	HIDDEN	14
__GI_inet_addr	.symtab	0x408ac0	72	FUNC	<unknown>	HIDDEN	3
__GI_inet_aton	.symtab	0x40c9d0	280	FUNC	<unknown>	HIDDEN	3
__GI_inet_ntoa	.symtab	0x408a9c	32	FUNC	<unknown>	HIDDEN	3
__GI_inet_ntoa_r	.symtab	0x4089e0	188	FUNC	<unknown>	HIDDEN	3
__GI_inet_ntop	.symtab	0x40f330	852	FUNC	<unknown>	HIDDEN	3
__GI_inet_pton	.symtab	0x40ee80	700	FUNC	<unknown>	HIDDEN	3
__GI_initstate_r	.symtab	0x40a0b0	328	FUNC	<unknown>	HIDDEN	3
__GI_ioctl	.symtab	0x406360	104	FUNC	<unknown>	HIDDEN	3
__GI_isatty	.symtab	0x408870	60	FUNC	<unknown>	HIDDEN	3
__GI_kill	.symtab	0x4063d0	88	FUNC	<unknown>	HIDDEN	3
__GI_lseek64	.symtab	0x40ffe0	164	FUNC	<unknown>	HIDDEN	3
__GI_memchr	.symtab	0x40c260	264	FUNC	<unknown>	HIDDEN	3
__GI_memcpy	.symtab	0x407fd0	308	FUNC	<unknown>	HIDDEN	3
__GI_memmove	.symtab	0x40c370	816	FUNC	<unknown>	HIDDEN	3
__GI_mempcpy	.symtab	0x40c6a0	76	FUNC	<unknown>	HIDDEN	3
__GI_memrchr	.symtab	0x40c6f0	272	FUNC	<unknown>	HIDDEN	3
__GI_memset	.symtab	0x408110	144	FUNC	<unknown>	HIDDEN	3
__GI_nanosleep	.symtab	0x40afe0	84	FUNC	<unknown>	HIDDEN	3
__GI_open	.symtab	0x406430	124	FUNC	<unknown>	HIDDEN	3
__GI_poll	.symtab	0x40dba0	84	FUNC	<unknown>	HIDDEN	3
__GI_raise	.symtab	0x40ff90	76	FUNC	<unknown>	HIDDEN	3
__GI_random	.symtab	0x409a80	164	FUNC	<unknown>	HIDDEN	3
__GI_random_r	.symtab	0x409e8c	176	FUNC	<unknown>	HIDDEN	3
__GI_rawmemchr	.symtab	0x40eb20	200	FUNC	<unknown>	HIDDEN	3
__GI_read	.symtab	0x4064d0	84	FUNC	<unknown>	HIDDEN	3
__GI_recv	.symtab	0x409130	84	FUNC	<unknown>	HIDDEN	3
__GI_sbrk	.symtab	0x40b040	144	FUNC	<unknown>	HIDDEN	3
__GI_select	.symtab	0x406530	120	FUNC	<unknown>	HIDDEN	3
__GI_send	.symtab	0x409190	84	FUNC	<unknown>	HIDDEN	3
__GI_setsid	.symtab	0x4065b0	84	FUNC	<unknown>	HIDDEN	3
__GI_setsockopt	.symtab	0x4091f0	120	FUNC	<unknown>	HIDDEN	3
__GI_setstate_r	.symtab	0x409d50	316	FUNC	<unknown>	HIDDEN	3
__GI_sigaction	.symtab	0x40ad10	232	FUNC	<unknown>	HIDDEN	3
__GI_signal	.symtab	0x4092d0	252	FUNC	<unknown>	HIDDEN	3
__GI_sigprocmask	.symtab	0x40b0d0	148	FUNC	<unknown>	HIDDEN	3
__GI_sleep	.symtab	0x40a580	564	FUNC	<unknown>	HIDDEN	3
__GI_socket	.symtab	0x409270	84	FUNC	<unknown>	HIDDEN	3
__GI_sprintf	.symtab	0x406780	80	FUNC	<unknown>	HIDDEN	3
__GI_srandom_r	.symtab	0x409f3c	372	FUNC	<unknown>	HIDDEN	3
__GI_strcasecmp	.symtab	0x4087e0	108	FUNC	<unknown>	HIDDEN	3
__GI_strchr	.symtab	0x4081a0	256	FUNC	<unknown>	HIDDEN	3
__GI_strcmp	.symtab	0x4082a0	44	FUNC	<unknown>	HIDDEN	3
__GI_strcoll	.symtab	0x4082a0	44	FUNC	<unknown>	HIDDEN	3
__GI_strcpy	.symtab	0x4082d0	36	FUNC	<unknown>	HIDDEN	3
__GI_strdup	.symtab	0x40ed00	144	FUNC	<unknown>	HIDDEN	3
__GI_strlen	.symtab	0x408300	184	FUNC	<unknown>	HIDDEN	3
__GI_strncat	.symtab	0x40ebf0	180	FUNC	<unknown>	HIDDEN	3
__GI_strncpy	.symtab	0x40c800	188	FUNC	<unknown>	HIDDEN	3
__GI_strnlen	.symtab	0x4083c0	256	FUNC	<unknown>	HIDDEN	3
__GI_strpbrk	.symtab	0x40c990	64	FUNC	<unknown>	HIDDEN	3
__GI_strspn	.symtab	0x40ecb0	76	FUNC	<unknown>	HIDDEN	3
__GI_strstr	.symtab	0x4084c0	256	FUNC	<unknown>	HIDDEN	3
__GI_strtok	.symtab	0x408850	32	FUNC	<unknown>	HIDDEN	3
__GI_strtok_r	.symtab	0x40c8c0	204	FUNC	<unknown>	HIDDEN	3
__GI_strtol	.symtab	0x40a220	28	FUNC	<unknown>	HIDDEN	3
__GI_tcgetattr	.symtab	0x4088b0	176	FUNC	<unknown>	HIDDEN	3
__GI_time	.symtab	0x406610	84	FUNC	<unknown>	HIDDEN	3
__GI_tolower	.symtab	0x410090	60	FUNC	<unknown>	HIDDEN	3
__GI_toupper	.symtab	0x406720	60	FUNC	<unknown>	HIDDEN	3
__GI_vsnprintf	.symtab	0x4067d0	260	FUNC	<unknown>	HIDDEN	3
__GI_wait4	.symtab	0x40b170	88	FUNC	<unknown>	HIDDEN	3
__GI_waitpid	.symtab	0x406670	28	FUNC	<unknown>	HIDDEN	3
__GI_wcrtomb	.symtab	0x40b1f0	112	FUNC	<unknown>	HIDDEN	3
__GI_wcsnrtombs	.symtab	0x40b2a0	228	FUNC	<unknown>	HIDDEN	3
__GI_wcsrtombs	.symtab	0x40b260	64	FUNC	<unknown>	HIDDEN	3
__GI_write	.symtab	0x406690	84	FUNC	<unknown>	HIDDEN	3
__JCR_END__	.symtab	0x454328	0	OBJECT	<unknown>	DEFAULT	9
__JCR_LIST__	.symtab	0x454328	0	OBJECT	<unknown>	DEFAULT	9
__app_fini	.symtab	0x45b3fc	4	OBJECT	<unknown>	HIDDEN	14
__atexit_lock	.symtab	0x454c90	24	OBJECT	<unknown>	DEFAULT	11
__bsd_signal	.symtab	0x4092d0	252	FUNC	<unknown>	HIDDEN	3
__bss_start	.symtab	0x455150	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x40a894	136	FUNC	<unknown>	DEFAULT	3
__ctype_b	.symtab	0x454944	4	OBJECT	<unknown>	DEFAULT	11
__ctype_tolower	.symtab	0x454cc4	4	OBJECT	<unknown>	DEFAULT	11
__ctype_toupper	.symtab	0x454954	4	OBJECT	<unknown>	DEFAULT	11
__curbrk	.symtab	0x45b450	4	OBJECT	<unknown>	HIDDEN	14
__data_start	.symtab	0x454820	0	OBJECT	<unknown>	DEFAULT	11
__decode_answer	.symtab	0x40f990	340	FUNC	<unknown>	HIDDEN	3
__decode_dotted	.symtab	0x410380	340	FUNC	<unknown>	HIDDEN	3
__decode_header	.symtab	0x40f7a0	228	FUNC	<unknown>	HIDDEN	3
__deregister_frame_info	.symtab	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__dns_lookup	.symtab	0x40caf0	2568	FUNC	<unknown>	HIDDEN	3
__do_global_ctors_aux	.symtab	0x410710	0	FUNC	<unknown>	DEFAULT	3
__do_global_dtors_aux	.symtab	0x400160	0	FUNC	<unknown>	DEFAULT	3
__dso_handle	.symtab	0x454800	0	OBJECT	<unknown>	HIDDEN	11
__encode_dotted	.symtab	0x410260	280	FUNC	<unknown>	HIDDEN	3
__encode_header	.symtab	0x40f690	272	FUNC	<unknown>	HIDDEN	3
__encode_question	.symtab	0x40f890	172	FUNC	<unknown>	HIDDEN	3
__environ	.symtab	0x45b3f4	4	OBJECT	<unknown>	DEFAULT	14
__errno_location	.symtab	0x406760	24	FUNC	<unknown>	DEFAULT	3
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x45b3e0	4	OBJECT	<unknown>	HIDDEN	14
__fgetc_unlocked	.symtab	0x4100d0	388	FUNC	<unknown>	DEFAULT	3
__fini_array_end	.symtab	0x454318	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fini_array_start	.symtab	0x454318	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__get_hosts_byname_r	.symtab	0x40d8e0	104	FUNC	<unknown>	HIDDEN	3
__glibc_strerror_r	.symtab	0x4085c0	68	FUNC	<unknown>	DEFAULT	3
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__h_errno_location	.symtab	0x40b1d0	24	FUNC	<unknown>	DEFAULT	3
__h_errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__heap_alloc	.symtab	0x4097e0	188	FUNC	<unknown>	DEFAULT	3
__heap_free	.symtab	0x4098e8	364	FUNC	<unknown>	DEFAULT	3
__heap_link_free_area	.symtab	0x4098a0	44	FUNC	<unknown>	DEFAULT	3
__heap_link_free_area_after	.symtab	0x4098cc	28	FUNC	<unknown>	DEFAULT	3
__init_array_end	.symtab	0x454318	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__init_array_start	.symtab	0x454318	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__length_dotted	.symtab	0x4104e0	72	FUNC	<unknown>	HIDDEN	3
__length_question	.symtab	0x40f940	72	FUNC	<unknown>	HIDDEN	3
__libc_close	.symtab	0x406240	84	FUNC	<unknown>	DEFAULT	3
__libc_connect	.symtab	0x408ff0	84	FUNC	<unknown>	DEFAULT	3
__libc_creat	.symtab	0x4064ac	28	FUNC	<unknown>	DEFAULT	3
__libc_fcntl	.symtab	0x406090	136	FUNC	<unknown>	DEFAULT	3
__libc_fcntl64	.symtab	0x406120	104	FUNC	<unknown>	DEFAULT	3
__libc_fork	.symtab	0x4062a0	84	FUNC	<unknown>	DEFAULT	3
__libc_getpid	.symtab	0x406300	84	FUNC	<unknown>	DEFAULT	3
__libc_lseek64	.symtab	0x40ffe0	164	FUNC	<unknown>	DEFAULT	3
__libc_nanosleep	.symtab	0x40afe0	84	FUNC	<unknown>	DEFAULT	3
__libc_open	.symtab	0x406430	124	FUNC	<unknown>	DEFAULT	3
__libc_poll	.symtab	0x40dba0	84	FUNC	<unknown>	DEFAULT	3
__libc_read	.symtab	0x4064d0	84	FUNC	<unknown>	DEFAULT	3
__libc_recv	.symtab	0x409130	84	FUNC	<unknown>	DEFAULT	3
__libc_select	.symtab	0x406530	120	FUNC	<unknown>	DEFAULT	3
__libc_send	.symtab	0x409190	84	FUNC	<unknown>	DEFAULT	3
__libc_sigaction	.symtab	0x40ad10	232	FUNC	<unknown>	DEFAULT	3
__libc_stack_end	.symtab	0x45b3f0	4	OBJECT	<unknown>	DEFAULT	14
__libc_waitpid	.symtab	0x406670	28	FUNC	<unknown>	DEFAULT	3
__libc_write	.symtab	0x406690	84	FUNC	<unknown>	DEFAULT	3
__malloc_heap	.symtab	0x454bc0	4	OBJECT	<unknown>	DEFAULT	11
__malloc_heap_lock	.symtab	0x45b3c0	24	OBJECT	<unknown>	DEFAULT	14
__malloc_sbrk_lock	.symtab	0x45b4e0	24	OBJECT	<unknown>	DEFAULT	14
__nameserver	.symtab	0x45b508	12	OBJECT	<unknown>	HIDDEN	14
__nameservers	.symtab	0x455158	4	OBJECT	<unknown>	HIDDEN	13
__open_etc_hosts	.symtab	0x40faf0	108	FUNC	<unknown>	HIDDEN	3
__open_nameservers	.symtab	0x40d500	984	FUNC	<unknown>	HIDDEN	3
__pagesize	.symtab	0x45b3f8	4	OBJECT	<unknown>	DEFAULT	14
__preinit_array_end	.symtab	0x454318	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__preinit_array_start	.symtab	0x454318	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__pthread_initialize_minimal	.symtab	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0x40a884	8	FUNC	<unknown>	DEFAULT	3
__pthread_mutex_lock	.symtab	0x40a884	8	FUNC	<unknown>	DEFAULT	3
__pthread_mutex_trylock	.symtab	0x40a884	8	FUNC	<unknown>	DEFAULT	3
__pthread_mutex_unlock	.symtab	0x40a884	8	FUNC	<unknown>	DEFAULT	3
__pthread_return_0	.symtab	0x40a884	8	FUNC	<unknown>	DEFAULT	3
__pthread_return_void	.symtab	0x40a88c	8	FUNC	<unknown>	DEFAULT	3
__raise	.symtab	0x40ff90	76	FUNC	<unknown>	HIDDEN	3
__read_etc_hosts_r	.symtab	0x40fb5c	1076	FUNC	<unknown>	HIDDEN	3
__register_frame_info	.symtab	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__resolv_lock	.symtab	0x454ce0	24	OBJECT	<unknown>	DEFAULT	11
__rtld_fini	.symtab	0x45b400	4	OBJECT	<unknown>	HIDDEN	14
__searchdomain	.symtab	0x45b4f8	16	OBJECT	<unknown>	HIDDEN	14
__searchdomains	.symtab	0x45515c	4	OBJECT	<unknown>	HIDDEN	13
__sigaddset	.symtab	0x4093f8	44	FUNC	<unknown>	DEFAULT	3
__sigdelset	.symtab	0x409424	48	FUNC	<unknown>	DEFAULT	3
__sigismember	.symtab	0x4093d0	40	FUNC	<unknown>	DEFAULT	3
__start	.symtab	0x4002a0	100	FUNC	<unknown>	DEFAULT	3
__stdin	.symtab	0x4549ac	4	OBJECT	<unknown>	DEFAULT	11
__stdio_READ	.symtab	0x410530	140	FUNC	<unknown>	HIDDEN	3
__stdio_WRITE	.symtab	0x40b390	280	FUNC	<unknown>	HIDDEN	3
__stdio_adjust_position	.symtab	0x40e000	320	FUNC	<unknown>	HIDDEN	3
__stdio_fwrite	.symtab	0x40b4b0	472	FUNC	<unknown>	HIDDEN	3
__stdio_init_mutex	.symtab	0x406998	32	FUNC	<unknown>	HIDDEN	3
__stdio_mutex_initializer.3833	.symtab	0x413180	24	OBJECT	<unknown>	DEFAULT	5
__stdio_rfill	.symtab	0x4105c0	88	FUNC	<unknown>	HIDDEN	3
__stdio_seek	.symtab	0x40e4b0	112	FUNC	<unknown>	HIDDEN	3
__stdio_trans2r_o	.symtab	0x410620	228	FUNC	<unknown>	HIDDEN	3
__stdio_trans2w_o	.symtab	0x40b690	308	FUNC	<unknown>	HIDDEN	3
__stdio_wcommit	.symtab	0x406ae0	100	FUNC	<unknown>	HIDDEN	3
__stdout	.symtab	0x4549b0	4	OBJECT	<unknown>	DEFAULT	11
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_rt_sigaction	.symtab	0x40ae00	84	FUNC	<unknown>	HIDDEN	3
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uClibc_fini	.symtab	0x40a7c0	196	FUNC	<unknown>	DEFAULT	3
__uClibc_init	.symtab	0x40a91c	140	FUNC	<unknown>	DEFAULT	3
__uClibc_main	.symtab	0x40a9a8	864	FUNC	<unknown>	DEFAULT	3
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x454cb0	4	OBJECT	<unknown>	HIDDEN	11
__xpg_strerror_r	.symtab	0x408610	392	FUNC	<unknown>	DEFAULT	3
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_charpad	.symtab	0x406b50	128	FUNC	<unknown>	DEFAULT	3
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_dl_aux_init	.symtab	0x40db00	44	FUNC	<unknown>	DEFAULT	3
_dl_phdr	.symtab	0x455160	4	OBJECT	<unknown>	DEFAULT	13
_dl_phnum	.symtab	0x455164	4	OBJECT	<unknown>	DEFAULT	13
_edata	.symtab	0x455150	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x45b514	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_errno	.symtab	0x45b410	4	OBJECT	<unknown>	DEFAULT	14
_exit	.symtab	0x406190	80	FUNC	<unknown>	DEFAULT	3
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fbss	.symtab	0x455150	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_fdata	.symtab	0x454800	0	NOTYPE	<unknown>	DEFAULT	11
_fini	.symtab	0x410780	28	FUNC	<unknown>	DEFAULT	4
_fixed_buffers	.symtab	0x4591b8	8192	OBJECT	<unknown>	DEFAULT	14
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x406bd0	228	FUNC	<unknown>	DEFAULT	3
_fpmaxtostr	.symtab	0x40ba10	2120	FUNC	<unknown>	HIDDEN	3
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ftext	.symtab	0x400160	0	NOTYPE	<unknown>	DEFAULT	3
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_gp	.symtab	0x45cd10	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_gp_disp	.symtab	0x0	0	OBJECT	<unknown>	DEFAULT	SHN_UNDEF
_h_errno	.symtab	0x45b414	4	OBJECT	<unknown>	DEFAULT	14
_init	.symtab	0x4000cc	28	FUNC	<unknown>	DEFAULT	2
_load_inttype	.symtab	0x40b7d0	136	FUNC	<unknown>	HIDDEN	3
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_init	.symtab	0x407460	220	FUNC	<unknown>	HIDDEN	3
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x40783c	1512	FUNC	<unknown>	HIDDEN	3
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x407540	100	FUNC	<unknown>	HIDDEN	3
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x4075b0	544	FUNC	<unknown>	HIDDEN	3
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x4077d0	108	FUNC	<unknown>	DEFAULT	3
_pthread_cleanup_pop_restore	.symtab	0x40a88c	8	FUNC	<unknown>	DEFAULT	3
_pthread_cleanup_push_defer	.symtab	0x40a88c	8	FUNC	<unknown>	DEFAULT	3
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_sigintr	.symtab	0x45b460	128	OBJECT	<unknown>	HIDDEN	14
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x40e140	880	FUNC	<unknown>	HIDDEN	3
_stdio_init	.symtab	0x4068e0	184	FUNC	<unknown>	HIDDEN	3
_stdio_openlist	.symtab	0x4549b4	4	OBJECT	<unknown>	DEFAULT	11
_stdio_openlist_add_lock	.symtab	0x454960	24	OBJECT	<unknown>	DEFAULT	11
_stdio_openlist_dec_use	.symtab	0x40e600	400	FUNC	<unknown>	DEFAULT	3
_stdio_openlist_del_count	.symtab	0x4591b4	4	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_del_lock	.symtab	0x454978	24	OBJECT	<unknown>	DEFAULT	11
_stdio_openlist_use_count	.symtab	0x4591b0	4	OBJECT	<unknown>	DEFAULT	14
_stdio_streams	.symtab	0x4549b8	240	OBJECT	<unknown>	DEFAULT	11
_stdio_term	.symtab	0x4069b8	284	FUNC	<unknown>	HIDDEN	3
_stdio_user_locking	.symtab	0x454990	4	OBJECT	<unknown>	DEFAULT	11
_stdlib_strto_l	.symtab	0x40a240	592	FUNC	<unknown>	HIDDEN	3
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x40b860	68	FUNC	<unknown>	HIDDEN	3
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x4132f0	2934	OBJECT	<unknown>	HIDDEN	5
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x40b8b0	340	FUNC	<unknown>	HIDDEN	3
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x406cb4	1960	FUNC	<unknown>	HIDDEN	3
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x40d950	428	FUNC	<unknown>	DEFAULT	3
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
atoi	.symtab	0x40a200	28	FUNC	<unknown>	DEFAULT	3
atol	.symtab	0x40a200	28	FUNC	<unknown>	DEFAULT	3
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bcopy	.symtab	0x4087a0	32	FUNC	<unknown>	DEFAULT	3
bcopy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
been_there_done_that	.symtab	0x45b440	4	OBJECT	<unknown>	DEFAULT	14
been_there_done_that.2792	.symtab	0x45b404	4	OBJECT	<unknown>	DEFAULT	14
bot.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
brk	.symtab	0x40db30	112	FUNC	<unknown>	DEFAULT	3
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x4092d0	252	FUNC	<unknown>	DEFAULT	3
buf.2613	.symtab	0x45b1d0	16	OBJECT	<unknown>	DEFAULT	14
buf.4833	.symtab	0x45b1e0	460	OBJECT	<unknown>	DEFAULT	14
bzero	.symtab	0x4087c0	28	FUNC	<unknown>	DEFAULT	3
bzero.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
c	.symtab	0x454834	4	OBJECT	<unknown>	DEFAULT	11
chdir	.symtab	0x4061e0	88	FUNC	<unknown>	DEFAULT	3
chdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x406240	84	FUNC	<unknown>	DEFAULT	3
close.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
commServer	.symtab	0x454840	4	OBJECT	<unknown>	DEFAULT	11
completed.2296	.symtab	0x455170	1	OBJECT	<unknown>	DEFAULT	14
connect	.symtab	0x408ff0	84	FUNC	<unknown>	DEFAULT	3
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connectTimeout	.symtab	0x401dd8	828	FUNC	<unknown>	DEFAULT	3
creat	.symtab	0x4064ac	28	FUNC	<unknown>	DEFAULT	3
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
currentServer	.symtab	0x454830	4	OBJECT	<unknown>	DEFAULT	11
data_start	.symtab	0x454820	0	OBJECT	<unknown>	DEFAULT	11
decodea.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dns	.symtab	0x454844	4	OBJECT	<unknown>	DEFAULT	11
dnslookup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ	.symtab	0x45b3f4	4	OBJECT	<unknown>	DEFAULT	14
errno	.symtab	0x45b410	4	OBJECT	<unknown>	DEFAULT	14
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
estridx	.symtab	0x413260	126	OBJECT	<unknown>	DEFAULT	5
exit	.symtab	0x40a490	236	FUNC	<unknown>	DEFAULT	3
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x414208	72	OBJECT	<unknown>	DEFAULT	5
fclose	.symtab	0x40dc00	512	FUNC	<unknown>	DEFAULT	3
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x406090	136	FUNC	<unknown>	DEFAULT	3
fcntl64	.symtab	0x406120	104	FUNC	<unknown>	DEFAULT	3
fdgets	.symtab	0x4006c0	292	FUNC	<unknown>	DEFAULT	3
fflush_unlocked	.symtab	0x40e790	628	FUNC	<unknown>	DEFAULT	3
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x4100d0	388	FUNC	<unknown>	DEFAULT	3
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x40e520	216	FUNC	<unknown>	DEFAULT	3
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x40ea10	268	FUNC	<unknown>	DEFAULT	3
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fmt	.symtab	0x4141f0	20	OBJECT	<unknown>	DEFAULT	5
fopen	.symtab	0x40de00	28	FUNC	<unknown>	DEFAULT	3
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0x4062a0	84	FUNC	<unknown>	DEFAULT	3
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs_unlocked	.symtab	0x407e30	128	FUNC	<unknown>	DEFAULT	3
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x40021c	0	FUNC	<unknown>	DEFAULT	3
free	.symtab	0x409650	396	FUNC	<unknown>	DEFAULT	3
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x40de20	68	FUNC	<unknown>	DEFAULT	3
fseeko	.symtab	0x40de20	68	FUNC	<unknown>	DEFAULT	3
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x40de70	388	FUNC	<unknown>	DEFAULT	3
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fwrite_unlocked	.symtab	0x407eb0	280	FUNC	<unknown>	DEFAULT	3
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getArch	.symtab	0x404154	56	FUNC	<unknown>	DEFAULT	3
getHost	.symtab	0x4019cc	160	FUNC	<unknown>	DEFAULT	3
getOurIP	.symtab	0x4007e4	904	FUNC	<unknown>	DEFAULT	3
getRandomIP	.symtab	0x400614	172	FUNC	<unknown>	DEFAULT	3
get_hosts_byname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getc_unlocked	.symtab	0x4100d0	388	FUNC	<unknown>	DEFAULT	3
getegid	.symtab	0x40ae60	88	FUNC	<unknown>	DEFAULT	3
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x40aec0	88	FUNC	<unknown>	DEFAULT	3
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x40af20	84	FUNC	<unknown>	DEFAULT	3
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname	.symtab	0x408b10	116	FUNC	<unknown>	DEFAULT	3
gethostbyname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r	.symtab	0x408b90	1108	FUNC	<unknown>	DEFAULT	3
gethostbyname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x406300	84	FUNC	<unknown>	DEFAULT	3
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockname	.symtab	0x409050	84	FUNC	<unknown>	DEFAULT	3
getsockname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x4090b0	120	FUNC	<unknown>	DEFAULT	3
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x40af80	84	FUNC	<unknown>	DEFAULT	3
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
h.4832	.symtab	0x45b3ac	20	OBJECT	<unknown>	DEFAULT	14
h_errno	.symtab	0x45b414	4	OBJECT	<unknown>	DEFAULT	14
heap_alloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
heap_free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
hlt	.symtab	0x4002fc	0	NOTYPE	<unknown>	DEFAULT	3
htonl	.symtab	0x4089a0	40	FUNC	<unknown>	DEFAULT	3
htons	.symtab	0x4089c8	24	FUNC	<unknown>	DEFAULT	3
i.4123	.symtab	0x454838	4	OBJECT	<unknown>	DEFAULT	11
index	.symtab	0x4081a0	256	FUNC	<unknown>	DEFAULT	3
inet_addr	.symtab	0x408ac0	72	FUNC	<unknown>	DEFAULT	3
inet_aton	.symtab	0x40c9d0	280	FUNC	<unknown>	DEFAULT	3
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa	.symtab	0x408a9c	32	FUNC	<unknown>	DEFAULT	3
inet_ntoa.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa_r	.symtab	0x4089e0	188	FUNC	<unknown>	DEFAULT	3
inet_ntop	.symtab	0x40f330	852	FUNC	<unknown>	DEFAULT	3
inet_ntop4	.symtab	0x40f13c	500	FUNC	<unknown>	DEFAULT	3
inet_pton	.symtab	0x40ee80	700	FUNC	<unknown>	DEFAULT	3
inet_pton4	.symtab	0x40ed90	240	FUNC	<unknown>	DEFAULT	3
initConnection	.symtab	0x405234	592	FUNC	<unknown>	DEFAULT	3
init_rand	.symtab	0x400310	300	FUNC	<unknown>	DEFAULT	3
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initial_fa	.symtab	0x454ab0	264	OBJECT	<unknown>	DEFAULT	11
initstate	.symtab	0x409bd4	208	FUNC	<unknown>	DEFAULT	3
initstate_r	.symtab	0x40a0b0	328	FUNC	<unknown>	DEFAULT	3
ioctl	.symtab	0x406360	104	FUNC	<unknown>	DEFAULT	3
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isatty	.symtab	0x408870	60	FUNC	<unknown>	DEFAULT	3
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isspace	.symtab	0x4066f0	44	FUNC	<unknown>	DEFAULT	3
isspace.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0x4063d0	88	FUNC	<unknown>	DEFAULT	3
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lengthd.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lengthq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/mips/memcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/mips/memset.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/mips/crt1.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/mips/crti.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/mips/crtn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
listFork	.symtab	0x402114	632	FUNC	<unknown>	DEFAULT	3
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x40ffe0	164	FUNC	<unknown>	DEFAULT	3
macAddress	.symtab	0x4551a0	6	OBJECT	<unknown>	DEFAULT	14
main	.symtab	0x405484	3072	FUNC	<unknown>	DEFAULT	3
mainCommSock	.symtab	0x455190	4	OBJECT	<unknown>	DEFAULT	14
malloc	.symtab	0x409460	492	FUNC	<unknown>	DEFAULT	3
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memchr	.symtab	0x40c260	264	FUNC	<unknown>	DEFAULT	3
memchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memcpy	.symtab	0x407fd0	308	FUNC	<unknown>	DEFAULT	3
memmove	.symtab	0x40c370	816	FUNC	<unknown>	DEFAULT	3
memmove.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mempcpy	.symtab	0x40c6a0	76	FUNC	<unknown>	DEFAULT	3
mempcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memrchr	.symtab	0x40c6f0	272	FUNC	<unknown>	DEFAULT	3
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x408110	144	FUNC	<unknown>	DEFAULT	3
mylock	.symtab	0x454bd0	24	OBJECT	<unknown>	DEFAULT	11
mylock	.symtab	0x45b420	24	OBJECT	<unknown>	DEFAULT	14
mylock	.symtab	0x454d00	24	OBJECT	<unknown>	DEFAULT	11
nanosleep	.symtab	0x40afe0	84	FUNC	<unknown>	DEFAULT	3
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
next_start.1065	.symtab	0x45b1c0	4	OBJECT	<unknown>	DEFAULT	14
ntohl	.symtab	0x408960	40	FUNC	<unknown>	DEFAULT	3
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0x408988	24	FUNC	<unknown>	DEFAULT	3
ntop.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
numpids	.symtab	0x455198	8	OBJECT	<unknown>	DEFAULT	14
object.2349	.symtab	0x455174	24	OBJECT	<unknown>	DEFAULT	14
open	.symtab	0x406430	124	FUNC	<unknown>	DEFAULT	3
open.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opennameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ourIP	.symtab	0x455150	4	OBJECT	<unknown>	DEFAULT	13
ovhl7	.symtab	0x402ec0	4756	FUNC	<unknown>	DEFAULT	3
p.2294	.symtab	0x454810	0	OBJECT	<unknown>	DEFAULT	11
pids	.symtab	0x455154	4	OBJECT	<unknown>	DEFAULT	13
poll	.symtab	0x40dba0	84	FUNC	<unknown>	DEFAULT	3
poll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prefix.4045	.symtab	0x4131b0	12	OBJECT	<unknown>	DEFAULT	5
print	.symtab	0x4012c4	1456	FUNC	<unknown>	DEFAULT	3
printchar	.symtab	0x400d38	184	FUNC	<unknown>	DEFAULT	3
printi	.symtab	0x40102c	664	FUNC	<unknown>	DEFAULT	3
prints	.symtab	0x400df0	572	FUNC	<unknown>	DEFAULT	3
processCmd	.symtab	0x40418c	4264	FUNC	<unknown>	DEFAULT	3
qual_chars.4050	.symtab	0x4131d0	20	OBJECT	<unknown>	DEFAULT	5
raise	.symtab	0x40ff90	76	FUNC	<unknown>	DEFAULT	3
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x409a60	28	FUNC	<unknown>	DEFAULT	3
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand_cmwc	.symtab	0x40043c	472	FUNC	<unknown>	DEFAULT	3
random	.symtab	0x409a80	164	FUNC	<unknown>	DEFAULT	3
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x413e70	40	OBJECT	<unknown>	DEFAULT	5
random_r	.symtab	0x409e8c	176	FUNC	<unknown>	DEFAULT	3
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randtbl	.symtab	0x454be8	128	OBJECT	<unknown>	DEFAULT	11
rawmemchr	.symtab	0x40eb20	200	FUNC	<unknown>	DEFAULT	3
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read	.symtab	0x4064d0	84	FUNC	<unknown>	DEFAULT	3
read.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read_etc_hosts_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recv	.symtab	0x409130	84	FUNC	<unknown>	DEFAULT	3
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recvLine	.symtab	0x401a6c	876	FUNC	<unknown>	DEFAULT	3
sbrk	.symtab	0x40b040	144	FUNC	<unknown>	DEFAULT	3
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
select	.symtab	0x406530	120	FUNC	<unknown>	DEFAULT	3
select.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send	.symtab	0x409190	84	FUNC	<unknown>	DEFAULT	3
send.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsid	.symtab	0x4065b0	84	FUNC	<unknown>	DEFAULT	3
setsid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsockopt	.symtab	0x4091f0	120	FUNC	<unknown>	DEFAULT	3
setsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate	.symtab	0x409b24	176	FUNC	<unknown>	DEFAULT	3
setstate_r	.symtab	0x409d50	316	FUNC	<unknown>	DEFAULT	3
sigaction	.symtab	0x40ad10	232	FUNC	<unknown>	DEFAULT	3
sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
signal	.symtab	0x4092d0	252	FUNC	<unknown>	DEFAULT	3
signal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigprocmask	.symtab	0x40b0d0	148	FUNC	<unknown>	DEFAULT	3
sigprocmask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigsetops.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sleep	.symtab	0x40a580	564	FUNC	<unknown>	DEFAULT	3
sleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket	.symtab	0x409270	84	FUNC	<unknown>	DEFAULT	3
socket.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket_connect	.symtab	0x40238c	444	FUNC	<unknown>	DEFAULT	3
sockprintf	.symtab	0x401874	344	FUNC	<unknown>	DEFAULT	3
spec_and_mask.4049	.symtab	0x4131e4	16	OBJECT	<unknown>	DEFAULT	5
spec_base.4044	.symtab	0x4131bc	7	OBJECT	<unknown>	DEFAULT	5
spec_chars.4046	.symtab	0x413210	21	OBJECT	<unknown>	DEFAULT	5
spec_flags.4045	.symtab	0x413228	8	OBJECT	<unknown>	DEFAULT	5
spec_or_mask.4048	.symtab	0x4131f4	16	OBJECT	<unknown>	DEFAULT	5
spec_ranges.4047	.symtab	0x413204	9	OBJECT	<unknown>	DEFAULT	5
sprintf	.symtab	0x406780	80	FUNC	<unknown>	DEFAULT	3
sprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
srand	.symtab	0x409ca4	172	FUNC	<unknown>	DEFAULT	3
srandom	.symtab	0x409ca4	172	FUNC	<unknown>	DEFAULT	3
srandom_r	.symtab	0x409f3c	372	FUNC	<unknown>	DEFAULT	3
static_id	.symtab	0x454cd0	2	OBJECT	<unknown>	DEFAULT	11
static_ns	.symtab	0x45b438	4	OBJECT	<unknown>	DEFAULT	14
stderr	.symtab	0x4549a8	4	OBJECT	<unknown>	DEFAULT	11
stdin	.symtab	0x4549a0	4	OBJECT	<unknown>	DEFAULT	11
stdout	.symtab	0x4549a4	4	OBJECT	<unknown>	DEFAULT	11
strcasecmp	.symtab	0x4087e0	108	FUNC	<unknown>	DEFAULT	3
strcasecmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchr	.symtab	0x4081a0	256	FUNC	<unknown>	DEFAULT	3
strchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcmp	.symtab	0x4082a0	44	FUNC	<unknown>	DEFAULT	3
strcmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcoll	.symtab	0x4082a0	44	FUNC	<unknown>	DEFAULT	3
strcpy	.symtab	0x4082d0	36	FUNC	<unknown>	DEFAULT	3
strcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strdup	.symtab	0x40ed00	144	FUNC	<unknown>	DEFAULT	3
strdup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strerror_r	.symtab	0x408610	392	FUNC	<unknown>	DEFAULT	3
strlen	.symtab	0x408300	184	FUNC	<unknown>	DEFAULT	3
strlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncat	.symtab	0x40ebf0	180	FUNC	<unknown>	DEFAULT	3
strncat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncpy	.symtab	0x40c800	188	FUNC	<unknown>	DEFAULT	3
strncpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strnlen	.symtab	0x4083c0	256	FUNC	<unknown>	DEFAULT	3
strnlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strpbrk	.symtab	0x40c990	64	FUNC	<unknown>	DEFAULT	3
strpbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strspn	.symtab	0x40ecb0	76	FUNC	<unknown>	DEFAULT	3
strspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strstr	.symtab	0x4084c0	256	FUNC	<unknown>	DEFAULT	3
strstr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok	.symtab	0x408850	32	FUNC	<unknown>	DEFAULT	3
strtok.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok_r	.symtab	0x40c8c0	204	FUNC	<unknown>	DEFAULT	3
strtok_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtol	.symtab	0x40a220	28	FUNC	<unknown>	DEFAULT	3
strtol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcgetattr	.symtab	0x4088b0	176	FUNC	<unknown>	DEFAULT	3
tcgetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
time	.symtab	0x406610	84	FUNC	<unknown>	DEFAULT	3
time.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tolower	.symtab	0x410090	60	FUNC	<unknown>	DEFAULT	3
tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
toupper	.symtab	0x406720	60	FUNC	<unknown>	DEFAULT	3
toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
trim	.symtab	0x400b6c	460	FUNC	<unknown>	DEFAULT	3
type_codes	.symtab	0x413230	24	OBJECT	<unknown>	DEFAULT	5
type_sizes	.symtab	0x413248	12	OBJECT	<unknown>	DEFAULT	5
unknown.1088	.symtab	0x4132e0	14	OBJECT	<unknown>	DEFAULT	5
unsafe_state	.symtab	0x454c70	28	OBJECT	<unknown>	DEFAULT	11
useragents	.symtab	0x454848	236	OBJECT	<unknown>	DEFAULT	11
vsnprintf	.symtab	0x4067d0	260	FUNC	<unknown>	DEFAULT	3
vsnprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wait4	.symtab	0x40b170	88	FUNC	<unknown>	DEFAULT	3
wait4.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
waitpid	.symtab	0x406670	28	FUNC	<unknown>	DEFAULT	3
waitpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcrtomb	.symtab	0x40b1f0	112	FUNC	<unknown>	DEFAULT	3
wcrtomb.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsnrtombs	.symtab	0x40b2a0	228	FUNC	<unknown>	DEFAULT	3
wcsnrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsrtombs	.symtab	0x40b260	64	FUNC	<unknown>	DEFAULT	3
wcsrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
write	.symtab	0x406690	84	FUNC	<unknown>	DEFAULT	3
write.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
xdigits.3043	.symtab	0x4142d4	17	OBJECT	<unknown>	DEFAULT	5
xtdcustom	.symtab	0x4027f0	528	FUNC	<unknown>	DEFAULT	3

Network Behavior

Download Network PCAP: filtered – full

Network Port Distribution

Total Packets: 404
• 4258 undefined
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 29, 2025 01:12:55.838395119 CET	60030	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:12:55.843395948 CET	4258	60030	146.19.24.68	192.168.2.13
Jan 29, 2025 01:12:55.843455076 CET	60030	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:12:55.844834089 CET	60030	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:12:55.849729061 CET	4258	60030	146.19.24.68	192.168.2.13
Jan 29, 2025 01:12:56.496844053 CET	4258	60030	146.19.24.68	192.168.2.13
Jan 29, 2025 01:12:56.496921062 CET	4258	60030	146.19.24.68	192.168.2.13
Jan 29, 2025 01:12:56.496973038 CET	60030	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:12:56.497931957 CET	60030	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:12:56.498461962 CET	60032	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:12:56.503859997 CET	4258	60030	146.19.24.68	192.168.2.13
Jan 29, 2025 01:12:56.504437923 CET	4258	60032	146.19.24.68	192.168.2.13
Jan 29, 2025 01:12:56.504559040 CET	60032	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:12:56.504559040 CET	60032	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:12:56.510071993 CET	4258	60032	146.19.24.68	192.168.2.13
Jan 29, 2025 01:12:57.080018997 CET	4258	60032	146.19.24.68	192.168.2.13
Jan 29, 2025 01:12:57.080080032 CET	4258	60032	146.19.24.68	192.168.2.13
Jan 29, 2025 01:12:57.080781937 CET	60032	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:12:57.080781937 CET	60032	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:12:57.083348036 CET	60034	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:12:57.085752964 CET	4258	60032	146.19.24.68	192.168.2.13
Jan 29, 2025 01:12:57.088212967 CET	4258	60034	146.19.24.68	192.168.2.13
Jan 29, 2025 01:12:57.088279963 CET	60034	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:12:57.088329077 CET	60034	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:12:57.093116999 CET	4258	60034	146.19.24.68	192.168.2.13
Jan 29, 2025 01:12:57.772826910 CET	4258	60034	146.19.24.68	192.168.2.13
Jan 29, 2025 01:12:57.772998095 CET	60034	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:12:57.916198969 CET	4258	60034	146.19.24.68	192.168.2.13
Jan 29, 2025 01:12:57.916496992 CET	60034	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:12:57.916966915 CET	60036	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:12:57.921339035 CET	4258	60034	146.19.24.68	192.168.2.13
Jan 29, 2025 01:12:57.921808004 CET	4258	60036	146.19.24.68	192.168.2.13
Jan 29, 2025 01:12:57.921897888 CET	60036	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:12:57.921926022 CET	60036	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:12:57.926742077 CET	4258	60036	146.19.24.68	192.168.2.13
Jan 29, 2025 01:12:58.495131969 CET	4258	60036	146.19.24.68	192.168.2.13
Jan 29, 2025 01:12:58.495270967 CET	60036	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:12:58.495274067 CET	4258	60036	146.19.24.68	192.168.2.13
Jan 29, 2025 01:12:58.495368004 CET	60036	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:12:58.495893002 CET	60038	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:12:58.500155926 CET	4258	60036	146.19.24.68	192.168.2.13
Jan 29, 2025 01:12:58.500648975 CET	4258	60038	146.19.24.68	192.168.2.13
Jan 29, 2025 01:12:58.500689983 CET	60038	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:12:58.500720024 CET	60038	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:12:58.505460024 CET	4258	60038	146.19.24.68	192.168.2.13
Jan 29, 2025 01:12:59.061577082 CET	4258	60038	146.19.24.68	192.168.2.13
Jan 29, 2025 01:12:59.061603069 CET	4258	60038	146.19.24.68	192.168.2.13
Jan 29, 2025 01:12:59.061702013 CET	60038	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:12:59.061774969 CET	60038	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:12:59.062314987 CET	60040	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:12:59.066662073 CET	4258	60038	146.19.24.68	192.168.2.13
Jan 29, 2025 01:12:59.067071915 CET	4258	60040	146.19.24.68	192.168.2.13
Jan 29, 2025 01:12:59.067116976 CET	60040	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:12:59.067157030 CET	60040	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:12:59.071908951 CET	4258	60040	146.19.24.68	192.168.2.13
Jan 29, 2025 01:12:59.642196894 CET	4258	60040	146.19.24.68	192.168.2.13
Jan 29, 2025 01:12:59.642252922 CET	4258	60040	146.19.24.68	192.168.2.13
Jan 29, 2025 01:12:59.642330885 CET	60040	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:12:59.642385960 CET	60040	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:12:59.642855883 CET	60042	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:12:59.647131920 CET	4258	60040	146.19.24.68	192.168.2.13
Jan 29, 2025 01:12:59.647587061 CET	4258	60042	146.19.24.68	192.168.2.13
Jan 29, 2025 01:12:59.647680044 CET	60042	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:12:59.647701979 CET	60042	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:12:59.652487993 CET	4258	60042	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:00.247415066 CET	4258	60042	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:00.247494936 CET	4258	60042	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:00.247577906 CET	60042	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:00.247776985 CET	60042	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:00.248529911 CET	60044	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:00.252595901 CET	4258	60042	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:00.253355026 CET	4258	60044	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:00.253449917 CET	60044	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:00.253540039 CET	60044	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:00.258325100 CET	4258	60044	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:00.844665051 CET	4258	60044	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:00.844703913 CET	4258	60044	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:00.844790936 CET	60044	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:00.844851017 CET	60044	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:00.845335007 CET	60046	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:00.849663019 CET	4258	60044	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:00.850449085 CET	4258	60046	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:00.850536108 CET	60046	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:00.850564957 CET	60046	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:00.855470896 CET	4258	60046	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:01.419837952 CET	4258	60046	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:01.419868946 CET	4258	60046	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:01.420002937 CET	60046	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:01.420039892 CET	60046	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:01.420644045 CET	60048	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:01.425019026 CET	4258	60046	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:01.425607920 CET	4258	60048	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:01.425739050 CET	60048	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:01.425739050 CET	60048	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:01.431081057 CET	4258	60048	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:01.994182110 CET	4258	60048	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:01.994297028 CET	60048	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:01.994342089 CET	4258	60048	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:01.994432926 CET	60048	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:01.994982004 CET	60050	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:01.999286890 CET	4258	60048	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:01.999818087 CET	4258	60050	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:01.999924898 CET	60050	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:01.999924898 CET	60050	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:02.004808903 CET	4258	60050	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:02.579071999 CET	4258	60050	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:02.579226017 CET	4258	60050	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:02.579327106 CET	60050	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:02.579603910 CET	60050	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:02.580005884 CET	60052	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:02.584481955 CET	4258	60050	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:02.584822893 CET	4258	60052	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:02.584903002 CET	60052	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:02.584923029 CET	60052	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:02.589694023 CET	4258	60052	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:03.162600994 CET	4258	60052	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:03.162764072 CET	60052	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:03.162947893 CET	4258	60052	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:03.163043022 CET	60052	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:03.163619041 CET	60054	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:03.167856932 CET	4258	60052	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:03.168592930 CET	4258	60054	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:03.168652058 CET	60054	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:03.168669939 CET	60054	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:03.173556089 CET	4258	60054	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:03.733074903 CET	4258	60054	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:03.733195066 CET	60054	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:03.733282089 CET	4258	60054	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:03.733349085 CET	60054	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:03.733789921 CET	60056	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:03.738172054 CET	4258	60054	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:03.738533974 CET	4258	60056	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:03.738576889 CET	60056	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:03.738605022 CET	60056	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:03.743459940 CET	4258	60056	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:04.300055981 CET	4258	60056	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:04.300120115 CET	4258	60056	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:04.300185919 CET	60056	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:04.300252914 CET	60056	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:04.300817013 CET	60058	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:04.304974079 CET	4258	60056	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:04.305623055 CET	4258	60058	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:04.305721045 CET	60058	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:04.305738926 CET	60058	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:04.310487986 CET	4258	60058	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:07.890197992 CET	4258	60058	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:07.890324116 CET	4258	60058	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:07.890536070 CET	60058	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:07.890608072 CET	60058	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:07.891258001 CET	60060	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:07.897691965 CET	4258	60058	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:07.897727013 CET	4258	60060	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:07.897815943 CET	60060	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:07.897886038 CET	60060	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:07.904850006 CET	4258	60060	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:08.468708038 CET	4258	60060	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:08.468744040 CET	4258	60060	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:08.468838930 CET	60060	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:08.468969107 CET	60060	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:08.469696999 CET	60062	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:08.473762035 CET	4258	60060	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:08.474549055 CET	4258	60062	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:08.474616051 CET	60062	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:08.475045919 CET	60062	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:08.479820967 CET	4258	60062	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:09.067625046 CET	4258	60062	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:09.067677975 CET	4258	60062	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:09.067779064 CET	60062	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:09.067974091 CET	60062	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:09.068610907 CET	60064	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:09.072838068 CET	4258	60062	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:09.073482990 CET	4258	60064	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:09.073605061 CET	60064	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:09.073704958 CET	60064	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:09.078536987 CET	4258	60064	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:09.650821924 CET	4258	60064	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:09.650846958 CET	4258	60064	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:09.650948048 CET	60064	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:09.651024103 CET	60064	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:09.651534081 CET	60066	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:09.655848026 CET	4258	60064	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:09.658679008 CET	4258	60066	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:09.658761024 CET	60066	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:09.658783913 CET	60066	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:09.663871050 CET	4258	60066	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:10.235440969 CET	4258	60066	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:10.235585928 CET	4258	60066	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:10.235594034 CET	60066	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:10.235667944 CET	60066	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:10.236221075 CET	60068	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:10.240437031 CET	4258	60066	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:10.241033077 CET	4258	60068	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:10.241199970 CET	60068	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:10.241214991 CET	60068	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:10.246001005 CET	4258	60068	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:10.818840027 CET	4258	60068	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:10.818939924 CET	4258	60068	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:10.819034100 CET	60068	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:10.819106102 CET	60068	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:10.819638014 CET	60070	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:10.824084044 CET	4258	60068	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:10.824431896 CET	4258	60070	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:10.824496984 CET	60070	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:10.824541092 CET	60070	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:10.829312086 CET	4258	60070	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:11.404865980 CET	4258	60070	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:11.404891968 CET	4258	60070	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:11.405014038 CET	60070	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:11.405080080 CET	60070	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:11.405600071 CET	60072	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:11.409905910 CET	4258	60070	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:11.410430908 CET	4258	60072	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:11.410485983 CET	60072	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:11.410516977 CET	60072	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:11.415294886 CET	4258	60072	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:11.974349022 CET	4258	60072	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:11.974486113 CET	4258	60072	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:11.974484921 CET	60072	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:11.974575043 CET	60072	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:11.975094080 CET	60074	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:11.979356050 CET	4258	60072	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:11.979916096 CET	4258	60074	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:11.980001926 CET	60074	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:11.980031013 CET	60074	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:11.984812021 CET	4258	60074	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:12.535058975 CET	4258	60074	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:12.535080910 CET	4258	60074	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:12.535217047 CET	60074	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:12.535288095 CET	60074	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:12.536149025 CET	60076	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:12.540096998 CET	4258	60074	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:12.540968895 CET	4258	60076	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:12.541064024 CET	60076	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:12.541110992 CET	60076	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:12.545977116 CET	4258	60076	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:13.113085032 CET	4258	60076	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:13.113132000 CET	4258	60076	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:13.113264084 CET	60076	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:13.113394022 CET	60076	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:13.113898039 CET	60078	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:13.118159056 CET	4258	60076	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:13.118716955 CET	4258	60078	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:13.118784904 CET	60078	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:13.118834019 CET	60078	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:13.123672009 CET	4258	60078	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:13.674586058 CET	4258	60078	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:13.674607038 CET	4258	60078	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:13.674741030 CET	60078	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:13.674788952 CET	60078	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:13.675370932 CET	60080	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:13.679909945 CET	4258	60078	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:13.680835009 CET	4258	60080	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:13.680902958 CET	60080	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:13.680964947 CET	60080	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:13.686194897 CET	4258	60080	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:14.242263079 CET	4258	60080	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:14.242281914 CET	4258	60080	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:14.242337942 CET	60080	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:14.242408037 CET	60080	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:14.242850065 CET	60082	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:14.247221947 CET	4258	60080	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:14.248075962 CET	4258	60082	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:14.248141050 CET	60082	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:14.248173952 CET	60082	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:14.252981901 CET	4258	60082	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:14.830063105 CET	4258	60082	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:14.830202103 CET	4258	60082	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:14.830209017 CET	60082	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:14.830303907 CET	60082	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:14.831154108 CET	60084	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:14.835165024 CET	4258	60082	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:14.836015940 CET	4258	60084	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:14.836085081 CET	60084	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:14.836774111 CET	60084	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:14.841552019 CET	4258	60084	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:15.411040068 CET	4258	60084	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:15.411061049 CET	4258	60084	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:15.411194086 CET	60084	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:15.411358118 CET	60084	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:15.414129972 CET	60086	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:15.416098118 CET	4258	60084	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:15.418982983 CET	4258	60086	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:15.419073105 CET	60086	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:15.419073105 CET	60086	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:15.423877954 CET	4258	60086	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:16.009815931 CET	4258	60086	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:16.009836912 CET	4258	60086	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:16.009953022 CET	60086	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:16.010065079 CET	60086	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:16.010817051 CET	60088	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:16.014893055 CET	4258	60086	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:16.015605927 CET	4258	60088	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:16.015650988 CET	60088	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:16.015688896 CET	60088	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:16.020500898 CET	4258	60088	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:16.972307920 CET	4258	60088	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:16.972548008 CET	60088	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:16.973649979 CET	60090	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:16.977397919 CET	4258	60088	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:16.978456974 CET	4258	60090	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:16.978539944 CET	60090	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:16.978600979 CET	60090	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:16.983407021 CET	4258	60090	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:17.540107965 CET	4258	60090	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:17.540186882 CET	4258	60090	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:17.540250063 CET	60090	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:17.540329933 CET	60090	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:17.540946007 CET	60092	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:17.545588017 CET	4258	60090	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:17.545753002 CET	4258	60092	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:17.545880079 CET	60092	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:17.545880079 CET	60092	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:17.550699949 CET	4258	60092	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:18.121845961 CET	4258	60092	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:18.121870041 CET	4258	60092	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:18.121994019 CET	60092	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:18.122117996 CET	60092	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:18.122649908 CET	60094	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:18.126880884 CET	4258	60092	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:18.127490997 CET	4258	60094	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:18.127609015 CET	60094	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:18.127635956 CET	60094	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:18.132416964 CET	4258	60094	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:18.700911045 CET	4258	60094	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:18.700953960 CET	4258	60094	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:18.701153994 CET	60094	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:18.701293945 CET	60094	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:18.701827049 CET	60096	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:18.706046104 CET	4258	60094	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:18.706653118 CET	4258	60096	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:18.706703901 CET	60096	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:18.706731081 CET	60096	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:18.711575031 CET	4258	60096	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:19.283292055 CET	4258	60096	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:19.283346891 CET	4258	60096	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:19.283452034 CET	60096	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:19.283516884 CET	60096	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:19.284306049 CET	60098	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:19.288341045 CET	4258	60096	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:19.289155960 CET	4258	60098	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:19.289216042 CET	60098	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:19.289247990 CET	60098	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:19.294095993 CET	4258	60098	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:19.846963882 CET	4258	60098	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:19.847033024 CET	4258	60098	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:19.847230911 CET	60098	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:19.847342014 CET	60098	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:19.847959995 CET	60100	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:19.852119923 CET	4258	60098	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:19.852829933 CET	4258	60100	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:19.852929115 CET	60100	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:19.852978945 CET	60100	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:19.858021021 CET	4258	60100	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:20.419622898 CET	4258	60100	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:20.419701099 CET	4258	60100	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:20.419863939 CET	60100	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:20.419910908 CET	60100	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:20.420574903 CET	60102	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:20.424994946 CET	4258	60100	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:20.425551891 CET	4258	60102	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:20.425626040 CET	60102	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:20.425652027 CET	60102	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:20.430758953 CET	4258	60102	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:20.993505001 CET	4258	60102	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:20.993520975 CET	4258	60102	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:20.993633032 CET	60102	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:20.993720055 CET	60102	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:20.994275093 CET	60104	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:20.998496056 CET	4258	60102	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:20.999083042 CET	4258	60104	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:20.999161959 CET	60104	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:20.999217987 CET	60104	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:21.004565954 CET	4258	60104	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:21.581465006 CET	4258	60104	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:21.581482887 CET	4258	60104	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:21.581582069 CET	60104	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:21.581639051 CET	60104	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:21.582091093 CET	60106	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:21.586390972 CET	4258	60104	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:21.587017059 CET	4258	60106	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:21.587099075 CET	60106	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:21.587115049 CET	60106	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:21.593327999 CET	4258	60106	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:22.173394918 CET	4258	60106	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:22.173413992 CET	4258	60106	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:22.173557997 CET	60106	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:22.173654079 CET	60106	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:22.174176931 CET	60108	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:22.178436995 CET	4258	60106	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:22.179063082 CET	4258	60108	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:22.179115057 CET	60108	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:22.179158926 CET	60108	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:22.184247017 CET	4258	60108	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:22.740959883 CET	4258	60108	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:22.741030931 CET	4258	60108	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:22.741123915 CET	60108	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:22.741213083 CET	60108	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:22.741926908 CET	60110	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:22.746011972 CET	4258	60108	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:22.746753931 CET	4258	60110	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:22.746818066 CET	60110	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:22.746855974 CET	60110	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:22.751629114 CET	4258	60110	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:23.308304071 CET	4258	60110	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:23.308373928 CET	4258	60110	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:23.308481932 CET	60110	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:23.308633089 CET	60110	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:23.310199976 CET	60112	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:23.313380957 CET	4258	60110	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:23.315097094 CET	4258	60112	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:23.315177917 CET	60112	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:23.315246105 CET	60112	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:23.321537971 CET	4258	60112	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:23.880871058 CET	4258	60112	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:23.880934954 CET	4258	60112	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:23.880999088 CET	60112	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:23.881069899 CET	60112	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:23.881635904 CET	60114	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:23.886661053 CET	4258	60112	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:23.886674881 CET	4258	60114	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:23.886734962 CET	60114	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:23.886774063 CET	60114	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:23.891618013 CET	4258	60114	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:24.455156088 CET	4258	60114	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:24.455281019 CET	4258	60114	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:24.455288887 CET	60114	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:24.455383062 CET	60114	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:24.456283092 CET	60116	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:24.460165024 CET	4258	60114	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:24.461085081 CET	4258	60116	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:24.461200953 CET	60116	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:24.461200953 CET	60116	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:24.465972900 CET	4258	60116	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:25.026088953 CET	4258	60116	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:25.026115894 CET	4258	60116	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:25.026236057 CET	60116	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:25.026371956 CET	60116	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:25.027430058 CET	60118	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:25.031121016 CET	4258	60116	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:25.032888889 CET	4258	60118	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:25.032948971 CET	60118	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:25.032994032 CET	60118	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:25.037760019 CET	4258	60118	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:25.642734051 CET	4258	60118	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:25.642895937 CET	60118	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:25.642981052 CET	4258	60118	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:25.643045902 CET	60118	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:25.643537998 CET	60120	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:25.647808075 CET	4258	60118	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:25.648360014 CET	4258	60120	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:25.648413897 CET	60120	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:25.648444891 CET	60120	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:25.653214931 CET	4258	60120	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:29.280045033 CET	4258	60120	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:29.280149937 CET	4258	60120	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:29.280296087 CET	60120	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:29.280361891 CET	60120	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:29.281285048 CET	60122	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:29.285178900 CET	4258	60120	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:29.286112070 CET	4258	60122	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:29.286216021 CET	60122	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:29.286273003 CET	60122	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:29.291043043 CET	4258	60122	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:29.859112978 CET	4258	60122	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:29.859146118 CET	4258	60122	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:29.859235048 CET	60122	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:29.859402895 CET	60122	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:29.860150099 CET	60124	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:29.864156008 CET	4258	60122	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:29.864918947 CET	4258	60124	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:29.865005970 CET	60124	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:29.865080118 CET	60124	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:29.869833946 CET	4258	60124	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:30.444961071 CET	4258	60124	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:30.445045948 CET	4258	60124	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:30.445121050 CET	60124	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:30.445199966 CET	60124	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:30.445871115 CET	60126	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:30.449971914 CET	4258	60124	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:30.450658083 CET	4258	60126	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:30.450771093 CET	60126	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:30.450834990 CET	60126	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:30.455545902 CET	4258	60126	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:31.035680056 CET	4258	60126	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:31.035788059 CET	60126	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:31.035804987 CET	4258	60126	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:31.035912991 CET	60126	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:31.036524057 CET	60128	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:31.040676117 CET	4258	60126	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:31.041378975 CET	4258	60128	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:31.041433096 CET	60128	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:31.041455030 CET	60128	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:31.046325922 CET	4258	60128	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:31.605580091 CET	4258	60128	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:31.605729103 CET	4258	60128	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:31.605890036 CET	60128	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:31.605945110 CET	60128	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:31.606750965 CET	60130	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:31.610709906 CET	4258	60128	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:31.611541033 CET	4258	60130	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:31.611609936 CET	60130	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:31.611639977 CET	60130	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:31.616409063 CET	4258	60130	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:32.172029972 CET	4258	60130	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:32.172071934 CET	4258	60130	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:32.172209024 CET	60130	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:32.172277927 CET	60130	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:32.173302889 CET	60132	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:32.177072048 CET	4258	60130	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:32.178100109 CET	4258	60132	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:32.178230047 CET	60132	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:32.178230047 CET	60132	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:32.183053017 CET	4258	60132	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:32.742419004 CET	4258	60132	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:32.742602110 CET	4258	60132	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:32.742602110 CET	60132	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:32.742867947 CET	60132	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:32.743407011 CET	60134	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:32.749406099 CET	4258	60132	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:32.749903917 CET	4258	60134	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:32.749958038 CET	60134	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:32.749979973 CET	60134	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:32.756308079 CET	4258	60134	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:33.324151993 CET	4258	60134	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:33.324266911 CET	4258	60134	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:33.324378967 CET	60134	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:33.324451923 CET	60134	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:33.325123072 CET	60136	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:33.329200983 CET	4258	60134	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:33.329899073 CET	4258	60136	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:33.329978943 CET	60136	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:33.330030918 CET	60136	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:33.334904909 CET	4258	60136	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:33.927335024 CET	4258	60136	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:33.927414894 CET	4258	60136	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:33.927561045 CET	60136	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:33.927644014 CET	60136	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:33.928358078 CET	60138	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:33.933420897 CET	4258	60136	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:33.933980942 CET	4258	60138	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:33.934101105 CET	60138	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:33.934166908 CET	60138	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:33.939024925 CET	4258	60138	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:34.502780914 CET	4258	60138	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:34.502948046 CET	60138	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:34.502964020 CET	4258	60138	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:34.503087044 CET	60138	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:34.503907919 CET	60140	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:34.507854939 CET	4258	60138	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:34.508680105 CET	4258	60140	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:34.508761883 CET	60140	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:34.508822918 CET	60140	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:34.513595104 CET	4258	60140	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:35.098145962 CET	4258	60140	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:35.098252058 CET	4258	60140	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:35.098411083 CET	60140	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:35.098448038 CET	60140	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:35.099200010 CET	60142	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:35.103241920 CET	4258	60140	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:35.104089022 CET	4258	60142	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:35.104176044 CET	60142	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:35.104235888 CET	60142	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:35.108994007 CET	4258	60142	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:38.695998907 CET	4258	60142	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:38.696019888 CET	4258	60142	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:38.696130037 CET	60142	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:38.696209908 CET	60142	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:38.696949005 CET	60144	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:38.700989962 CET	4258	60142	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:38.701771975 CET	4258	60144	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:38.701838017 CET	60144	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:38.701900959 CET	60144	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:38.706682920 CET	4258	60144	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:39.271301985 CET	4258	60144	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:39.271322966 CET	4258	60144	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:39.271526098 CET	60144	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:39.271733999 CET	60144	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:39.272532940 CET	60146	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:39.277250051 CET	4258	60144	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:39.278033972 CET	4258	60146	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:39.278090000 CET	60146	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:39.278120995 CET	60146	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:39.283610106 CET	4258	60146	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:39.857729912 CET	4258	60146	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:39.857819080 CET	4258	60146	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:39.857861996 CET	60146	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:39.857918024 CET	60146	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:39.858594894 CET	60148	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:39.862674952 CET	4258	60146	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:39.863394022 CET	4258	60148	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:39.863548994 CET	60148	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:39.863548994 CET	60148	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:39.868392944 CET	4258	60148	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:40.439441919 CET	4258	60148	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:40.439553976 CET	60148	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:40.439605951 CET	4258	60148	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:40.439796925 CET	60148	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:40.440570116 CET	60150	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:40.445337057 CET	4258	60148	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:40.446156979 CET	4258	60150	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:40.446233034 CET	60150	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:40.446306944 CET	60150	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:40.451122046 CET	4258	60150	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:41.014826059 CET	4258	60150	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:41.014878988 CET	4258	60150	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:41.015024900 CET	60150	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:41.015228987 CET	60150	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:41.016041994 CET	60152	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:41.020031929 CET	4258	60150	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:41.020864010 CET	4258	60152	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:41.020951033 CET	60152	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:41.021013975 CET	60152	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:41.025863886 CET	4258	60152	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:41.591624975 CET	4258	60152	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:41.591833115 CET	4258	60152	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:41.591835976 CET	60152	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:41.592032909 CET	60152	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:41.592798948 CET	60154	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:41.596764088 CET	4258	60152	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:41.597533941 CET	4258	60154	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:41.597632885 CET	60154	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:41.597701073 CET	60154	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:41.602456093 CET	4258	60154	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:42.165817022 CET	4258	60154	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:42.165957928 CET	60154	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:42.165978909 CET	4258	60154	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:42.166079044 CET	60154	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:42.167450905 CET	60156	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:42.171629906 CET	4258	60154	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:42.172949076 CET	4258	60156	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:42.173010111 CET	60156	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:42.173055887 CET	60156	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:42.178570986 CET	4258	60156	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:42.744767904 CET	4258	60156	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:42.744832039 CET	4258	60156	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:42.744939089 CET	60156	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:42.745027065 CET	60156	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:42.745590925 CET	60158	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:42.751104116 CET	4258	60156	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:42.751121998 CET	4258	60158	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:42.751225948 CET	60158	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:42.751272917 CET	60158	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:42.756119967 CET	4258	60158	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:43.314048052 CET	4258	60158	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:43.314182997 CET	4258	60158	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:43.314193010 CET	60158	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:43.314354897 CET	60158	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:43.315206051 CET	60160	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:43.319154024 CET	4258	60158	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:43.319984913 CET	4258	60160	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:43.320070982 CET	60160	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:43.320138931 CET	60160	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:43.324879885 CET	4258	60160	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:43.894845009 CET	4258	60160	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:43.894887924 CET	4258	60160	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:43.894982100 CET	60160	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:43.895062923 CET	60160	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:43.895713091 CET	60162	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:43.899790049 CET	4258	60160	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:43.900558949 CET	4258	60162	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:43.900660038 CET	60162	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:43.900686979 CET	60162	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:43.905461073 CET	4258	60162	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:47.463572979 CET	4258	60162	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:47.463752985 CET	60162	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:47.463764906 CET	4258	60162	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:47.463915110 CET	60162	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:47.464495897 CET	60164	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:47.469360113 CET	4258	60162	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:47.469651937 CET	4258	60164	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:47.469724894 CET	60164	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:47.469754934 CET	60164	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:47.474517107 CET	4258	60164	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:48.056267023 CET	4258	60164	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:48.056422949 CET	4258	60164	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:48.056432009 CET	60164	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:48.056510925 CET	60164	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:48.057218075 CET	60166	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:48.063185930 CET	4258	60164	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:48.063746929 CET	4258	60166	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:48.063879967 CET	60166	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:48.063879967 CET	60166	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:48.068794012 CET	4258	60166	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:48.626045942 CET	4258	60166	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:48.626142025 CET	4258	60166	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:48.626188993 CET	60166	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:48.626398087 CET	60166	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:48.627077103 CET	60168	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:48.631195068 CET	4258	60166	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:48.631906033 CET	4258	60168	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:48.631972075 CET	60168	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:48.632047892 CET	60168	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:48.637101889 CET	4258	60168	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:49.196707010 CET	4258	60168	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:49.196840048 CET	60168	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:49.196906090 CET	4258	60168	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:49.197000980 CET	60168	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:49.197587967 CET	60170	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:49.201845884 CET	4258	60168	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:49.202548027 CET	4258	60170	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:49.202677965 CET	60170	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:49.202754974 CET	60170	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:49.207681894 CET	4258	60170	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:49.886578083 CET	4258	60170	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:49.886775017 CET	60170	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:49.887447119 CET	60172	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:49.891597033 CET	4258	60170	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:49.893403053 CET	4258	60172	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:49.893515110 CET	60172	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:49.893549919 CET	60172	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:49.898950100 CET	4258	60172	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:50.467962980 CET	4258	60172	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:50.468025923 CET	4258	60172	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:50.468156099 CET	60172	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:50.468233109 CET	60172	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:50.468924046 CET	60174	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:50.473045111 CET	4258	60172	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:50.473762989 CET	4258	60174	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:50.473834991 CET	60174	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:50.473884106 CET	60174	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:50.478688002 CET	4258	60174	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:51.054192066 CET	4258	60174	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:51.054351091 CET	60174	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:51.054742098 CET	4258	60174	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:51.054815054 CET	60174	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:51.055680037 CET	60176	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:51.059580088 CET	4258	60174	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:51.060545921 CET	4258	60176	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:51.060617924 CET	60176	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:51.060672045 CET	60176	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:51.065437078 CET	4258	60176	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:51.619910002 CET	4258	60176	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:51.620157003 CET	60176	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:51.621025085 CET	4258	60176	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:51.621148109 CET	60176	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:51.622191906 CET	60178	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:51.626236916 CET	4258	60176	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:51.627012968 CET	4258	60178	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:51.627147913 CET	60178	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:51.627207041 CET	60178	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:51.631999969 CET	4258	60178	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:52.187309027 CET	4258	60178	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:52.187436104 CET	4258	60178	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:52.187494993 CET	60178	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:52.187568903 CET	60178	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:52.188677073 CET	60180	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:52.192411900 CET	4258	60178	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:52.193684101 CET	4258	60180	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:52.193789005 CET	60180	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:52.193847895 CET	60180	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:52.198681116 CET	4258	60180	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:52.774513960 CET	4258	60180	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:52.774663925 CET	4258	60180	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:52.774730921 CET	60180	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:52.774919987 CET	60180	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:52.775933027 CET	60182	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:52.779723883 CET	4258	60180	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:52.780767918 CET	4258	60182	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:52.780911922 CET	60182	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:52.780956030 CET	60182	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:52.785736084 CET	4258	60182	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:56.355830908 CET	4258	60182	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:56.355990887 CET	60182	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:56.356034040 CET	4258	60182	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:56.356184006 CET	60182	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:56.356792927 CET	60184	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:56.361962080 CET	4258	60182	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:56.362442017 CET	4258	60184	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:56.362513065 CET	60184	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:56.362556934 CET	60184	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:56.368119955 CET	4258	60184	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:56.953785896 CET	4258	60184	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:56.953970909 CET	4258	60184	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:56.954003096 CET	60184	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:56.954057932 CET	60184	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:56.954544067 CET	60186	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:56.958856106 CET	4258	60184	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:56.959368944 CET	4258	60186	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:56.959453106 CET	60186	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:56.959453106 CET	60186	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:56.964469910 CET	4258	60186	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:57.525161028 CET	4258	60186	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:57.525302887 CET	4258	60186	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:57.525336981 CET	60186	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:57.525551081 CET	60186	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:57.526375055 CET	60188	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:57.530276060 CET	4258	60186	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:57.531126976 CET	4258	60188	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:57.531234980 CET	60188	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:57.531297922 CET	60188	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:57.536032915 CET	4258	60188	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:58.089020014 CET	4258	60188	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:58.089081049 CET	4258	60188	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:58.089142084 CET	60188	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:58.089221954 CET	60188	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:58.089747906 CET	60190	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:58.093996048 CET	4258	60188	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:58.094523907 CET	4258	60190	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:58.094594955 CET	60190	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:58.094616890 CET	60190	4258	192.168.2.13	146.19.24.68
Jan 29, 2025 01:13:58.099368095 CET	4258	60190	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:58.752677917 CET	4258	60190	146.19.24.68	192.168.2.13
Jan 29, 2025 01:13:58.752799988 CET	60190	4258	192.168.2.13	146.19.24.68

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 29, 2025 01:15:39.475038052 CET	55603	53	192.168.2.13	8.8.8.8
Jan 29, 2025 01:15:39.475122929 CET	39785	53	192.168.2.13	8.8.8.8
Jan 29, 2025 01:15:39.481317043 CET	53	39785	8.8.8.8	192.168.2.13
Jan 29, 2025 01:15:39.481549025 CET	53	55603	8.8.8.8	192.168.2.13

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 29, 2025 01:15:39.475038052 CET	192.168.2.13	8.8.8.8	0xcf23	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Jan 29, 2025 01:15:39.475122929 CET	192.168.2.13	8.8.8.8	0x1223	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 29, 2025 01:15:39.481549025 CET	8.8.8.8	192.168.2.13	0xcf23	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false
Jan 29, 2025 01:15:39.481549025 CET	8.8.8.8	192.168.2.13	0xcf23	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: hidakibest.mpsl.elf PID: 5431, Parent PID: 5355

General

Start time (UTC):	00:12:54
Start date (UTC):	29/01/2025
Path:	/tmp/hidakibest.mpsl.elf
Arguments:	/tmp/hidakibest.mpsl.elf
File size:	5773336 bytes
MD5 hash:	0d6f61f82cf2f781c6eb0661071d42d9

File Activities

File Opened

File Read

Process Activities

Process Forked

Thread Sleep

System Activities

Query System Information (uname)

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: hidakibest.mpsl.elf PID: 5433, Parent PID: 5431

General

Start time (UTC):	00:12:54
Start date (UTC):	29/01/2025
Path:	/tmp/hidakibest.mpsl.elf
Arguments:	-
File size:	5773336 bytes
MD5 hash:	0d6f61f82cf2f781c6eb0661071d42d9

Process Activities

Process Forked

Thread Sleep

Chronological Activities

Analysis Process: hidakibest.mpsl.elf PID: 5435, Parent PID: 5433

General

Start time (UTC):	00:12:54
Start date (UTC):	29/01/2025
Path:	/tmp/hidakibest.mpsl.elf
Arguments:	-
File size:	5773336 bytes
MD5 hash:	0d6f61f82cf2f781c6eb0661071d42d9

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping or `net view` using Net .
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report hidakibest.mpsl.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Threatname: Gafgyt

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: hidakibest.mpsl.elf PID: 5431, Parent PID: 5355

General

File Activities

File Opened

File Read

Process Activities

Process Forked

Thread Sleep

System Activities

Query System Information (uname)

Network Activities

Socket Connecting

Linux Analysis Report
hidakibest.mpsl.elf