Create Interactive Tour

Linux Analysis Report
pXdN91.x68.elf

Overview

General Information

Sample name:	pXdN91.x68.elf
Analysis ID:	1616314
MD5:	e9a3fc1cc9b49e2480c67a02c8dbef8b
SHA1:	f7c1d125a02a3889c67e4c4e79ca8d16c3602787
SHA256:	dd291309e4bb8d184bd744462143cbb07ccd92751d1bb1d5da92f257cd86e0a3
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai, Gafgyt

Score:	100
Range:	0 - 100

Signatures

Antivirus / Scanner detection for submitted sample

Detected Mirai

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Gafgyt

Yara detected Mirai

Contains symbols with names commonly found in malware

Opens /proc/net/* files useful for finding connected devices and routers

Detected TCP or UDP traffic on non-standard ports

Sample contains strings that are user agent strings indicative of HTTP manipulation

Suricata IDS alerts with low severity for network traffic

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Yara signature match

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1616314
Start date and time:	2025-02-16 14:47:16 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	pXdN91.x68.elf
Detection:	MAL
Classification:	mal100.spre.troj.linELF@0/0@0/0

Warnings

VT rate limit hit for: 156.229.233.170:6149

Runtime Messages

Command:	/tmp/pXdN91.x68.elf
PID:	6247
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

pXdN91.x68.elf (PID: 6247, Parent: 6162, MD5: e9a3fc1cc9b49e2480c67a02c8dbef8b) Arguments: /tmp/pXdN91.x68.elf

pXdN91.x68.elf New Fork (PID: 6248, Parent: 6247)

pXdN91.x68.elf New Fork (PID: 6249, Parent: 6247)

pXdN91.x68.elf New Fork (PID: 6250, Parent: 6249)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
pXdN91.x68.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
pXdN91.x68.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
pXdN91.x68.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xfb90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfba4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfbb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfbcc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfbe0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfbf4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfc08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfc1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfc30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfc44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfc58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfc6c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfc80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfc94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfca8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfcbc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfcd0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfce4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfcf8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfd0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfd20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
pXdN91.x68.elf	Linux_Trojan_Gafgyt_a6a2adb9	unknown	unknown	0x8a6:$a: CC 01 C2 89 55 B4 8B 45 B4 C9 C3 55 48 89 E5 48 81 EC 90 00
pXdN91.x68.elf	Linux_Trojan_Gafgyt_a10161ce	unknown	unknown	0x29b4:$a: 45 B0 8B 45 BC 48 63 D0 48 89 D0 48 C1 E0 02 48 8D 14 10 48 8B
pXdN91.x68.elf	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x7d84:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
pXdN91.x68.elf	Linux_Trojan_Gafgyt_f3d83a74	unknown	unknown	0x7cc:$a: DC 00 74 1B 83 7D E0 0A 75 15 83 7D E4 00 79 0F C7 45 C8 01 00
pXdN91.x68.elf	Linux_Trojan_Gafgyt_a0a4de11	unknown	unknown	0x24ab:$a: 42 0D 83 C8 10 88 42 0D 48 8B 55 D8 0F B6 42 0D 83 C8 08 88
pXdN91.x68.elf	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xf0f8:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0xfb3c:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
pXdN91.x68.elf	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0x594a:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x59ae:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x5a69:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
pXdN91.x68.elf	Linux_Trojan_Gafgyt_09c3070e	unknown	unknown	0xf8e:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 0x1043:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 0x1284:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83
pXdN91.x68.elf	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0xb6de:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
pXdN91.x68.elf	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0x8135:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
pXdN91.x68.elf	Linux_Trojan_Gafgyt_dd0d6173	unknown	unknown	0x14e5:$a: 55 F8 8B 45 F0 89 42 0C 48 8B 55 F8 8B 45 F4 89 42 10 C9 C3 55 48
pXdN91.x68.elf	Linux_Trojan_Gafgyt_779e142f	unknown	unknown	0x6ee:$a: EC 8B 45 E8 83 E0 02 85 C0 74 07 C7 45 D8 30 00 00 00 8B 45 E8 83
pXdN91.x68.elf	Linux_Trojan_Gafgyt_cf84c9f2	unknown	unknown	0x323:$a: 55 48 89 E5 48 83 EC 30 48 89 7D E8 89 75 E4 89 55 E0 C7 45 F8 01 00
pXdN91.x68.elf	Linux_Trojan_Gafgyt_859042a0	unknown	unknown	0x5537:$a: 45 A8 48 83 C0 01 48 89 45 C0 EB 05 48 83 45 C0 01 48 8B 45 C0 0F
pXdN91.x68.elf	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0x842b:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
pXdN91.x68.elf	Linux_Trojan_Gafgyt_e4a1982b	unknown	unknown	0x317:$a: 8B 45 EC F7 D0 21 D0 33 45 FC C9 C3 55 48 89 E5 48 83 EC 30 48 89
Click to see the 14 entries

Memory Dumps

Source	Rule	Description	Author	Strings
6247.1.0000000000400000.0000000000413000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
6249.1.0000000000400000.0000000000413000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
6247.1.0000000000400000.0000000000413000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6247.1.0000000000400000.0000000000413000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xfb90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfba4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfbb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfbcc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfbe0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfbf4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfc08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfc1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfc30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfc44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfc58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfc6c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfc80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfc94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfca8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfcbc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfcd0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfce4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfcf8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfd0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfd20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6247.1.0000000000400000.0000000000413000.r-x.sdmp	Linux_Trojan_Gafgyt_a6a2adb9	unknown	unknown	0x8a6:$a: CC 01 C2 89 55 B4 8B 45 B4 C9 C3 55 48 89 E5 48 81 EC 90 00
6247.1.0000000000400000.0000000000413000.r-x.sdmp	Linux_Trojan_Gafgyt_a10161ce	unknown	unknown	0x29b4:$a: 45 B0 8B 45 BC 48 63 D0 48 89 D0 48 C1 E0 02 48 8D 14 10 48 8B
6247.1.0000000000400000.0000000000413000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x7d84:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
6247.1.0000000000400000.0000000000413000.r-x.sdmp	Linux_Trojan_Gafgyt_f3d83a74	unknown	unknown	0x7cc:$a: DC 00 74 1B 83 7D E0 0A 75 15 83 7D E4 00 79 0F C7 45 C8 01 00
6247.1.0000000000400000.0000000000413000.r-x.sdmp	Linux_Trojan_Gafgyt_a0a4de11	unknown	unknown	0x24ab:$a: 42 0D 83 C8 10 88 42 0D 48 8B 55 D8 0F B6 42 0D 83 C8 08 88
6247.1.0000000000400000.0000000000413000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xf0f8:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0xfb3c:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
6247.1.0000000000400000.0000000000413000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0x594a:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x59ae:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x5a69:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
6247.1.0000000000400000.0000000000413000.r-x.sdmp	Linux_Trojan_Gafgyt_09c3070e	unknown	unknown	0xf8e:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 0x1043:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 0x1284:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83
6247.1.0000000000400000.0000000000413000.r-x.sdmp	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0xb6de:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
6247.1.0000000000400000.0000000000413000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0x8135:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
6247.1.0000000000400000.0000000000413000.r-x.sdmp	Linux_Trojan_Gafgyt_dd0d6173	unknown	unknown	0x14e5:$a: 55 F8 8B 45 F0 89 42 0C 48 8B 55 F8 8B 45 F4 89 42 10 C9 C3 55 48
6247.1.0000000000400000.0000000000413000.r-x.sdmp	Linux_Trojan_Gafgyt_779e142f	unknown	unknown	0x6ee:$a: EC 8B 45 E8 83 E0 02 85 C0 74 07 C7 45 D8 30 00 00 00 8B 45 E8 83
6247.1.0000000000400000.0000000000413000.r-x.sdmp	Linux_Trojan_Gafgyt_cf84c9f2	unknown	unknown	0x323:$a: 55 48 89 E5 48 83 EC 30 48 89 7D E8 89 75 E4 89 55 E0 C7 45 F8 01 00
6247.1.0000000000400000.0000000000413000.r-x.sdmp	Linux_Trojan_Gafgyt_859042a0	unknown	unknown	0x5537:$a: 45 A8 48 83 C0 01 48 89 45 C0 EB 05 48 83 45 C0 01 48 8B 45 C0 0F
6247.1.0000000000400000.0000000000413000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0x842b:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
6247.1.0000000000400000.0000000000413000.r-x.sdmp	Linux_Trojan_Gafgyt_e4a1982b	unknown	unknown	0x317:$a: 8B 45 EC F7 D0 21 D0 33 45 FC C9 C3 55 48 89 E5 48 83 EC 30 48 89
6249.1.0000000000400000.0000000000413000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6249.1.0000000000400000.0000000000413000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xfb90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfba4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfbb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfbcc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfbe0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfbf4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfc08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfc1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfc30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfc44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfc58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfc6c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfc80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfc94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfca8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfcbc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfcd0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfce4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfcf8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfd0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfd20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6249.1.0000000000400000.0000000000413000.r-x.sdmp	Linux_Trojan_Gafgyt_a6a2adb9	unknown	unknown	0x8a6:$a: CC 01 C2 89 55 B4 8B 45 B4 C9 C3 55 48 89 E5 48 81 EC 90 00
6249.1.0000000000400000.0000000000413000.r-x.sdmp	Linux_Trojan_Gafgyt_a10161ce	unknown	unknown	0x29b4:$a: 45 B0 8B 45 BC 48 63 D0 48 89 D0 48 C1 E0 02 48 8D 14 10 48 8B
6249.1.0000000000400000.0000000000413000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x7d84:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
6249.1.0000000000400000.0000000000413000.r-x.sdmp	Linux_Trojan_Gafgyt_f3d83a74	unknown	unknown	0x7cc:$a: DC 00 74 1B 83 7D E0 0A 75 15 83 7D E4 00 79 0F C7 45 C8 01 00
6249.1.0000000000400000.0000000000413000.r-x.sdmp	Linux_Trojan_Gafgyt_a0a4de11	unknown	unknown	0x24ab:$a: 42 0D 83 C8 10 88 42 0D 48 8B 55 D8 0F B6 42 0D 83 C8 08 88
6249.1.0000000000400000.0000000000413000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xf0f8:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0xfb3c:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
6249.1.0000000000400000.0000000000413000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0x594a:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x59ae:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x5a69:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
6249.1.0000000000400000.0000000000413000.r-x.sdmp	Linux_Trojan_Gafgyt_09c3070e	unknown	unknown	0xf8e:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 0x1043:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 0x1284:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83
6249.1.0000000000400000.0000000000413000.r-x.sdmp	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0xb6de:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
6249.1.0000000000400000.0000000000413000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0x8135:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
6249.1.0000000000400000.0000000000413000.r-x.sdmp	Linux_Trojan_Gafgyt_dd0d6173	unknown	unknown	0x14e5:$a: 55 F8 8B 45 F0 89 42 0C 48 8B 55 F8 8B 45 F4 89 42 10 C9 C3 55 48
6249.1.0000000000400000.0000000000413000.r-x.sdmp	Linux_Trojan_Gafgyt_779e142f	unknown	unknown	0x6ee:$a: EC 8B 45 E8 83 E0 02 85 C0 74 07 C7 45 D8 30 00 00 00 8B 45 E8 83
6249.1.0000000000400000.0000000000413000.r-x.sdmp	Linux_Trojan_Gafgyt_cf84c9f2	unknown	unknown	0x323:$a: 55 48 89 E5 48 83 EC 30 48 89 7D E8 89 75 E4 89 55 E0 C7 45 F8 01 00
6249.1.0000000000400000.0000000000413000.r-x.sdmp	Linux_Trojan_Gafgyt_859042a0	unknown	unknown	0x5537:$a: 45 A8 48 83 C0 01 48 89 45 C0 EB 05 48 83 45 C0 01 48 8B 45 C0 0F
6249.1.0000000000400000.0000000000413000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0x842b:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
6249.1.0000000000400000.0000000000413000.r-x.sdmp	Linux_Trojan_Gafgyt_e4a1982b	unknown	unknown	0x317:$a: 8B 45 EC F7 D0 21 D0 33 45 FC C9 C3 55 48 89 E5 48 83 EC 30 48 89
Process Memory Space: pXdN91.x68.elf PID: 6247	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: pXdN91.x68.elf PID: 6247	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x25e9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x25fd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2611:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2625:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2639:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x264d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2661:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2675:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2689:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x269d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x26b1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x26c5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x26d9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x26ed:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2701:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2715:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2729:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x273d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2751:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2765:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2779:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: pXdN91.x68.elf PID: 6247	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x101d:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x1c25:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x259c:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x2be6:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: pXdN91.x68.elf PID: 6249	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: pXdN91.x68.elf PID: 6249	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x2860:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2874:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2888:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x289c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x28b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x28c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x28d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x28ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2900:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2914:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2928:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x293c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2950:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2964:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2978:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x298c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x29a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x29b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x29c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x29dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x29f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: pXdN91.x68.elf PID: 6249	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x1294:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x1e9c:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x2813:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x2e5d:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Click to see the 39 entries

Suricata Signatures

ETPRO MALWARE ELF/Mirai Variant CnC Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-16T14:48:04.753084+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56210	156.229.233.170	6149	TCP
2025-02-16T14:48:06.471404+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56212	156.229.233.170	6149	TCP
2025-02-16T14:48:08.190372+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56214	156.229.233.170	6149	TCP
2025-02-16T14:48:09.895767+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56216	156.229.233.170	6149	TCP
2025-02-16T14:48:11.534584+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56218	156.229.233.170	6149	TCP
2025-02-16T14:48:13.256835+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56220	156.229.233.170	6149	TCP
2025-02-16T14:48:14.951520+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56222	156.229.233.170	6149	TCP
2025-02-16T14:48:16.631544+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56224	156.229.233.170	6149	TCP
2025-02-16T14:48:18.348599+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56226	156.229.233.170	6149	TCP
2025-02-16T14:48:20.021647+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56228	156.229.233.170	6149	TCP
2025-02-16T14:48:21.753727+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56230	156.229.233.170	6149	TCP
2025-02-16T14:48:23.476321+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56232	156.229.233.170	6149	TCP
2025-02-16T14:48:25.146792+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56234	156.229.233.170	6149	TCP
2025-02-16T14:48:26.921355+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56236	156.229.233.170	6149	TCP
2025-02-16T14:48:28.585976+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56238	156.229.233.170	6149	TCP
2025-02-16T14:48:30.319612+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56240	156.229.233.170	6149	TCP
2025-02-16T14:48:32.008802+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56242	156.229.233.170	6149	TCP
2025-02-16T14:48:33.708536+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56244	156.229.233.170	6149	TCP
2025-02-16T14:48:35.367838+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56246	156.229.233.170	6149	TCP
2025-02-16T14:48:37.052142+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56248	156.229.233.170	6149	TCP
2025-02-16T14:48:38.823516+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56250	156.229.233.170	6149	TCP
2025-02-16T14:48:40.532348+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56252	156.229.233.170	6149	TCP
2025-02-16T14:48:42.253972+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56254	156.229.233.170	6149	TCP
2025-02-16T14:48:43.896473+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56256	156.229.233.170	6149	TCP
2025-02-16T14:48:45.584548+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56258	156.229.233.170	6149	TCP
2025-02-16T14:48:47.258660+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56260	156.229.233.170	6149	TCP
2025-02-16T14:48:48.915569+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56262	156.229.233.170	6149	TCP
2025-02-16T14:48:50.587774+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56264	156.229.233.170	6149	TCP
2025-02-16T14:48:52.239110+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56266	156.229.233.170	6149	TCP
2025-02-16T14:48:54.009406+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56268	156.229.233.170	6149	TCP
2025-02-16T14:48:55.742863+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56270	156.229.233.170	6149	TCP
2025-02-16T14:48:57.465032+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56272	156.229.233.170	6149	TCP
2025-02-16T14:48:59.114356+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56274	156.229.233.170	6149	TCP
2025-02-16T14:49:00.882381+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56276	156.229.233.170	6149	TCP
2025-02-16T14:49:03.036026+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56278	156.229.233.170	6149	TCP
2025-02-16T14:49:04.757452+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56280	156.229.233.170	6149	TCP
2025-02-16T14:49:06.401608+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56282	156.229.233.170	6149	TCP
2025-02-16T14:49:08.129851+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56284	156.229.233.170	6149	TCP
2025-02-16T14:49:09.771199+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56286	156.229.233.170	6149	TCP
2025-02-16T14:49:11.523974+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56288	156.229.233.170	6149	TCP
2025-02-16T14:49:13.274908+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56290	156.229.233.170	6149	TCP
2025-02-16T14:49:15.066910+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56292	156.229.233.170	6149	TCP
2025-02-16T14:49:16.754548+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56294	156.229.233.170	6149	TCP
2025-02-16T14:49:18.428792+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56296	156.229.233.170	6149	TCP
2025-02-16T14:49:20.186148+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56298	156.229.233.170	6149	TCP
2025-02-16T14:49:21.836768+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56300	156.229.233.170	6149	TCP
2025-02-16T14:49:23.544125+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56302	156.229.233.170	6149	TCP
2025-02-16T14:49:25.239818+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56304	156.229.233.170	6149	TCP
2025-02-16T14:49:26.898507+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56306	156.229.233.170	6149	TCP
2025-02-16T14:49:28.632432+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56308	156.229.233.170	6149	TCP
2025-02-16T14:49:30.335428+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56310	156.229.233.170	6149	TCP
2025-02-16T14:49:32.064053+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56312	156.229.233.170	6149	TCP
2025-02-16T14:49:33.789921+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56314	156.229.233.170	6149	TCP
2025-02-16T14:49:35.447966+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56316	156.229.233.170	6149	TCP
2025-02-16T14:49:37.177745+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56318	156.229.233.170	6149	TCP
2025-02-16T14:49:38.887000+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56320	156.229.233.170	6149	TCP
2025-02-16T14:49:40.606667+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56322	156.229.233.170	6149	TCP
2025-02-16T14:49:42.288947+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56324	156.229.233.170	6149	TCP
2025-02-16T14:49:43.928622+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56326	156.229.233.170	6149	TCP
2025-02-16T14:49:45.645908+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56328	156.229.233.170	6149	TCP
2025-02-16T14:49:47.370201+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56330	156.229.233.170	6149	TCP
2025-02-16T14:49:49.023501+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56332	156.229.233.170	6149	TCP
2025-02-16T14:49:50.695034+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56334	156.229.233.170	6149	TCP
2025-02-16T14:49:52.352362+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56336	156.229.233.170	6149	TCP
2025-02-16T14:49:54.028543+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56338	156.229.233.170	6149	TCP
2025-02-16T14:49:55.677396+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56340	156.229.233.170	6149	TCP
2025-02-16T14:49:57.319263+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56342	156.229.233.170	6149	TCP
2025-02-16T14:49:58.978264+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56344	156.229.233.170	6149	TCP
2025-02-16T14:50:00.646764+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56346	156.229.233.170	6149	TCP
2025-02-16T14:50:02.288969+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56348	156.229.233.170	6149	TCP
2025-02-16T14:50:03.945049+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56350	156.229.233.170	6149	TCP
2025-02-16T14:50:05.600570+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56352	156.229.233.170	6149	TCP
2025-02-16T14:50:07.259446+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56354	156.229.233.170	6149	TCP
2025-02-16T14:50:08.915085+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56356	156.229.233.170	6149	TCP
2025-02-16T14:50:10.574772+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56358	156.229.233.170	6149	TCP
2025-02-16T14:50:12.248535+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56360	156.229.233.170	6149	TCP
2025-02-16T14:50:13.898242+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56362	156.229.233.170	6149	TCP
2025-02-16T14:50:15.540572+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56364	156.229.233.170	6149	TCP
2025-02-16T14:50:17.195791+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56366	156.229.233.170	6149	TCP
2025-02-16T14:50:18.836273+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56368	156.229.233.170	6149	TCP
2025-02-16T14:50:20.673794+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56370	156.229.233.170	6149	TCP
2025-02-16T14:50:22.322764+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56372	156.229.233.170	6149	TCP
2025-02-16T14:50:23.976991+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56374	156.229.233.170	6149	TCP
2025-02-16T14:50:25.632628+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56376	156.229.233.170	6149	TCP
2025-02-16T14:50:27.271834+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56378	156.229.233.170	6149	TCP
2025-02-16T14:50:28.914974+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56380	156.229.233.170	6149	TCP
2025-02-16T14:50:30.572979+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56382	156.229.233.170	6149	TCP
2025-02-16T14:50:32.229483+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56384	156.229.233.170	6149	TCP
2025-02-16T14:50:33.897337+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56386	156.229.233.170	6149	TCP
2025-02-16T14:50:35.709372+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56388	156.229.233.170	6149	TCP
2025-02-16T14:50:37.354133+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56390	156.229.233.170	6149	TCP
2025-02-16T14:50:39.008016+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56392	156.229.233.170	6149	TCP
2025-02-16T14:50:40.649563+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56394	156.229.233.170	6149	TCP
2025-02-16T14:50:42.307613+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56396	156.229.233.170	6149	TCP
2025-02-16T14:50:43.984346+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56398	156.229.233.170	6149	TCP
2025-02-16T14:50:45.632430+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56400	156.229.233.170	6149	TCP
2025-02-16T14:50:47.291995+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56402	156.229.233.170	6149	TCP
2025-02-16T14:50:48.946364+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56404	156.229.233.170	6149	TCP
2025-02-16T14:50:50.586272+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56406	156.229.233.170	6149	TCP
2025-02-16T14:50:52.229736+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56408	156.229.233.170	6149	TCP
2025-02-16T14:50:53.903074+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56410	156.229.233.170	6149	TCP
2025-02-16T14:50:55.559100+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56412	156.229.233.170	6149	TCP
2025-02-16T14:50:57.209938+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56414	156.229.233.170	6149	TCP
2025-02-16T14:50:58.870105+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56416	156.229.233.170	6149	TCP
2025-02-16T14:51:00.525966+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56418	156.229.233.170	6149	TCP
2025-02-16T14:51:02.201733+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56420	156.229.233.170	6149	TCP
2025-02-16T14:51:03.859805+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56422	156.229.233.170	6149	TCP
2025-02-16T14:51:05.527667+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56424	156.229.233.170	6149	TCP
2025-02-16T14:51:07.216044+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56426	156.229.233.170	6149	TCP
2025-02-16T14:51:08.888453+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56428	156.229.233.170	6149	TCP
2025-02-16T14:51:10.538548+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56430	156.229.233.170	6149	TCP
2025-02-16T14:51:12.196548+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56432	156.229.233.170	6149	TCP
2025-02-16T14:51:13.855575+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56434	156.229.233.170	6149	TCP
2025-02-16T14:51:15.508557+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56436	156.229.233.170	6149	TCP
2025-02-16T14:51:17.174379+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56438	156.229.233.170	6149	TCP
2025-02-16T14:51:18.820391+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56440	156.229.233.170	6149	TCP
2025-02-16T14:51:20.481021+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56442	156.229.233.170	6149	TCP
2025-02-16T14:51:22.133203+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56444	156.229.233.170	6149	TCP
2025-02-16T14:51:23.789416+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56446	156.229.233.170	6149	TCP
2025-02-16T14:51:25.448724+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56448	156.229.233.170	6149	TCP
2025-02-16T14:51:27.105839+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56450	156.229.233.170	6149	TCP
2025-02-16T14:51:28.767403+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56452	156.229.233.170	6149	TCP
2025-02-16T14:51:30.415804+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56454	156.229.233.170	6149	TCP
2025-02-16T14:51:32.072229+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56456	156.229.233.170	6149	TCP
2025-02-16T14:51:33.762113+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56458	156.229.233.170	6149	TCP
2025-02-16T14:51:35.418464+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56460	156.229.233.170	6149	TCP
2025-02-16T14:51:37.092454+0100	2846407	1	A Network Trojan was detected	192.168.2.23	56462	156.229.233.170	6149	TCP

ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-16T14:48:04.757937+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56210	156.229.233.170	6149	TCP
2025-02-16T14:48:06.476239+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56212	156.229.233.170	6149	TCP
2025-02-16T14:48:08.195264+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56214	156.229.233.170	6149	TCP
2025-02-16T14:48:09.900651+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56216	156.229.233.170	6149	TCP
2025-02-16T14:48:11.539552+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56218	156.229.233.170	6149	TCP
2025-02-16T14:48:13.261773+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56220	156.229.233.170	6149	TCP
2025-02-16T14:48:14.956796+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56222	156.229.233.170	6149	TCP
2025-02-16T14:48:16.636709+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56224	156.229.233.170	6149	TCP
2025-02-16T14:48:18.353433+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56226	156.229.233.170	6149	TCP
2025-02-16T14:48:20.026534+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56228	156.229.233.170	6149	TCP
2025-02-16T14:48:21.758637+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56230	156.229.233.170	6149	TCP
2025-02-16T14:48:23.481204+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56232	156.229.233.170	6149	TCP
2025-02-16T14:48:25.152712+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56234	156.229.233.170	6149	TCP
2025-02-16T14:48:26.928452+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56236	156.229.233.170	6149	TCP
2025-02-16T14:48:28.596112+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56238	156.229.233.170	6149	TCP
2025-02-16T14:48:30.324729+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56240	156.229.233.170	6149	TCP
2025-02-16T14:48:32.013989+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56242	156.229.233.170	6149	TCP
2025-02-16T14:48:33.713487+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56244	156.229.233.170	6149	TCP
2025-02-16T14:48:35.372888+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56246	156.229.233.170	6149	TCP
2025-02-16T14:48:37.056948+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56248	156.229.233.170	6149	TCP
2025-02-16T14:48:38.830026+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56250	156.229.233.170	6149	TCP
2025-02-16T14:48:40.537272+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56252	156.229.233.170	6149	TCP
2025-02-16T14:48:42.258868+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56254	156.229.233.170	6149	TCP
2025-02-16T14:48:43.901538+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56256	156.229.233.170	6149	TCP
2025-02-16T14:48:45.589388+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56258	156.229.233.170	6149	TCP
2025-02-16T14:48:47.263794+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56260	156.229.233.170	6149	TCP
2025-02-16T14:48:48.920540+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56262	156.229.233.170	6149	TCP
2025-02-16T14:48:50.592760+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56264	156.229.233.170	6149	TCP
2025-02-16T14:48:52.243987+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56266	156.229.233.170	6149	TCP
2025-02-16T14:48:54.014857+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56268	156.229.233.170	6149	TCP
2025-02-16T14:48:55.747794+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56270	156.229.233.170	6149	TCP
2025-02-16T14:48:57.469945+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56272	156.229.233.170	6149	TCP
2025-02-16T14:48:59.119506+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56274	156.229.233.170	6149	TCP
2025-02-16T14:49:00.887297+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56276	156.229.233.170	6149	TCP
2025-02-16T14:49:03.043099+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56278	156.229.233.170	6149	TCP
2025-02-16T14:49:04.762381+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56280	156.229.233.170	6149	TCP
2025-02-16T14:49:06.408873+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56282	156.229.233.170	6149	TCP
2025-02-16T14:49:08.134717+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56284	156.229.233.170	6149	TCP
2025-02-16T14:49:09.776096+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56286	156.229.233.170	6149	TCP
2025-02-16T14:49:11.528828+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56288	156.229.233.170	6149	TCP
2025-02-16T14:49:13.279942+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56290	156.229.233.170	6149	TCP
2025-02-16T14:49:15.071894+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56292	156.229.233.170	6149	TCP
2025-02-16T14:49:16.759431+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56294	156.229.233.170	6149	TCP
2025-02-16T14:49:18.433793+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56296	156.229.233.170	6149	TCP
2025-02-16T14:49:20.192902+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56298	156.229.233.170	6149	TCP
2025-02-16T14:49:21.842164+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56300	156.229.233.170	6149	TCP
2025-02-16T14:49:23.549263+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56302	156.229.233.170	6149	TCP
2025-02-16T14:49:25.244755+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56304	156.229.233.170	6149	TCP
2025-02-16T14:49:26.903373+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56306	156.229.233.170	6149	TCP
2025-02-16T14:49:28.637439+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56308	156.229.233.170	6149	TCP
2025-02-16T14:49:30.340768+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56310	156.229.233.170	6149	TCP
2025-02-16T14:49:32.069075+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56312	156.229.233.170	6149	TCP
2025-02-16T14:49:33.795304+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56314	156.229.233.170	6149	TCP
2025-02-16T14:49:35.453360+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56316	156.229.233.170	6149	TCP
2025-02-16T14:49:37.183086+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56318	156.229.233.170	6149	TCP
2025-02-16T14:49:38.892327+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56320	156.229.233.170	6149	TCP
2025-02-16T14:49:40.613620+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56322	156.229.233.170	6149	TCP
2025-02-16T14:49:42.293883+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56324	156.229.233.170	6149	TCP
2025-02-16T14:49:43.934530+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56326	156.229.233.170	6149	TCP
2025-02-16T14:49:45.650730+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56328	156.229.233.170	6149	TCP
2025-02-16T14:49:47.375151+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56330	156.229.233.170	6149	TCP
2025-02-16T14:49:49.028463+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56332	156.229.233.170	6149	TCP
2025-02-16T14:49:50.700140+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56334	156.229.233.170	6149	TCP
2025-02-16T14:49:52.357805+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56336	156.229.233.170	6149	TCP
2025-02-16T14:49:54.033440+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56338	156.229.233.170	6149	TCP
2025-02-16T14:49:55.682254+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56340	156.229.233.170	6149	TCP
2025-02-16T14:49:57.324183+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56342	156.229.233.170	6149	TCP
2025-02-16T14:49:58.983282+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56344	156.229.233.170	6149	TCP
2025-02-16T14:50:00.651705+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56346	156.229.233.170	6149	TCP
2025-02-16T14:50:02.294269+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56348	156.229.233.170	6149	TCP
2025-02-16T14:50:03.949976+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56350	156.229.233.170	6149	TCP
2025-02-16T14:50:05.605352+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56352	156.229.233.170	6149	TCP
2025-02-16T14:50:07.264518+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56354	156.229.233.170	6149	TCP
2025-02-16T14:50:08.920029+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56356	156.229.233.170	6149	TCP
2025-02-16T14:50:10.580159+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56358	156.229.233.170	6149	TCP
2025-02-16T14:50:12.253864+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56360	156.229.233.170	6149	TCP
2025-02-16T14:50:13.903507+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56362	156.229.233.170	6149	TCP
2025-02-16T14:50:15.547235+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56364	156.229.233.170	6149	TCP
2025-02-16T14:50:17.201266+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56366	156.229.233.170	6149	TCP
2025-02-16T14:50:18.841417+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56368	156.229.233.170	6149	TCP
2025-02-16T14:50:20.678715+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56370	156.229.233.170	6149	TCP
2025-02-16T14:50:22.327853+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56372	156.229.233.170	6149	TCP
2025-02-16T14:50:23.981895+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56374	156.229.233.170	6149	TCP
2025-02-16T14:50:25.637986+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56376	156.229.233.170	6149	TCP
2025-02-16T14:50:27.276861+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56378	156.229.233.170	6149	TCP
2025-02-16T14:50:28.924136+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56380	156.229.233.170	6149	TCP
2025-02-16T14:50:30.578183+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56382	156.229.233.170	6149	TCP
2025-02-16T14:50:32.234770+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56384	156.229.233.170	6149	TCP
2025-02-16T14:50:33.902322+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56386	156.229.233.170	6149	TCP
2025-02-16T14:50:35.714384+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56388	156.229.233.170	6149	TCP
2025-02-16T14:50:37.359015+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56390	156.229.233.170	6149	TCP
2025-02-16T14:50:39.013068+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56392	156.229.233.170	6149	TCP
2025-02-16T14:50:40.658684+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56394	156.229.233.170	6149	TCP
2025-02-16T14:50:42.312579+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56396	156.229.233.170	6149	TCP
2025-02-16T14:50:43.991415+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56398	156.229.233.170	6149	TCP
2025-02-16T14:50:45.637368+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56400	156.229.233.170	6149	TCP
2025-02-16T14:50:47.296912+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56402	156.229.233.170	6149	TCP
2025-02-16T14:50:48.951300+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56404	156.229.233.170	6149	TCP
2025-02-16T14:50:50.591198+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56406	156.229.233.170	6149	TCP
2025-02-16T14:50:52.235264+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56408	156.229.233.170	6149	TCP
2025-02-16T14:50:53.908058+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56410	156.229.233.170	6149	TCP
2025-02-16T14:50:55.565003+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56412	156.229.233.170	6149	TCP
2025-02-16T14:50:57.214981+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56414	156.229.233.170	6149	TCP
2025-02-16T14:50:58.874983+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56416	156.229.233.170	6149	TCP
2025-02-16T14:51:00.530834+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56418	156.229.233.170	6149	TCP
2025-02-16T14:51:02.206590+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56420	156.229.233.170	6149	TCP
2025-02-16T14:51:03.864661+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56422	156.229.233.170	6149	TCP
2025-02-16T14:51:05.532664+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56424	156.229.233.170	6149	TCP
2025-02-16T14:51:07.221067+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56426	156.229.233.170	6149	TCP
2025-02-16T14:51:08.893282+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56428	156.229.233.170	6149	TCP
2025-02-16T14:51:10.543348+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56430	156.229.233.170	6149	TCP
2025-02-16T14:51:12.202676+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56432	156.229.233.170	6149	TCP
2025-02-16T14:51:13.860523+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56434	156.229.233.170	6149	TCP
2025-02-16T14:51:15.513689+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56436	156.229.233.170	6149	TCP
2025-02-16T14:51:17.179555+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56438	156.229.233.170	6149	TCP
2025-02-16T14:51:18.825823+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56440	156.229.233.170	6149	TCP
2025-02-16T14:51:20.489177+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56442	156.229.233.170	6149	TCP
2025-02-16T14:51:22.138371+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56444	156.229.233.170	6149	TCP
2025-02-16T14:51:23.795002+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56446	156.229.233.170	6149	TCP
2025-02-16T14:51:25.453619+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56448	156.229.233.170	6149	TCP
2025-02-16T14:51:27.110687+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56450	156.229.233.170	6149	TCP
2025-02-16T14:51:28.775372+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56452	156.229.233.170	6149	TCP
2025-02-16T14:51:30.421032+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56454	156.229.233.170	6149	TCP
2025-02-16T14:51:32.077286+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56456	156.229.233.170	6149	TCP
2025-02-16T14:51:33.767022+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56458	156.229.233.170	6149	TCP
2025-02-16T14:51:35.423433+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56460	156.229.233.170	6149	TCP
2025-02-16T14:51:37.099667+0100	2848448	1	A Network Trojan was detected	192.168.2.23	56462	156.229.233.170	6149	TCP

Joe Sandbox Signatures

• AV Detection
• Spreading
• Networking
• System Summary
• Stealing of Sensitive Information
• Remote Access Functionality

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: pXdN91.x68.elf

Avira: detected

Found malware configuration

Source: pXdN91.x68.elf

Malware Configuration Extractor: Gafgyt {"C2 url": "156.229.233.170:6149"}

Multi AV Scanner detection for submitted file

Source: pXdN91.x68.elf	Virustotal: Detection: 60%			Perma Link
Source: pXdN91.x68.elf	ReversingLabs: Detection: 62%

Spreading

Opens /proc/net/* files useful for finding connected devices and routers

Source: /tmp/pXdN91.x68.elf (PID: 6247)

Opens: /proc/net/route

Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56252 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56232 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56244 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56222 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56256 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56282 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56216 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56230 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56260 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56238 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56224 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56292 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56266 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56246 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56286 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56298 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56306 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56248 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56250 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56220 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56380 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56366 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56332 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56398 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56302 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56264 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56254 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56416 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56258 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56384 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56268 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56412 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56458 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56272 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56236 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56278 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56284 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56314 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56424 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56274 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56290 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56228 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56460 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56334 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56336 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56240 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56372 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56378 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56434 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56270 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56226 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56294 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56280 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56402 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56390 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56320 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56262 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56410 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56296 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56450 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56214 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56382 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56310 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56414 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56396 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56322 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56210 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56308 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56234 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56436 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56354 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56340 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56348 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56356 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56324 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56328 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56364 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56326 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56462 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56212 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56406 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56454 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56316 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56420 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56360 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56330 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56368 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56430 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56448 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56358 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56304 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56344 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56456 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56350 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56386 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56288 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56426 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56318 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56394 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56242 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56374 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56408 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56404 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56432 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56370 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56346 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56446 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56388 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56444 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56300 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56422 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56352 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56418 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56338 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56362 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56392 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56452 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56438 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56442 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56440 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56218 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56428 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56276 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56312 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56342 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56376 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.23:56400 -> 156.229.233.170:6149

Source: global traffic

TCP traffic: 192.168.2.23:56210 -> 156.229.233.170:6149

Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56222 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56260 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56286 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56244 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56248 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56380 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56220 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56398 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56302 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56298 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56230 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56268 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56412 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56384 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56282 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56258 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56216 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56458 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56238 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56232 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56278 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56314 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56424 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56246 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56290 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56284 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56460 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56306 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56228 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56334 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56266 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56250 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56336 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56240 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56416 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56254 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56434 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56294 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56332 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56280 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56252 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56402 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56272 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56262 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56236 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56292 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56296 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56214 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56382 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56310 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56366 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56264 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56378 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56396 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56256 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56322 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56308 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56436 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56340 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56274 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56356 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56320 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56450 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56410 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56364 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56414 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56462 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56212 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56406 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56348 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56454 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56316 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56372 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56420 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56226 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56234 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56430 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56330 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56390 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56324 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56354 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56304 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56270 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56360 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56210 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56368 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56358 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56426 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56448 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56328 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56350 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56326 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56394 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56386 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56288 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56456 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56242 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56346 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56432 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56318 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56446 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56370 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56444 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56404 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56408 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56300 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56344 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56374 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56352 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56388 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56418 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56362 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56392 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56452 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56422 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56438 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56442 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56338 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56440 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56218 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56428 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56224 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56276 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56312 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56342 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56376 -> 156.229.233.170:6149
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:56400 -> 156.229.233.170:6149

Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443

Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.233.170
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.233.170
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.233.170
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.233.170
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.233.170
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.233.170
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.233.170
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.233.170
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.233.170
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.233.170
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.233.170
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.233.170
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.233.170
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.233.170
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.233.170
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.233.170
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.233.170
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.233.170
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.233.170
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.233.170
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.233.170
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.233.170
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.233.170
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.233.170
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.233.170
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.233.170
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.233.170
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.233.170
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.233.170
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.233.170
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.233.170
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.233.170
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.233.170
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.233.170
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.233.170
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.233.170
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.233.170
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.233.170
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.233.170
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.233.170
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.233.170
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.233.170
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.233.170
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.233.170
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.233.170
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.233.170
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.233.170
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.233.170

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: pXdN91.x68.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: pXdN91.x68.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 Author: unknown
Source: pXdN91.x68.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a10161ce Author: unknown
Source: pXdN91.x68.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: pXdN91.x68.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 Author: unknown
Source: pXdN91.x68.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a0a4de11 Author: unknown
Source: pXdN91.x68.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: pXdN91.x68.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: pXdN91.x68.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_09c3070e Author: unknown
Source: pXdN91.x68.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: pXdN91.x68.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: pXdN91.x68.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_dd0d6173 Author: unknown
Source: pXdN91.x68.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_779e142f Author: unknown
Source: pXdN91.x68.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_cf84c9f2 Author: unknown
Source: pXdN91.x68.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_859042a0 Author: unknown
Source: pXdN91.x68.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: pXdN91.x68.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_e4a1982b Author: unknown
Source: 6247.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6247.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 Author: unknown
Source: 6247.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a10161ce Author: unknown
Source: 6247.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 6247.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 Author: unknown
Source: 6247.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a0a4de11 Author: unknown
Source: 6247.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6247.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 6247.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_09c3070e Author: unknown
Source: 6247.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 6247.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 6247.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_dd0d6173 Author: unknown
Source: 6247.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_779e142f Author: unknown
Source: 6247.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_cf84c9f2 Author: unknown
Source: 6247.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_859042a0 Author: unknown
Source: 6247.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 6247.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_e4a1982b Author: unknown
Source: 6249.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6249.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 Author: unknown
Source: 6249.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a10161ce Author: unknown
Source: 6249.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 6249.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 Author: unknown
Source: 6249.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a0a4de11 Author: unknown
Source: 6249.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6249.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 6249.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_09c3070e Author: unknown
Source: 6249.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 6249.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 6249.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_dd0d6173 Author: unknown
Source: 6249.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_779e142f Author: unknown
Source: 6249.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_cf84c9f2 Author: unknown
Source: 6249.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_859042a0 Author: unknown
Source: 6249.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 6249.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_e4a1982b Author: unknown
Source: Process Memory Space: pXdN91.x68.elf PID: 6247, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: pXdN91.x68.elf PID: 6247, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: pXdN91.x68.elf PID: 6249, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: pXdN91.x68.elf PID: 6249, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown

Contains symbols with names commonly found in malware

Source: ELF static info symbol of initial sample

Name: vseattack

Source: pXdN91.x68.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: pXdN91.x68.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = cdd0bb9ce40a000bb86b0c76616fe71fb7dbb87a044ddd778b7a07fdf804b877, id = a6a2adb9-9d54-42d4-abed-5b30d8062e97, last_modified = 2021-09-16
Source: pXdN91.x68.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a10161ce os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 77e89011a67a539954358118d41ad3dabde0e69bac2bbb2b2da18eaad427d935, id = a10161ce-62e0-4f60-9de7-bd8caf8618be, last_modified = 2021-09-16
Source: pXdN91.x68.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: pXdN91.x68.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 1c5df68501b688905484ed47dc588306828aa7c114644428e22e5021bb39bd4a, id = f3d83a74-2888-435a-9a3c-b7de25084e9a, last_modified = 2021-09-16
Source: pXdN91.x68.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a0a4de11 reference_sample = cf1ca1d824c8687e87a5b0275a0e39fa101442b4bbf470859ddda9982f9b3417, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 891cfc6a4c38fb257ada29050e0047bd1301e8f0a6a1a919685b1fcc2960b047, id = a0a4de11-fe65-449f-a990-ad5f18ac66f0, last_modified = 2021-09-16
Source: pXdN91.x68.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: pXdN91.x68.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: pXdN91.x68.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_09c3070e reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 84fad96b60b297736c149e14de12671ff778bff427ab7684df2c541a6f6d7e7d, id = 09c3070e-4b71-45a0-aa62-0cc6e496644a, last_modified = 2021-09-16
Source: pXdN91.x68.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: pXdN91.x68.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: pXdN91.x68.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_dd0d6173 reference_sample = c5a317d0d8470814ff343ce78ad2428ebb3f036763fcf703a589b6c4d33a3ec6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 5e2cb111c2b712951b71166111d339724b4f52b93f90cb474f1e67598212605f, id = dd0d6173-b863-45cf-9348-3375a4e624cf, last_modified = 2021-09-16
Source: pXdN91.x68.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_779e142f reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 83377b6fa77fda4544c409487d2d2c1ddcef8f7d4120f49a18888c7536f3969f, id = 779e142f-b867-46e6-b1fb-9105976f42fd, last_modified = 2021-09-16
Source: pXdN91.x68.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_cf84c9f2 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = bb766b356c3e8706740e3bb9b4a7171d8eb5137e09fc7ab6952412fa55e2dcfc, id = cf84c9f2-7435-4faf-8c5f-d14945ffad7a, last_modified = 2021-09-16
Source: pXdN91.x68.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_859042a0 reference_sample = 41615d3f3f27f04669166fdee3996d77890016304ee87851a5f90804d6d4a0b0, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a27bcaa16edceda3dc5a80803372c907a7efd00736c7859c5a9d6a2cf56a8eec, id = 859042a0-a424-4c83-944b-ed182b342998, last_modified = 2021-09-16
Source: pXdN91.x68.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: pXdN91.x68.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_e4a1982b os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d9f852c28433128b0fd330bee35f7bd4aada5226e9ca865fe5cd8cca52b2a622, id = e4a1982b-928a-4da5-b497-cedc1d26e845, last_modified = 2021-09-16
Source: 6247.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6247.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = cdd0bb9ce40a000bb86b0c76616fe71fb7dbb87a044ddd778b7a07fdf804b877, id = a6a2adb9-9d54-42d4-abed-5b30d8062e97, last_modified = 2021-09-16
Source: 6247.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a10161ce os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 77e89011a67a539954358118d41ad3dabde0e69bac2bbb2b2da18eaad427d935, id = a10161ce-62e0-4f60-9de7-bd8caf8618be, last_modified = 2021-09-16
Source: 6247.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 6247.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 1c5df68501b688905484ed47dc588306828aa7c114644428e22e5021bb39bd4a, id = f3d83a74-2888-435a-9a3c-b7de25084e9a, last_modified = 2021-09-16
Source: 6247.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a0a4de11 reference_sample = cf1ca1d824c8687e87a5b0275a0e39fa101442b4bbf470859ddda9982f9b3417, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 891cfc6a4c38fb257ada29050e0047bd1301e8f0a6a1a919685b1fcc2960b047, id = a0a4de11-fe65-449f-a990-ad5f18ac66f0, last_modified = 2021-09-16
Source: 6247.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6247.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 6247.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_09c3070e reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 84fad96b60b297736c149e14de12671ff778bff427ab7684df2c541a6f6d7e7d, id = 09c3070e-4b71-45a0-aa62-0cc6e496644a, last_modified = 2021-09-16
Source: 6247.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 6247.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 6247.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_dd0d6173 reference_sample = c5a317d0d8470814ff343ce78ad2428ebb3f036763fcf703a589b6c4d33a3ec6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 5e2cb111c2b712951b71166111d339724b4f52b93f90cb474f1e67598212605f, id = dd0d6173-b863-45cf-9348-3375a4e624cf, last_modified = 2021-09-16
Source: 6247.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_779e142f reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 83377b6fa77fda4544c409487d2d2c1ddcef8f7d4120f49a18888c7536f3969f, id = 779e142f-b867-46e6-b1fb-9105976f42fd, last_modified = 2021-09-16
Source: 6247.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_cf84c9f2 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = bb766b356c3e8706740e3bb9b4a7171d8eb5137e09fc7ab6952412fa55e2dcfc, id = cf84c9f2-7435-4faf-8c5f-d14945ffad7a, last_modified = 2021-09-16
Source: 6247.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_859042a0 reference_sample = 41615d3f3f27f04669166fdee3996d77890016304ee87851a5f90804d6d4a0b0, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a27bcaa16edceda3dc5a80803372c907a7efd00736c7859c5a9d6a2cf56a8eec, id = 859042a0-a424-4c83-944b-ed182b342998, last_modified = 2021-09-16
Source: 6247.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 6247.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_e4a1982b os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d9f852c28433128b0fd330bee35f7bd4aada5226e9ca865fe5cd8cca52b2a622, id = e4a1982b-928a-4da5-b497-cedc1d26e845, last_modified = 2021-09-16
Source: 6249.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6249.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = cdd0bb9ce40a000bb86b0c76616fe71fb7dbb87a044ddd778b7a07fdf804b877, id = a6a2adb9-9d54-42d4-abed-5b30d8062e97, last_modified = 2021-09-16
Source: 6249.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a10161ce os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 77e89011a67a539954358118d41ad3dabde0e69bac2bbb2b2da18eaad427d935, id = a10161ce-62e0-4f60-9de7-bd8caf8618be, last_modified = 2021-09-16
Source: 6249.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 6249.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 1c5df68501b688905484ed47dc588306828aa7c114644428e22e5021bb39bd4a, id = f3d83a74-2888-435a-9a3c-b7de25084e9a, last_modified = 2021-09-16
Source: 6249.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a0a4de11 reference_sample = cf1ca1d824c8687e87a5b0275a0e39fa101442b4bbf470859ddda9982f9b3417, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 891cfc6a4c38fb257ada29050e0047bd1301e8f0a6a1a919685b1fcc2960b047, id = a0a4de11-fe65-449f-a990-ad5f18ac66f0, last_modified = 2021-09-16
Source: 6249.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6249.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 6249.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_09c3070e reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 84fad96b60b297736c149e14de12671ff778bff427ab7684df2c541a6f6d7e7d, id = 09c3070e-4b71-45a0-aa62-0cc6e496644a, last_modified = 2021-09-16
Source: 6249.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 6249.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 6249.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_dd0d6173 reference_sample = c5a317d0d8470814ff343ce78ad2428ebb3f036763fcf703a589b6c4d33a3ec6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 5e2cb111c2b712951b71166111d339724b4f52b93f90cb474f1e67598212605f, id = dd0d6173-b863-45cf-9348-3375a4e624cf, last_modified = 2021-09-16
Source: 6249.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_779e142f reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 83377b6fa77fda4544c409487d2d2c1ddcef8f7d4120f49a18888c7536f3969f, id = 779e142f-b867-46e6-b1fb-9105976f42fd, last_modified = 2021-09-16
Source: 6249.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_cf84c9f2 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = bb766b356c3e8706740e3bb9b4a7171d8eb5137e09fc7ab6952412fa55e2dcfc, id = cf84c9f2-7435-4faf-8c5f-d14945ffad7a, last_modified = 2021-09-16
Source: 6249.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_859042a0 reference_sample = 41615d3f3f27f04669166fdee3996d77890016304ee87851a5f90804d6d4a0b0, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a27bcaa16edceda3dc5a80803372c907a7efd00736c7859c5a9d6a2cf56a8eec, id = 859042a0-a424-4c83-944b-ed182b342998, last_modified = 2021-09-16
Source: 6249.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 6249.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_e4a1982b os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d9f852c28433128b0fd330bee35f7bd4aada5226e9ca865fe5cd8cca52b2a622, id = e4a1982b-928a-4da5-b497-cedc1d26e845, last_modified = 2021-09-16
Source: Process Memory Space: pXdN91.x68.elf PID: 6247, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: pXdN91.x68.elf PID: 6247, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: pXdN91.x68.elf PID: 6249, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: pXdN91.x68.elf PID: 6249, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.spre.troj.linELF@0/0@0/0

Source: pXdN91.x68.elf	ELF static info symbol of initial sample: libc/string/x86_64/bzero.S
Source: pXdN91.x68.elf	ELF static info symbol of initial sample: libc/string/x86_64/memcpy.S
Source: pXdN91.x68.elf	ELF static info symbol of initial sample: libc/string/x86_64/mempcpy.S
Source: pXdN91.x68.elf	ELF static info symbol of initial sample: libc/string/x86_64/memset.S
Source: pXdN91.x68.elf	ELF static info symbol of initial sample: libc/string/x86_64/strcat.S
Source: pXdN91.x68.elf	ELF static info symbol of initial sample: libc/string/x86_64/strchr.S
Source: pXdN91.x68.elf	ELF static info symbol of initial sample: libc/string/x86_64/strcmp.S
Source: pXdN91.x68.elf	ELF static info symbol of initial sample: libc/string/x86_64/strcpy.S
Source: pXdN91.x68.elf	ELF static info symbol of initial sample: libc/string/x86_64/strcspn.S
Source: pXdN91.x68.elf	ELF static info symbol of initial sample: libc/string/x86_64/strlen.S
Source: pXdN91.x68.elf	ELF static info symbol of initial sample: libc/string/x86_64/strpbrk.S
Source: pXdN91.x68.elf	ELF static info symbol of initial sample: libc/string/x86_64/strspn.S
Source: pXdN91.x68.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/x86_64/crt1.S
Source: pXdN91.x68.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/x86_64/crti.S
Source: pXdN91.x68.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/x86_64/crtn.S

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match	File source: pXdN91.x68.elf, type: SAMPLE
Source: Yara match	File source: 6247.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6249.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY

Yara detected Mirai

Source: Yara match	File source: pXdN91.x68.elf, type: SAMPLE
Source: Yara match	File source: 6247.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6249.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: pXdN91.x68.elf PID: 6247, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: pXdN91.x68.elf PID: 6249, type: MEMORYSTR

Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U;) Presto/2.7.62 Version/11.01
Source: Initial sample	User agent string found: Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.117 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.117 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_2 like Mac OS X) AppleWebKit/603.2.4 (KHTML, like Gecko) Version/10.0 Mobile/14F89 Safari/602.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Linux; Android 5.0.2; HTCONE Build/LRX22G) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.125 Mobile Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.79 Safari/537.36 Edge/14.14393
Source: Initial sample	User agent string found: Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_2 like Mac OS X) AppleWebKit/603.2.4 (KHTML, like Gecko) Mobile/14F89
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.71 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:54.0) Gecko/20100101 Firefox/54.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Remote Access Functionality

Detected Mirai

Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity

Yara detected Gafgyt

Source: Yara match	File source: pXdN91.x68.elf, type: SAMPLE
Source: Yara match	File source: 6247.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6249.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY

Yara detected Mirai

Source: Yara match	File source: pXdN91.x68.elf, type: SAMPLE
Source: Yara match	File source: 6247.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6249.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: pXdN91.x68.elf PID: 6247, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: pXdN91.x68.elf PID: 6249, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	OS Credential Dumping	1 Remote System Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

Threatname: Gafgyt

{
  "C2 url": "156.229.233.170:6149"
}

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
pXdN91.x68.elf	61%	Virustotal		Browse
pXdN91.x68.elf	62%	ReversingLabs	Linux.Backdoor.DemonBot
pXdN91.x68.elf	100%	Avira	EXP/ELF.Mirai.Z

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

⊘No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
156.229.233.170:6149	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
156.229.233.170	unknown	Seychelles	139086	ONL-HKOCEANNETWORKLIMITEDHK	true
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.43	main_sh4.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	boatnet.x86.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	sshd.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Prometei	Browse
91.189.91.42	main_sh4.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	boatnet.x86.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	sshd.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Prometei	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	main_sh4.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	boatnet.x86.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	boatnet.arc.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	sshd.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
CANONICAL-ASGB	main_sh4.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	boatnet.x86.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	boatnet.arc.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	sshd.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
ONL-HKOCEANNETWORKLIMITEDHK	gmips.elf	Get hash	malicious	Unknown	Browse	156.229.232.154
	arm5.elf	Get hash	malicious	Unknown	Browse	156.229.232.154
	garm5.elf	Get hash	malicious	Unknown	Browse	156.229.232.154
	gx86.elf	Get hash	malicious	Unknown	Browse	156.229.232.154
	garm7.elf	Get hash	malicious	Mirai	Browse	156.229.232.154
	garm.elf	Get hash	malicious	Unknown	Browse	156.229.232.154
	gmpsl.elf	Get hash	malicious	Unknown	Browse	156.229.232.154
	arm7.elf	Get hash	malicious	Mirai	Browse	156.229.232.154
	mpsl.elf	Get hash	malicious	Unknown	Browse	156.229.232.154
	mips.elf	Get hash	malicious	Unknown	Browse	156.229.232.154
INIT7CH	main_sh4.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	boatnet.x86.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	sshd.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, not stripped
Entropy (8bit):	5.931583289530539
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	pXdN91.x68.elf
File size:	120'952 bytes
MD5:	e9a3fc1cc9b49e2480c67a02c8dbef8b
SHA1:	f7c1d125a02a3889c67e4c4e79ca8d16c3602787
SHA256:	dd291309e4bb8d184bd744462143cbb07ccd92751d1bb1d5da92f257cd86e0a3
SHA512:	c20c3f6c9e5d5df7c59246ef5d74dbf65a31d3ba88d5e40ffe0ea08663b14740a1b7e3918948d9563ba29857fdf689d7a8e5c7b606286396a550716b5ca3071c
SSDEEP:	3072:xMxB5Tc9xfHxFScXcsi+TMoc6Qgmom0ea7HWvP:Cxs9x/gsjLGom0eaTWvP
TLSH:	36C35B03D661C5BAC0C762751BEF8632E563B4F91731322723D4BEA02F129D99F5A782
File Content Preview:	.ELF..............>.......@.....@.......Hg..........@.8...@.......................@.......@......................................0.......0Q......0Q.....H+......................Q.td....................................................H...._....J...H........

Static ELF Info

ELF header
Class:	ELF64
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Advanced Micro Devices X86-64
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x400194
Flags:	0x0
ELF Header Size:	64
Program Header Offset:	64
Program Header Size:	56
Number of Program Headers:	3
Section Header Offset:	91976
Section Header Size:	64
Number of Section Headers:	15
Header String Table Index:	12

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x4000e8	0xe8	0x13	0x0	0x6	AX	0	0	1
.text	PROGBITS	0x400100	0x100	0xe374	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x40e474	0xe474	0xe	0x0	0x6	AX	0	0	1
.rodata	PROGBITS	0x40e4a0	0xe4a0	0x4960	0x0	0x2	A	0	0	32
.eh_frame	PROGBITS	0x513000	0x13000	0x2614	0x0	0x3	WA	0	0	8
.ctors	PROGBITS	0x515618	0x15618	0x10	0x0	0x3	WA	0	0	8
.dtors	PROGBITS	0x515628	0x15628	0x10	0x0	0x3	WA	0	0	8
.jcr	PROGBITS	0x515638	0x15638	0x8	0x0	0x3	WA	0	0	8
.data	PROGBITS	0x515640	0x15640	0x508	0x0	0x3	WA	0	0	32
.bss	NOBITS	0x515b60	0x15b48	0x6b58	0x0	0x3	WA	0	0	32
.comment	PROGBITS	0x0	0x15b48	0xb9a	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x166e2	0x66	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x16b08	0x4848	0x18	0x0		14	273	8
.strtab	STRTAB	0x0	0x1b350	0x2528	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x12e00	0x12e00	6.4198	0x5	R E	0x100000	.init .text .fini .rodata
LOAD	0x13000	0x513000	0x513000	0x2b48	0x96b8	3.5884	0x6	RW	0x100000	.eh_frame .ctors .dtors .jcr .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x8

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x4000e8	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x400100	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x40e474	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x40e4a0	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x513000	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x515618	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x515628	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x515638	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x515640	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x515b60	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	14
C.1.3840	.symtab	0x411480	40	OBJECT	<unknown>	DEFAULT	4
C.105.6230	.symtab	0x4102a0	2256	OBJECT	<unknown>	DEFAULT	4
Nulled	.symtab	0x51bea0	80	OBJECT	<unknown>	DEFAULT	10
Q	.symtab	0x515be0	16384	OBJECT	<unknown>	DEFAULT	10
Randhex	.symtab	0x402765	385	FUNC	<unknown>	DEFAULT	2
SendHTTP	.symtab	0x403477	379	FUNC	<unknown>	DEFAULT	2
SendHttpRand	.symtab	0x4035f2	541	FUNC	<unknown>	DEFAULT	2
SendHttpRand2	.symtab	0x40204c	541	FUNC	<unknown>	DEFAULT	2
SendSTDHEX	.symtab	0x401716	595	FUNC	<unknown>	DEFAULT	2
_Exit	.symtab	0x405ac8	43	FUNC	<unknown>	DEFAULT	2
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x515620	0	OBJECT	<unknown>	DEFAULT	6
__CTOR_LIST__	.symtab	0x515618	0	OBJECT	<unknown>	DEFAULT	6
__C_ctype_b	.symtab	0x515768	8	OBJECT	<unknown>	DEFAULT	9
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x410e80	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x515b38	8	OBJECT	<unknown>	DEFAULT	9
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x412b00	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x515778	8	OBJECT	<unknown>	DEFAULT	9
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x411180	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x515630	0	OBJECT	<unknown>	DEFAULT	7
__DTOR_LIST__	.symtab	0x515628	0	OBJECT	<unknown>	DEFAULT	7
__EH_FRAME_BEGIN__	.symtab	0x513000	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x515610	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x515768	8	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_tolower	.symtab	0x515b38	8	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_toupper	.symtab	0x515778	8	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_b	.symtab	0x515770	8	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_tolower	.symtab	0x515b40	8	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_toupper	.symtab	0x515780	8	OBJECT	<unknown>	HIDDEN	9
__GI___errno_location	.symtab	0x405e20	6	FUNC	<unknown>	HIDDEN	2
__GI___fcntl_nocancel	.symtab	0x4059a8	100	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x40b414	222	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x407a14	14	FUNC	<unknown>	HIDDEN	2
__GI___h_errno_location	.symtab	0x40a018	6	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x405944	100	FUNC	<unknown>	HIDDEN	2
__GI___sigaddset	.symtab	0x407e88	28	FUNC	<unknown>	HIDDEN	2
__GI___sigdelset	.symtab	0x407ea4	30	FUNC	<unknown>	HIDDEN	2
__GI___sigismember	.symtab	0x407e68	32	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x4096f0	70	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x40976b	58	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x407a40	196	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x405ac8	43	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x408cc4	200	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x409168	18	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x40c4f8	43	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0x40587c	38	FUNC	<unknown>	HIDDEN	2
__GI_clock_getres	.symtab	0x409ad8	41	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x405af4	41	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0x405b54	147	FUNC	<unknown>	HIDDEN	2
__GI_config_close	.symtab	0x40a2e2	43	FUNC	<unknown>	HIDDEN	2
__GI_config_open	.symtab	0x40a30d	46	FUNC	<unknown>	HIDDEN	2
__GI_config_read	.symtab	0x40a020	706	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x407c74	43	FUNC	<unknown>	HIDDEN	2
__GI_errno	.symtab	0x51be38	4	OBJECT	<unknown>	HIDDEN	10
__GI_exit	.symtab	0x4092dc	92	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x40a40c	269	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x405944	100	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x40b2d0	322	FUNC	<unknown>	HIDDEN	2
__GI_fgetc	.symtab	0x40b104	128	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x40b414	222	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x40b184	116	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x40b4f4	116	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x40a51c	10	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x4057f4	38	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x407054	56	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x40c558	5	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x40c560	225	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x409b3c	82	FUNC	<unknown>	HIDDEN	2
__GI_fstat64	.symtab	0x409b3c	82	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x40708c	128	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x40b414	222	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x4058f4	36	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x409b2c	8	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x409b34	8	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x409bdc	8	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname	.symtab	0x407c24	10	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2	.symtab	0x407c30	65	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2_r	.symtab	0x40be60	761	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x40db28	791	FUNC	<unknown>	HIDDEN	2
__GI_gethostname	.symtab	0x40de9c	94	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x409abc	19	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x4057e4	8	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x409b04	40	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x407ca0	41	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x409ad0	8	FUNC	<unknown>	HIDDEN	2
__GI_h_errno	.symtab	0x51be3c	4	OBJECT	<unknown>	HIDDEN	10
__GI_htonl	.symtab	0x407b98	5	FUNC	<unknown>	HIDDEN	2
__GI_htons	.symtab	0x407b90	8	FUNC	<unknown>	HIDDEN	2
__GI_inet_addr	.symtab	0x407c04	29	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x40bdd8	135	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa	.symtab	0x407bf9	10	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa_r	.symtab	0x407bac	77	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x40cc1d	518	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x40c93d	493	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x4090ac	185	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x405a60	101	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x407b04	25	FUNC	<unknown>	HIDDEN	2
__GI_isspace	.symtab	0x405b20	18	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x405918	44	FUNC	<unknown>	HIDDEN	2
__GI_lseek	.symtab	0x40de6c	45	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x40c550	5	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x40b6dc	236	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x407740	102	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x40b7c8	702	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x40b680	90	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x40bba8	233	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x407110	210	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x4099e0	48	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x40c524	42	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x409de8	38	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x409e10	38	FUNC	<unknown>	HIDDEN	2
__GI_ntohl	.symtab	0x407ba5	5	FUNC	<unknown>	HIDDEN	2
__GI_ntohs	.symtab	0x407b9d	8	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x405778	106	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0x405c7d	157	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x40de40	41	FUNC	<unknown>	HIDDEN	2
__GI_printf	.symtab	0x405e28	157	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x40c15c	18	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x408d98	72	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x408f9b	90	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x40bae8	189	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x4058cc	39	FUNC	<unknown>	HIDDEN	2
__GI_readdir	.symtab	0x405d90	143	FUNC	<unknown>	HIDDEN	2
__GI_readdir64	.symtab	0x409f88	143	FUNC	<unknown>	HIDDEN	2
__GI_readlink	.symtab	0x4058a4	39	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x407d00	11	FUNC	<unknown>	HIDDEN	2
__GI_recvfrom	.symtab	0x407d0c	45	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x409b90	74	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x405850	44	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x407d3c	11	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x407d48	48	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x405a38	38	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x407d78	53	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x408ef0	171	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x409a19	114	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x407de0	133	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x409e38	47	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x409338	142	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x407db0	47	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x405ec8	149	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x408ff5	183	FUNC	<unknown>	HIDDEN	2
__GI_stat	.symtab	0x40defc	79	FUNC	<unknown>	HIDDEN	2
__GI_stat64	.symtab	0x40defc	79	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x40e36c	48	FUNC	<unknown>	HIDDEN	2
__GI_strcat	.symtab	0x407590	428	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x4071f0	417	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul	.symtab	0x40bccc	268	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x407484	33	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x407484	33	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x4074b0	213	FUNC	<unknown>	HIDDEN	2
__GI_strcspn	.symtab	0x40b568	135	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x40df4c	54	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x4073a0	225	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x40c834	131	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x407948	201	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x40c7a8	140	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x40bc94	53	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x40b5f0	135	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x407884	193	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x407a34	10	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x40ba88	94	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x40917c	10	FUNC	<unknown>	HIDDEN	2
__GI_strtoll	.symtab	0x40917c	10	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x4094a7	499	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x407b20	110	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x4057ec	8	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x405b34	30	FUNC	<unknown>	HIDDEN	2
__GI_uname	.symtab	0x40e344	38	FUNC	<unknown>	HIDDEN	2
__GI_vfprintf	.symtab	0x406140	150	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x405f60	189	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x409a8c	47	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x40581c	7	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x40a33c	68	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x40a390	123	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x40a380	15	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x405a0c	42	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x515638	0	OBJECT	<unknown>	DEFAULT	8
__JCR_LIST__	.symtab	0x515638	0	OBJECT	<unknown>	DEFAULT	8
__app_fini	.symtab	0x51be28	8	OBJECT	<unknown>	HIDDEN	10
__atexit_lock	.symtab	0x515af0	40	OBJECT	<unknown>	DEFAULT	9
__bss_start	.symtab	0x515b48	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x409736	53	FUNC	<unknown>	DEFAULT	2
__close_nameservers	.symtab	0x40da88	109	FUNC	<unknown>	HIDDEN	2
__ctype_b	.symtab	0x515770	8	OBJECT	<unknown>	DEFAULT	9
__ctype_tolower	.symtab	0x515b40	8	OBJECT	<unknown>	DEFAULT	9
__ctype_toupper	.symtab	0x515780	8	OBJECT	<unknown>	DEFAULT	9
__curbrk	.symtab	0x51be40	8	OBJECT	<unknown>	HIDDEN	10
__data_start	.symtab	0x515650	0	NOTYPE	<unknown>	DEFAULT	9
__decode_dotted	.symtab	0x40ce24	280	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x40e048	156	FUNC	<unknown>	HIDDEN	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__dns_lookup	.symtab	0x40cf3c	1836	FUNC	<unknown>	HIDDEN	2
__do_global_ctors_aux	.symtab	0x40e440	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x400100	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x515640	0	OBJECT	<unknown>	HIDDEN	9
__encode_dotted	.symtab	0x40e39c	162	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x40df84	193	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x40e0e4	80	FUNC	<unknown>	HIDDEN	2
__environ	.symtab	0x51be18	8	OBJECT	<unknown>	DEFAULT	10
__errno_location	.symtab	0x405e20	6	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x51be08	8	OBJECT	<unknown>	HIDDEN	10
__fcntl_nocancel	.symtab	0x4059a8	100	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x40b414	222	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x515614	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fini_array_start	.symtab	0x515614	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__get_hosts_byname_r	.symtab	0x40daf8	48	FUNC	<unknown>	HIDDEN	2
__getdents	.symtab	0x409e68	288	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x409e68	288	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x409abc	19	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x407a14	14	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__h_errno_location	.symtab	0x40a018	6	FUNC	<unknown>	DEFAULT	2
__h_errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__init_array_end	.symtab	0x515614	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__init_array_start	.symtab	0x515614	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__libc_close	.symtab	0x405af4	41	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x407c74	43	FUNC	<unknown>	DEFAULT	2
__libc_fcntl	.symtab	0x405944	100	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x4057f4	38	FUNC	<unknown>	DEFAULT	2
__libc_lseek	.symtab	0x40de6c	45	FUNC	<unknown>	DEFAULT	2
__libc_lseek64	.symtab	0x40c550	5	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0x409e10	38	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x405778	106	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x4058cc	39	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x407d00	11	FUNC	<unknown>	DEFAULT	2
__libc_recvfrom	.symtab	0x407d0c	45	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x405850	44	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x407d3c	11	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x407d48	48	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x409a19	114	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x51be10	8	OBJECT	<unknown>	DEFAULT	10
__libc_waitpid	.symtab	0x40581c	7	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x405a0c	42	FUNC	<unknown>	DEFAULT	2
__local_nameserver	.symtab	0x412ae0	16	OBJECT	<unknown>	HIDDEN	4
__malloc_consolidate	.symtab	0x40894e	407	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x407ec4	110	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x5159b0	40	OBJECT	<unknown>	DEFAULT	9
__malloc_state	.symtab	0x51bfb0	1752	OBJECT	<unknown>	DEFAULT	10
__malloc_trim	.symtab	0x4088b8	150	FUNC	<unknown>	DEFAULT	2
__nameserver	.symtab	0x51c6a8	8	OBJECT	<unknown>	HIDDEN	10
__nameservers	.symtab	0x51c6b0	4	OBJECT	<unknown>	HIDDEN	10
__open_etc_hosts	.symtab	0x40e134	10	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x40d6bd	968	FUNC	<unknown>	HIDDEN	2
__pagesize	.symtab	0x51be20	8	OBJECT	<unknown>	DEFAULT	10
__preinit_array_end	.symtab	0x515614	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__preinit_array_start	.symtab	0x515614	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__progname	.symtab	0x515b20	8	OBJECT	<unknown>	DEFAULT	9
__progname_full	.symtab	0x515b28	8	OBJECT	<unknown>	DEFAULT	9
__pthread_initialize_minimal	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0x4096d3	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x4096d0	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x4096d0	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x4096d0	3	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x4096d0	3	FUNC	<unknown>	DEFAULT	2
__read_etc_hosts_r	.symtab	0x40e13e	518	FUNC	<unknown>	HIDDEN	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__res_sync	.symtab	0x51c698	8	OBJECT	<unknown>	HIDDEN	10
__resolv_attempts	.symtab	0x515b35	1	OBJECT	<unknown>	HIDDEN	9
__resolv_lock	.symtab	0x51be50	40	OBJECT	<unknown>	DEFAULT	10
__resolv_timeout	.symtab	0x515b34	1	OBJECT	<unknown>	HIDDEN	9
__restore_rt	.symtab	0x409a10	0	NOTYPE	<unknown>	DEFAULT	2
__rtld_fini	.symtab	0x51be30	8	OBJECT	<unknown>	HIDDEN	10
__searchdomain	.symtab	0x51c6a0	8	OBJECT	<unknown>	HIDDEN	10
__searchdomains	.symtab	0x51c6b4	4	OBJECT	<unknown>	HIDDEN	10
__sigaddset	.symtab	0x407e88	28	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x407ea4	30	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x407e68	32	FUNC	<unknown>	DEFAULT	2
__stdin	.symtab	0x5157a8	8	OBJECT	<unknown>	DEFAULT	9
__stdio_READ	.symtab	0x40c644	58	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x40a528	150	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x40c680	131	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x40a7f4	259	FUNC	<unknown>	HIDDEN	2
__stdio_init_mutex	.symtab	0x40607f	15	FUNC	<unknown>	HIDDEN	2
__stdio_mutex_initializer.4911	.symtab	0x4114b0	40	OBJECT	<unknown>	DEFAULT	4
__stdio_rfill	.symtab	0x40c704	37	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x40c788	31	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x40c72c	90	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x40a8f8	149	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x406118	39	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x5157b0	8	OBJECT	<unknown>	DEFAULT	9
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uClibc_fini	.symtab	0x4096f0	70	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x40976b	58	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x4097a5	570	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x515b18	8	OBJECT	<unknown>	HIDDEN	9
__xpg_strerror_r	.symtab	0x407a40	196	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__xstat32_conv	.symtab	0x409c90	172	FUNC	<unknown>	HIDDEN	2
__xstat64_conv	.symtab	0x409be4	172	FUNC	<unknown>	HIDDEN	2
__xstat_conv	.symtab	0x409d3c	172	FUNC	<unknown>	HIDDEN	2
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_bss_custom_printf_spec	.symtab	0x51bbf0	10	OBJECT	<unknown>	DEFAULT	10
_charpad	.symtab	0x4061d8	77	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_custom_printf_arginfo	.symtab	0x51bf00	80	OBJECT	<unknown>	HIDDEN	10
_custom_printf_handler	.symtab	0x51bf50	80	OBJECT	<unknown>	HIDDEN	10
_custom_printf_spec	.symtab	0x5159a0	8	OBJECT	<unknown>	HIDDEN	9
_dl_aux_init	.symtab	0x40c4e0	23	FUNC	<unknown>	DEFAULT	2
_dl_phdr	.symtab	0x51c688	8	OBJECT	<unknown>	DEFAULT	10
_dl_phnum	.symtab	0x51c690	8	OBJECT	<unknown>	DEFAULT	10
_edata	.symtab	0x515b48	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x51c6b8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_errno	.symtab	0x51be38	4	OBJECT	<unknown>	DEFAULT	10
_exit	.symtab	0x405ac8	43	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x40e474	0	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x519bf0	8192	OBJECT	<unknown>	DEFAULT	10
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x406225	120	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x40aae4	1565	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_h_errno	.symtab	0x51be3c	4	OBJECT	<unknown>	DEFAULT	10
_init	.symtab	0x4000e8	0	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x40a990	85	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_init	.symtab	0x406954	114	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x406bee	1126	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x4069c8	67	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x406a0c	436	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x406bc0	46	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x4096de	18	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x4096d6	8	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_sigintr	.symtab	0x51bfa0	8	OBJECT	<unknown>	HIDDEN	10
_start	.symtab	0x400194	42	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x40a5c0	563	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x406020	95	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x5157b8	8	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_add_lock	.symtab	0x5157c0	40	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_dec_use	.symtab	0x40b1f8	216	FUNC	<unknown>	HIDDEN	2
_stdio_openlist_del_count	.symtab	0x519be4	4	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_del_lock	.symtab	0x5157f0	40	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_use_count	.symtab	0x519be0	4	OBJECT	<unknown>	DEFAULT	10
_stdio_streams	.symtab	0x515820	384	OBJECT	<unknown>	DEFAULT	9
_stdio_term	.symtab	0x40608e	135	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x515818	4	OBJECT	<unknown>	DEFAULT	9
_stdlib_strto_l	.symtab	0x409188	339	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x40a9e8	46	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x4115b0	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x40aa18	201	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x40629d	1716	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x408cc4	200	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
access	.symtab	0x405824	41	FUNC	<unknown>	DEFAULT	2
access.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ahold	.symtab	0x4028e6	1191	FUNC	<unknown>	DEFAULT	2
atoi	.symtab	0x409168	18	FUNC	<unknown>	DEFAULT	2
atoi.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bcopy	.symtab	0x407a24	14	FUNC	<unknown>	DEFAULT	2
bcopy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
been_there_done_that	.symtab	0x51be00	4	OBJECT	<unknown>	DEFAULT	10
bot.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
brk	.symtab	0x40c4f8	43	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x407de0	133	FUNC	<unknown>	DEFAULT	2
buf.3318	.symtab	0x51bc10	16	OBJECT	<unknown>	DEFAULT	10
buf.5765	.symtab	0x51bc20	448	OBJECT	<unknown>	DEFAULT	10
bzero	.symtab	0x4077b0	210	FUNC	<unknown>	DEFAULT	2
c	.symtab	0x51575c	4	OBJECT	<unknown>	DEFAULT	9
calloc	.symtab	0x4087c0	248	FUNC	<unknown>	DEFAULT	2
calloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
cck	.symtab	0x401616	256	FUNC	<unknown>	DEFAULT	2
chdir	.symtab	0x40587c	38	FUNC	<unknown>	DEFAULT	2
chdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
clock_getres	.symtab	0x409ad8	41	FUNC	<unknown>	DEFAULT	2
clock_getres.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x405af4	41	FUNC	<unknown>	DEFAULT	2
close.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
closedir	.symtab	0x405b54	147	FUNC	<unknown>	DEFAULT	2
closedir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
closenameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
commServer	.symtab	0x515660	8	OBJECT	<unknown>	DEFAULT	9
completed.5150	.symtab	0x515b60	1	OBJECT	<unknown>	DEFAULT	10
connect	.symtab	0x407c74	43	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connectTimeout	.symtab	0x401147	582	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
csum	.symtab	0x4014f9	116	FUNC	<unknown>	DEFAULT	2
currentServer	.symtab	0x515758	4	OBJECT	<unknown>	DEFAULT	9
data_start	.symtab	0x515650	0	NOTYPE	<unknown>	DEFAULT	9
decoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dnslookup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ	.symtab	0x51be18	8	OBJECT	<unknown>	DEFAULT	10
errno	.symtab	0x51be38	4	OBJECT	<unknown>	DEFAULT	10
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x4092dc	92	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x412940	208	OBJECT	<unknown>	DEFAULT	4
fclose	.symtab	0x40a40c	269	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x405944	100	FUNC	<unknown>	DEFAULT	2
fd_to_DIR	.symtab	0x405be8	149	FUNC	<unknown>	DEFAULT	2
fdgets	.symtab	0x400323	130	FUNC	<unknown>	DEFAULT	2
fdopendir	.symtab	0x405d1a	115	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x40b2d0	322	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc	.symtab	0x40b104	128	FUNC	<unknown>	DEFAULT	2
fgetc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x40b414	222	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x40b184	116	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x40b4f4	116	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fmt	.symtab	0x412920	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x40a51c	10	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0x4057f4	38	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs_unlocked	.symtab	0x407054	56	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x400150	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x408ae5	451	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x40c558	5	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x40c558	5	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x40c560	225	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fstat	.symtab	0x409b3c	82	FUNC	<unknown>	DEFAULT	2
fstat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fstat64	.symtab	0x409b3c	82	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked	.symtab	0x40708c	128	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getArch	.symtab	0x40380f	11	FUNC	<unknown>	DEFAULT	2
getHost	.symtab	0x400e5a	65	FUNC	<unknown>	DEFAULT	2
getOurIP	.symtab	0x4003a5	483	FUNC	<unknown>	DEFAULT	2
getRandomIP	.symtab	0x4002f4	47	FUNC	<unknown>	DEFAULT	2
getSoftware	.symtab	0x404fc0	307	FUNC	<unknown>	DEFAULT	2
get_hosts_byname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getc	.symtab	0x40b104	128	FUNC	<unknown>	DEFAULT	2
getc_unlocked	.symtab	0x40b414	222	FUNC	<unknown>	DEFAULT	2
getdents64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdtablesize	.symtab	0x4058f4	36	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x409b2c	8	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x409b34	8	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x409bdc	8	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname	.symtab	0x407c24	10	FUNC	<unknown>	DEFAULT	2
gethostbyname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname2	.symtab	0x407c30	65	FUNC	<unknown>	DEFAULT	2
gethostbyname2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname2_r	.symtab	0x40be60	761	FUNC	<unknown>	DEFAULT	2
gethostbyname2_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r	.symtab	0x40db28	791	FUNC	<unknown>	DEFAULT	2
gethostbyname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostname	.symtab	0x40de9c	94	FUNC	<unknown>	DEFAULT	2
gethostname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpagesize	.symtab	0x409abc	19	FUNC	<unknown>	DEFAULT	2
getpagesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x4057e4	8	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getppid	.symtab	0x405770	8	FUNC	<unknown>	DEFAULT	2
getppid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x409b04	40	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit64	.symtab	0x409b04	40	FUNC	<unknown>	DEFAULT	2
getsockname	.symtab	0x407ca0	41	FUNC	<unknown>	DEFAULT	2
getsockname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x407ccc	50	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x409ad0	8	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gotIP	.symtab	0x515bc4	4	OBJECT	<unknown>	DEFAULT	10
h_errno	.symtab	0x51be3c	4	OBJECT	<unknown>	DEFAULT	10
hoste.5764	.symtab	0x51bde0	32	OBJECT	<unknown>	DEFAULT	10
htonl	.symtab	0x407b98	5	FUNC	<unknown>	DEFAULT	2
htons	.symtab	0x407b90	8	FUNC	<unknown>	DEFAULT	2
i.5013	.symtab	0x515760	4	OBJECT	<unknown>	DEFAULT	9
index	.symtab	0x4071f0	417	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x407c04	29	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x40bdd8	135	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa	.symtab	0x407bf9	10	FUNC	<unknown>	DEFAULT	2
inet_ntoa.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa_r	.symtab	0x407bac	77	FUNC	<unknown>	DEFAULT	2
inet_ntop	.symtab	0x40cc1d	518	FUNC	<unknown>	DEFAULT	2
inet_ntop4	.symtab	0x40cb2a	243	FUNC	<unknown>	DEFAULT	2
inet_pton	.symtab	0x40c93d	493	FUNC	<unknown>	DEFAULT	2
inet_pton4	.symtab	0x40c8b8	133	FUNC	<unknown>	DEFAULT	2
initConnection	.symtab	0x4050f3	296	FUNC	<unknown>	DEFAULT	2
init_rand	.symtab	0x4001c0	126	FUNC	<unknown>	DEFAULT	2
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initstate	.symtab	0x408e3a	110	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x4090ac	185	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x405a60	101	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isatty	.symtab	0x407b04	25	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isspace	.symtab	0x405b20	18	FUNC	<unknown>	DEFAULT	2
isspace.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0x405918	44	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
killer	.symtab	0x4032eb	359	FUNC	<unknown>	DEFAULT	2
killer_main	.symtab	0x403452	37	FUNC	<unknown>	DEFAULT	2
last_id.5826	.symtab	0x515b30	2	OBJECT	<unknown>	DEFAULT	9
last_ns_num.5825	.symtab	0x51be48	4	OBJECT	<unknown>	DEFAULT	10
libc/string/x86_64/bzero.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/memcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/mempcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/memset.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/strcat.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/strchr.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/strcmp.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/strcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/strcspn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/strlen.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/strpbrk.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/strspn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/x86_64/crt1.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/x86_64/crti.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/x86_64/crtn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
listFork	.symtab	0x40138d	211	FUNC	<unknown>	DEFAULT	2
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek	.symtab	0x40de6c	45	FUNC	<unknown>	DEFAULT	2
lseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x40c550	5	FUNC	<unknown>	DEFAULT	2
macAddress	.symtab	0x515bd0	6	OBJECT	<unknown>	DEFAULT	10
main	.symtab	0x40521b	1365	FUNC	<unknown>	DEFAULT	2
mainCommSock	.symtab	0x515bc0	4	OBJECT	<unknown>	DEFAULT	10
makeIPPacket	.symtab	0x401460	153	FUNC	<unknown>	DEFAULT	2
makeRandomStr	.symtab	0x400e9b	110	FUNC	<unknown>	DEFAULT	2
makevsepacket	.symtab	0x401a41	169	FUNC	<unknown>	DEFAULT	2
malloc	.symtab	0x407f32	2187	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
malloc_trim	.symtab	0x408ca8	28	FUNC	<unknown>	DEFAULT	2
memchr	.symtab	0x40b6dc	236	FUNC	<unknown>	DEFAULT	2
memchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memcpy	.symtab	0x407740	102	FUNC	<unknown>	DEFAULT	2
memmove	.symtab	0x40b7c8	702	FUNC	<unknown>	DEFAULT	2
memmove.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mempcpy	.symtab	0x40b680	90	FUNC	<unknown>	DEFAULT	2
memrchr	.symtab	0x40bba8	233	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x407110	210	FUNC	<unknown>	DEFAULT	2
mmap	.symtab	0x4099e0	48	FUNC	<unknown>	DEFAULT	2
mmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mremap	.symtab	0x40c524	42	FUNC	<unknown>	DEFAULT	2
mremap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
munmap	.symtab	0x409de8	38	FUNC	<unknown>	DEFAULT	2
munmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mylock	.symtab	0x5159e0	40	OBJECT	<unknown>	DEFAULT	9
mylock	.symtab	0x515a10	40	OBJECT	<unknown>	DEFAULT	9
nanosleep	.symtab	0x409e10	38	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
next_start.1699	.symtab	0x51bc00	8	OBJECT	<unknown>	DEFAULT	10
nprocessors_onln	.symtab	0x4093c8	223	FUNC	<unknown>	DEFAULT	2
ntohl	.symtab	0x407ba5	5	FUNC	<unknown>	DEFAULT	2
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0x407b9d	8	FUNC	<unknown>	DEFAULT	2
ntop.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
numpids	.symtab	0x515bc8	8	OBJECT	<unknown>	DEFAULT	10
object.5162	.symtab	0x515b80	48	OBJECT	<unknown>	DEFAULT	10
open	.symtab	0x405778	106	FUNC	<unknown>	DEFAULT	2
open.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opendir	.symtab	0x405c7d	157	FUNC	<unknown>	DEFAULT	2
opendir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opennameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ourIP	.symtab	0x51be80	4	OBJECT	<unknown>	DEFAULT	10
p.5148	.symtab	0x515648	0	OBJECT	<unknown>	DEFAULT	9
parse_config.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pids	.symtab	0x51bef0	8	OBJECT	<unknown>	DEFAULT	10
poll	.symtab	0x40de40	41	FUNC	<unknown>	DEFAULT	2
poll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prefix.5134	.symtab	0x4114e8	12	OBJECT	<unknown>	DEFAULT	4
print	.symtab	0x4008b1	1084	FUNC	<unknown>	DEFAULT	2
printchar	.symtab	0x40063e	75	FUNC	<unknown>	DEFAULT	2
printf	.symtab	0x405e28	157	FUNC	<unknown>	DEFAULT	2
printf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
printi	.symtab	0x400770	321	FUNC	<unknown>	DEFAULT	2
prints	.symtab	0x400689	231	FUNC	<unknown>	DEFAULT	2
processCmd	.symtab	0x40381a	6054	FUNC	<unknown>	DEFAULT	2
program_invocation_name	.symtab	0x515b28	8	OBJECT	<unknown>	DEFAULT	9
program_invocation_short_name	.symtab	0x515b20	8	OBJECT	<unknown>	DEFAULT	9
qual_chars.5141	.symtab	0x411500	20	OBJECT	<unknown>	DEFAULT	4
raise	.symtab	0x40c15c	18	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x408d8c	11	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand_cmwc	.symtab	0x40023e	182	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x408d98	72	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x412110	40	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x408f9b	90	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randtbl	.symtab	0x515a70	128	OBJECT	<unknown>	DEFAULT	9
rawmemchr	.symtab	0x40bae8	189	FUNC	<unknown>	DEFAULT	2
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read	.symtab	0x4058cc	39	FUNC	<unknown>	DEFAULT	2
read.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read_etc_hosts_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
readdir	.symtab	0x405d90	143	FUNC	<unknown>	DEFAULT	2
readdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
readdir64	.symtab	0x409f88	143	FUNC	<unknown>	DEFAULT	2
readdir64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
readlink	.symtab	0x4058a4	39	FUNC	<unknown>	DEFAULT	2
readlink.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
realloc	.symtab	0x40c170	878	FUNC	<unknown>	DEFAULT	2
realloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recv	.symtab	0x407d00	11	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recvLine	.symtab	0x400f09	574	FUNC	<unknown>	DEFAULT	2
recvfrom	.symtab	0x407d0c	45	FUNC	<unknown>	DEFAULT	2
recvfrom.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
resolv_conf_mtime.5807	.symtab	0x51be78	4	OBJECT	<unknown>	DEFAULT	10
rindex	.symtab	0x40bc94	53	FUNC	<unknown>	DEFAULT	2
sbrk	.symtab	0x409b90	74	FUNC	<unknown>	DEFAULT	2
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
select	.symtab	0x405850	44	FUNC	<unknown>	DEFAULT	2
select.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send	.symtab	0x407d3c	11	FUNC	<unknown>	DEFAULT	2
send.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sendTCP	.symtab	0x402269	1276	FUNC	<unknown>	DEFAULT	2
sendUDP	.symtab	0x402d8d	1374	FUNC	<unknown>	DEFAULT	2
sendto	.symtab	0x407d48	48	FUNC	<unknown>	DEFAULT	2
sendto.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsid	.symtab	0x405a38	38	FUNC	<unknown>	DEFAULT	2
setsid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsockopt	.symtab	0x407d78	53	FUNC	<unknown>	DEFAULT	2
setsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate	.symtab	0x408de0	90	FUNC	<unknown>	DEFAULT	2
setstate_r	.symtab	0x408ef0	171	FUNC	<unknown>	DEFAULT	2
sigaction	.symtab	0x409a19	114	FUNC	<unknown>	DEFAULT	2
sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
signal	.symtab	0x407de0	133	FUNC	<unknown>	DEFAULT	2
signal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigprocmask	.symtab	0x409e38	47	FUNC	<unknown>	DEFAULT	2
sigprocmask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigsetops.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
skip_and_NUL_space	.symtab	0x40d691	44	FUNC	<unknown>	DEFAULT	2
skip_nospace	.symtab	0x40d668	41	FUNC	<unknown>	DEFAULT	2
sleep	.symtab	0x409338	142	FUNC	<unknown>	DEFAULT	2
sleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket	.symtab	0x407db0	47	FUNC	<unknown>	DEFAULT	2
socket.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket_connect	.symtab	0x401969	216	FUNC	<unknown>	DEFAULT	2
sockprintf	.symtab	0x400ced	365	FUNC	<unknown>	DEFAULT	2
spec_and_mask.5140	.symtab	0x411520	16	OBJECT	<unknown>	DEFAULT	4
spec_base.5133	.symtab	0x4114f4	7	OBJECT	<unknown>	DEFAULT	4
spec_chars.5137	.symtab	0x411580	21	OBJECT	<unknown>	DEFAULT	4
spec_flags.5136	.symtab	0x411598	8	OBJECT	<unknown>	DEFAULT	4
spec_or_mask.5139	.symtab	0x411530	16	OBJECT	<unknown>	DEFAULT	4
spec_ranges.5138	.symtab	0x411540	9	OBJECT	<unknown>	DEFAULT	4
sprintf	.symtab	0x405ec8	149	FUNC	<unknown>	DEFAULT	2
sprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
srand	.symtab	0x408ea8	72	FUNC	<unknown>	DEFAULT	2
srandom	.symtab	0x408ea8	72	FUNC	<unknown>	DEFAULT	2
srandom_r	.symtab	0x408ff5	183	FUNC	<unknown>	DEFAULT	2
stat	.symtab	0x40defc	79	FUNC	<unknown>	DEFAULT	2
stat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
stat64	.symtab	0x40defc	79	FUNC	<unknown>	DEFAULT	2
stderr	.symtab	0x5157a0	8	OBJECT	<unknown>	DEFAULT	9
stdin	.symtab	0x515790	8	OBJECT	<unknown>	DEFAULT	9
stdout	.symtab	0x515798	8	OBJECT	<unknown>	DEFAULT	9
strcasecmp	.symtab	0x40e36c	48	FUNC	<unknown>	DEFAULT	2
strcasecmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcat	.symtab	0x407590	428	FUNC	<unknown>	DEFAULT	2
strchr	.symtab	0x4071f0	417	FUNC	<unknown>	DEFAULT	2
strchrnul	.symtab	0x40bccc	268	FUNC	<unknown>	DEFAULT	2
strchrnul.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcmp	.symtab	0x407484	33	FUNC	<unknown>	DEFAULT	2
strcoll	.symtab	0x407484	33	FUNC	<unknown>	DEFAULT	2
strcpy	.symtab	0x4074b0	213	FUNC	<unknown>	DEFAULT	2
strcspn	.symtab	0x40b568	135	FUNC	<unknown>	DEFAULT	2
strdup	.symtab	0x40df4c	54	FUNC	<unknown>	DEFAULT	2
strdup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strerror_r	.symtab	0x407a40	196	FUNC	<unknown>	DEFAULT	2
strlen	.symtab	0x4073a0	225	FUNC	<unknown>	DEFAULT	2
strncpy	.symtab	0x40c834	131	FUNC	<unknown>	DEFAULT	2
strncpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strnlen	.symtab	0x407948	201	FUNC	<unknown>	DEFAULT	2
strnlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strpbrk	.symtab	0x40c7a8	140	FUNC	<unknown>	DEFAULT	2
strrchr	.symtab	0x40bc94	53	FUNC	<unknown>	DEFAULT	2
strrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strspn	.symtab	0x40b5f0	135	FUNC	<unknown>	DEFAULT	2
strstr	.symtab	0x407884	193	FUNC	<unknown>	DEFAULT	2
strstr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtoimax	.symtab	0x40917c	10	FUNC	<unknown>	DEFAULT	2
strtok	.symtab	0x407a34	10	FUNC	<unknown>	DEFAULT	2
strtok.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok_r	.symtab	0x40ba88	94	FUNC	<unknown>	DEFAULT	2
strtok_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtol	.symtab	0x40917c	10	FUNC	<unknown>	DEFAULT	2
strtol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtoll	.symtab	0x40917c	10	FUNC	<unknown>	DEFAULT	2
strtoq	.symtab	0x40917c	10	FUNC	<unknown>	DEFAULT	2
sysconf	.symtab	0x4094a7	499	FUNC	<unknown>	DEFAULT	2
sysconf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcgetattr	.symtab	0x407b20	110	FUNC	<unknown>	DEFAULT	2
tcgetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcpcsum	.symtab	0x40156d	169	FUNC	<unknown>	DEFAULT	2
time	.symtab	0x4057ec	8	FUNC	<unknown>	DEFAULT	2
time.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
toupper	.symtab	0x405b34	30	FUNC	<unknown>	DEFAULT	2
toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
trim	.symtab	0x400588	182	FUNC	<unknown>	DEFAULT	2
type_codes	.symtab	0x411550	24	OBJECT	<unknown>	DEFAULT	4
type_sizes	.symtab	0x411568	12	OBJECT	<unknown>	DEFAULT	4
uname	.symtab	0x40e344	38	FUNC	<unknown>	DEFAULT	2
uname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
unknown.1721	.symtab	0x4115a0	14	OBJECT	<unknown>	DEFAULT	4
unsafe_state	.symtab	0x515a40	40	OBJECT	<unknown>	DEFAULT	9
useragents	.symtab	0x515680	216	OBJECT	<unknown>	DEFAULT	9
usleep	.symtab	0x40969c	52	FUNC	<unknown>	DEFAULT	2
usleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
vfprintf	.symtab	0x406140	150	FUNC	<unknown>	DEFAULT	2
vfprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
vseattack	.symtab	0x401aea	1378	FUNC	<unknown>	DEFAULT	2
vsnprintf	.symtab	0x405f60	189	FUNC	<unknown>	DEFAULT	2
vsnprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wait4	.symtab	0x409a8c	47	FUNC	<unknown>	DEFAULT	2
wait4.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
waitpid	.symtab	0x40581c	7	FUNC	<unknown>	DEFAULT	2
waitpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcrtomb	.symtab	0x40a33c	68	FUNC	<unknown>	DEFAULT	2
wcrtomb.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsnrtombs	.symtab	0x40a390	123	FUNC	<unknown>	DEFAULT	2
wcsnrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsrtombs	.symtab	0x40a380	15	FUNC	<unknown>	DEFAULT	2
wcsrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
write	.symtab	0x405a0c	42	FUNC	<unknown>	DEFAULT	2
write.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
xdigits.3745	.symtab	0x412a70	17	OBJECT	<unknown>	DEFAULT	4
xstatconv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS

Network Behavior

Download Network PCAP: filtered – full

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-02-16T14:48:04.753084+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56210	156.229.233.170	6149	TCP
2025-02-16T14:48:04.757937+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56210	156.229.233.170	6149	TCP
2025-02-16T14:48:06.471404+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56212	156.229.233.170	6149	TCP
2025-02-16T14:48:06.476239+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56212	156.229.233.170	6149	TCP
2025-02-16T14:48:08.190372+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56214	156.229.233.170	6149	TCP
2025-02-16T14:48:08.195264+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56214	156.229.233.170	6149	TCP
2025-02-16T14:48:09.895767+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56216	156.229.233.170	6149	TCP
2025-02-16T14:48:09.900651+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56216	156.229.233.170	6149	TCP
2025-02-16T14:48:11.534584+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56218	156.229.233.170	6149	TCP
2025-02-16T14:48:11.539552+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56218	156.229.233.170	6149	TCP
2025-02-16T14:48:13.256835+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56220	156.229.233.170	6149	TCP
2025-02-16T14:48:13.261773+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56220	156.229.233.170	6149	TCP
2025-02-16T14:48:14.951520+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56222	156.229.233.170	6149	TCP
2025-02-16T14:48:14.956796+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56222	156.229.233.170	6149	TCP
2025-02-16T14:48:16.631544+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56224	156.229.233.170	6149	TCP
2025-02-16T14:48:16.636709+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56224	156.229.233.170	6149	TCP
2025-02-16T14:48:18.348599+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56226	156.229.233.170	6149	TCP
2025-02-16T14:48:18.353433+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56226	156.229.233.170	6149	TCP
2025-02-16T14:48:20.021647+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56228	156.229.233.170	6149	TCP
2025-02-16T14:48:20.026534+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56228	156.229.233.170	6149	TCP
2025-02-16T14:48:21.753727+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56230	156.229.233.170	6149	TCP
2025-02-16T14:48:21.758637+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56230	156.229.233.170	6149	TCP
2025-02-16T14:48:23.476321+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56232	156.229.233.170	6149	TCP
2025-02-16T14:48:23.481204+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56232	156.229.233.170	6149	TCP
2025-02-16T14:48:25.146792+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56234	156.229.233.170	6149	TCP
2025-02-16T14:48:25.152712+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56234	156.229.233.170	6149	TCP
2025-02-16T14:48:26.921355+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56236	156.229.233.170	6149	TCP
2025-02-16T14:48:26.928452+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56236	156.229.233.170	6149	TCP
2025-02-16T14:48:28.585976+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56238	156.229.233.170	6149	TCP
2025-02-16T14:48:28.596112+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56238	156.229.233.170	6149	TCP
2025-02-16T14:48:30.319612+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56240	156.229.233.170	6149	TCP
2025-02-16T14:48:30.324729+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56240	156.229.233.170	6149	TCP
2025-02-16T14:48:32.008802+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56242	156.229.233.170	6149	TCP
2025-02-16T14:48:32.013989+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56242	156.229.233.170	6149	TCP
2025-02-16T14:48:33.708536+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56244	156.229.233.170	6149	TCP
2025-02-16T14:48:33.713487+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56244	156.229.233.170	6149	TCP
2025-02-16T14:48:35.367838+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56246	156.229.233.170	6149	TCP
2025-02-16T14:48:35.372888+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56246	156.229.233.170	6149	TCP
2025-02-16T14:48:37.052142+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56248	156.229.233.170	6149	TCP
2025-02-16T14:48:37.056948+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56248	156.229.233.170	6149	TCP
2025-02-16T14:48:38.823516+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56250	156.229.233.170	6149	TCP
2025-02-16T14:48:38.830026+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56250	156.229.233.170	6149	TCP
2025-02-16T14:48:40.532348+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56252	156.229.233.170	6149	TCP
2025-02-16T14:48:40.537272+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56252	156.229.233.170	6149	TCP
2025-02-16T14:48:42.253972+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56254	156.229.233.170	6149	TCP
2025-02-16T14:48:42.258868+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56254	156.229.233.170	6149	TCP
2025-02-16T14:48:43.896473+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56256	156.229.233.170	6149	TCP
2025-02-16T14:48:43.901538+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56256	156.229.233.170	6149	TCP
2025-02-16T14:48:45.584548+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56258	156.229.233.170	6149	TCP
2025-02-16T14:48:45.589388+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56258	156.229.233.170	6149	TCP
2025-02-16T14:48:47.258660+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56260	156.229.233.170	6149	TCP
2025-02-16T14:48:47.263794+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56260	156.229.233.170	6149	TCP
2025-02-16T14:48:48.915569+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56262	156.229.233.170	6149	TCP
2025-02-16T14:48:48.920540+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56262	156.229.233.170	6149	TCP
2025-02-16T14:48:50.587774+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56264	156.229.233.170	6149	TCP
2025-02-16T14:48:50.592760+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56264	156.229.233.170	6149	TCP
2025-02-16T14:48:52.239110+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56266	156.229.233.170	6149	TCP
2025-02-16T14:48:52.243987+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56266	156.229.233.170	6149	TCP
2025-02-16T14:48:54.009406+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56268	156.229.233.170	6149	TCP
2025-02-16T14:48:54.014857+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56268	156.229.233.170	6149	TCP
2025-02-16T14:48:55.742863+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56270	156.229.233.170	6149	TCP
2025-02-16T14:48:55.747794+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56270	156.229.233.170	6149	TCP
2025-02-16T14:48:57.465032+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56272	156.229.233.170	6149	TCP
2025-02-16T14:48:57.469945+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56272	156.229.233.170	6149	TCP
2025-02-16T14:48:59.114356+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56274	156.229.233.170	6149	TCP
2025-02-16T14:48:59.119506+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56274	156.229.233.170	6149	TCP
2025-02-16T14:49:00.882381+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56276	156.229.233.170	6149	TCP
2025-02-16T14:49:00.887297+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56276	156.229.233.170	6149	TCP
2025-02-16T14:49:03.036026+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56278	156.229.233.170	6149	TCP
2025-02-16T14:49:03.043099+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56278	156.229.233.170	6149	TCP
2025-02-16T14:49:04.757452+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56280	156.229.233.170	6149	TCP
2025-02-16T14:49:04.762381+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56280	156.229.233.170	6149	TCP
2025-02-16T14:49:06.401608+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56282	156.229.233.170	6149	TCP
2025-02-16T14:49:06.408873+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56282	156.229.233.170	6149	TCP
2025-02-16T14:49:08.129851+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56284	156.229.233.170	6149	TCP
2025-02-16T14:49:08.134717+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56284	156.229.233.170	6149	TCP
2025-02-16T14:49:09.771199+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56286	156.229.233.170	6149	TCP
2025-02-16T14:49:09.776096+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56286	156.229.233.170	6149	TCP
2025-02-16T14:49:11.523974+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56288	156.229.233.170	6149	TCP
2025-02-16T14:49:11.528828+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56288	156.229.233.170	6149	TCP
2025-02-16T14:49:13.274908+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56290	156.229.233.170	6149	TCP
2025-02-16T14:49:13.279942+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56290	156.229.233.170	6149	TCP
2025-02-16T14:49:15.066910+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56292	156.229.233.170	6149	TCP
2025-02-16T14:49:15.071894+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56292	156.229.233.170	6149	TCP
2025-02-16T14:49:16.754548+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56294	156.229.233.170	6149	TCP
2025-02-16T14:49:16.759431+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56294	156.229.233.170	6149	TCP
2025-02-16T14:49:18.428792+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56296	156.229.233.170	6149	TCP
2025-02-16T14:49:18.433793+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56296	156.229.233.170	6149	TCP
2025-02-16T14:49:20.186148+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56298	156.229.233.170	6149	TCP
2025-02-16T14:49:20.192902+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56298	156.229.233.170	6149	TCP
2025-02-16T14:49:21.836768+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56300	156.229.233.170	6149	TCP
2025-02-16T14:49:21.842164+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56300	156.229.233.170	6149	TCP
2025-02-16T14:49:23.544125+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56302	156.229.233.170	6149	TCP
2025-02-16T14:49:23.549263+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56302	156.229.233.170	6149	TCP
2025-02-16T14:49:25.239818+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56304	156.229.233.170	6149	TCP
2025-02-16T14:49:25.244755+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56304	156.229.233.170	6149	TCP
2025-02-16T14:49:26.898507+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56306	156.229.233.170	6149	TCP
2025-02-16T14:49:26.903373+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56306	156.229.233.170	6149	TCP
2025-02-16T14:49:28.632432+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56308	156.229.233.170	6149	TCP
2025-02-16T14:49:28.637439+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56308	156.229.233.170	6149	TCP
2025-02-16T14:49:30.335428+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56310	156.229.233.170	6149	TCP
2025-02-16T14:49:30.340768+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56310	156.229.233.170	6149	TCP
2025-02-16T14:49:32.064053+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56312	156.229.233.170	6149	TCP
2025-02-16T14:49:32.069075+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56312	156.229.233.170	6149	TCP
2025-02-16T14:49:33.789921+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56314	156.229.233.170	6149	TCP
2025-02-16T14:49:33.795304+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56314	156.229.233.170	6149	TCP
2025-02-16T14:49:35.447966+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56316	156.229.233.170	6149	TCP
2025-02-16T14:49:35.453360+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56316	156.229.233.170	6149	TCP
2025-02-16T14:49:37.177745+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56318	156.229.233.170	6149	TCP
2025-02-16T14:49:37.183086+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56318	156.229.233.170	6149	TCP
2025-02-16T14:49:38.887000+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56320	156.229.233.170	6149	TCP
2025-02-16T14:49:38.892327+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56320	156.229.233.170	6149	TCP
2025-02-16T14:49:40.606667+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56322	156.229.233.170	6149	TCP
2025-02-16T14:49:40.613620+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56322	156.229.233.170	6149	TCP
2025-02-16T14:49:42.288947+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56324	156.229.233.170	6149	TCP
2025-02-16T14:49:42.293883+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56324	156.229.233.170	6149	TCP
2025-02-16T14:49:43.928622+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56326	156.229.233.170	6149	TCP
2025-02-16T14:49:43.934530+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56326	156.229.233.170	6149	TCP
2025-02-16T14:49:45.645908+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56328	156.229.233.170	6149	TCP
2025-02-16T14:49:45.650730+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56328	156.229.233.170	6149	TCP
2025-02-16T14:49:47.370201+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56330	156.229.233.170	6149	TCP
2025-02-16T14:49:47.375151+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56330	156.229.233.170	6149	TCP
2025-02-16T14:49:49.023501+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56332	156.229.233.170	6149	TCP
2025-02-16T14:49:49.028463+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56332	156.229.233.170	6149	TCP
2025-02-16T14:49:50.695034+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56334	156.229.233.170	6149	TCP
2025-02-16T14:49:50.700140+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56334	156.229.233.170	6149	TCP
2025-02-16T14:49:52.352362+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56336	156.229.233.170	6149	TCP
2025-02-16T14:49:52.357805+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56336	156.229.233.170	6149	TCP
2025-02-16T14:49:54.028543+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56338	156.229.233.170	6149	TCP
2025-02-16T14:49:54.033440+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56338	156.229.233.170	6149	TCP
2025-02-16T14:49:55.677396+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56340	156.229.233.170	6149	TCP
2025-02-16T14:49:55.682254+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56340	156.229.233.170	6149	TCP
2025-02-16T14:49:57.319263+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56342	156.229.233.170	6149	TCP
2025-02-16T14:49:57.324183+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56342	156.229.233.170	6149	TCP
2025-02-16T14:49:58.978264+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56344	156.229.233.170	6149	TCP
2025-02-16T14:49:58.983282+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56344	156.229.233.170	6149	TCP
2025-02-16T14:50:00.646764+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56346	156.229.233.170	6149	TCP
2025-02-16T14:50:00.651705+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56346	156.229.233.170	6149	TCP
2025-02-16T14:50:02.288969+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56348	156.229.233.170	6149	TCP
2025-02-16T14:50:02.294269+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56348	156.229.233.170	6149	TCP
2025-02-16T14:50:03.945049+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56350	156.229.233.170	6149	TCP
2025-02-16T14:50:03.949976+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56350	156.229.233.170	6149	TCP
2025-02-16T14:50:05.600570+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56352	156.229.233.170	6149	TCP
2025-02-16T14:50:05.605352+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56352	156.229.233.170	6149	TCP
2025-02-16T14:50:07.259446+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56354	156.229.233.170	6149	TCP
2025-02-16T14:50:07.264518+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56354	156.229.233.170	6149	TCP
2025-02-16T14:50:08.915085+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56356	156.229.233.170	6149	TCP
2025-02-16T14:50:08.920029+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56356	156.229.233.170	6149	TCP
2025-02-16T14:50:10.574772+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56358	156.229.233.170	6149	TCP
2025-02-16T14:50:10.580159+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56358	156.229.233.170	6149	TCP
2025-02-16T14:50:12.248535+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56360	156.229.233.170	6149	TCP
2025-02-16T14:50:12.253864+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56360	156.229.233.170	6149	TCP
2025-02-16T14:50:13.898242+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56362	156.229.233.170	6149	TCP
2025-02-16T14:50:13.903507+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56362	156.229.233.170	6149	TCP
2025-02-16T14:50:15.540572+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56364	156.229.233.170	6149	TCP
2025-02-16T14:50:15.547235+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56364	156.229.233.170	6149	TCP
2025-02-16T14:50:17.195791+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56366	156.229.233.170	6149	TCP
2025-02-16T14:50:17.201266+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56366	156.229.233.170	6149	TCP
2025-02-16T14:50:18.836273+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56368	156.229.233.170	6149	TCP
2025-02-16T14:50:18.841417+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56368	156.229.233.170	6149	TCP
2025-02-16T14:50:20.673794+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56370	156.229.233.170	6149	TCP
2025-02-16T14:50:20.678715+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56370	156.229.233.170	6149	TCP
2025-02-16T14:50:22.322764+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56372	156.229.233.170	6149	TCP
2025-02-16T14:50:22.327853+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56372	156.229.233.170	6149	TCP
2025-02-16T14:50:23.976991+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56374	156.229.233.170	6149	TCP
2025-02-16T14:50:23.981895+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56374	156.229.233.170	6149	TCP
2025-02-16T14:50:25.632628+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56376	156.229.233.170	6149	TCP
2025-02-16T14:50:25.637986+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56376	156.229.233.170	6149	TCP
2025-02-16T14:50:27.271834+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56378	156.229.233.170	6149	TCP
2025-02-16T14:50:27.276861+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56378	156.229.233.170	6149	TCP
2025-02-16T14:50:28.914974+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56380	156.229.233.170	6149	TCP
2025-02-16T14:50:28.924136+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56380	156.229.233.170	6149	TCP
2025-02-16T14:50:30.572979+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56382	156.229.233.170	6149	TCP
2025-02-16T14:50:30.578183+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56382	156.229.233.170	6149	TCP
2025-02-16T14:50:32.229483+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56384	156.229.233.170	6149	TCP
2025-02-16T14:50:32.234770+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56384	156.229.233.170	6149	TCP
2025-02-16T14:50:33.897337+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56386	156.229.233.170	6149	TCP
2025-02-16T14:50:33.902322+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56386	156.229.233.170	6149	TCP
2025-02-16T14:50:35.709372+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56388	156.229.233.170	6149	TCP
2025-02-16T14:50:35.714384+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56388	156.229.233.170	6149	TCP
2025-02-16T14:50:37.354133+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56390	156.229.233.170	6149	TCP
2025-02-16T14:50:37.359015+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56390	156.229.233.170	6149	TCP
2025-02-16T14:50:39.008016+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56392	156.229.233.170	6149	TCP
2025-02-16T14:50:39.013068+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56392	156.229.233.170	6149	TCP
2025-02-16T14:50:40.649563+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56394	156.229.233.170	6149	TCP
2025-02-16T14:50:40.658684+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56394	156.229.233.170	6149	TCP
2025-02-16T14:50:42.307613+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56396	156.229.233.170	6149	TCP
2025-02-16T14:50:42.312579+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56396	156.229.233.170	6149	TCP
2025-02-16T14:50:43.984346+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56398	156.229.233.170	6149	TCP
2025-02-16T14:50:43.991415+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56398	156.229.233.170	6149	TCP
2025-02-16T14:50:45.632430+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56400	156.229.233.170	6149	TCP
2025-02-16T14:50:45.637368+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56400	156.229.233.170	6149	TCP
2025-02-16T14:50:47.291995+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56402	156.229.233.170	6149	TCP
2025-02-16T14:50:47.296912+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56402	156.229.233.170	6149	TCP
2025-02-16T14:50:48.946364+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56404	156.229.233.170	6149	TCP
2025-02-16T14:50:48.951300+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56404	156.229.233.170	6149	TCP
2025-02-16T14:50:50.586272+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56406	156.229.233.170	6149	TCP
2025-02-16T14:50:50.591198+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56406	156.229.233.170	6149	TCP
2025-02-16T14:50:52.229736+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56408	156.229.233.170	6149	TCP
2025-02-16T14:50:52.235264+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56408	156.229.233.170	6149	TCP
2025-02-16T14:50:53.903074+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56410	156.229.233.170	6149	TCP
2025-02-16T14:50:53.908058+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56410	156.229.233.170	6149	TCP
2025-02-16T14:50:55.559100+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56412	156.229.233.170	6149	TCP
2025-02-16T14:50:55.565003+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56412	156.229.233.170	6149	TCP
2025-02-16T14:50:57.209938+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56414	156.229.233.170	6149	TCP
2025-02-16T14:50:57.214981+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56414	156.229.233.170	6149	TCP
2025-02-16T14:50:58.870105+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56416	156.229.233.170	6149	TCP
2025-02-16T14:50:58.874983+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56416	156.229.233.170	6149	TCP
2025-02-16T14:51:00.525966+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56418	156.229.233.170	6149	TCP
2025-02-16T14:51:00.530834+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56418	156.229.233.170	6149	TCP
2025-02-16T14:51:02.201733+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56420	156.229.233.170	6149	TCP
2025-02-16T14:51:02.206590+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56420	156.229.233.170	6149	TCP
2025-02-16T14:51:03.859805+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56422	156.229.233.170	6149	TCP
2025-02-16T14:51:03.864661+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56422	156.229.233.170	6149	TCP
2025-02-16T14:51:05.527667+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56424	156.229.233.170	6149	TCP
2025-02-16T14:51:05.532664+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56424	156.229.233.170	6149	TCP
2025-02-16T14:51:07.216044+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56426	156.229.233.170	6149	TCP
2025-02-16T14:51:07.221067+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56426	156.229.233.170	6149	TCP
2025-02-16T14:51:08.888453+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56428	156.229.233.170	6149	TCP
2025-02-16T14:51:08.893282+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56428	156.229.233.170	6149	TCP
2025-02-16T14:51:10.538548+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56430	156.229.233.170	6149	TCP
2025-02-16T14:51:10.543348+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56430	156.229.233.170	6149	TCP
2025-02-16T14:51:12.196548+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56432	156.229.233.170	6149	TCP
2025-02-16T14:51:12.202676+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56432	156.229.233.170	6149	TCP
2025-02-16T14:51:13.855575+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56434	156.229.233.170	6149	TCP
2025-02-16T14:51:13.860523+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56434	156.229.233.170	6149	TCP
2025-02-16T14:51:15.508557+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56436	156.229.233.170	6149	TCP
2025-02-16T14:51:15.513689+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56436	156.229.233.170	6149	TCP
2025-02-16T14:51:17.174379+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56438	156.229.233.170	6149	TCP
2025-02-16T14:51:17.179555+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56438	156.229.233.170	6149	TCP
2025-02-16T14:51:18.820391+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56440	156.229.233.170	6149	TCP
2025-02-16T14:51:18.825823+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56440	156.229.233.170	6149	TCP
2025-02-16T14:51:20.481021+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56442	156.229.233.170	6149	TCP
2025-02-16T14:51:20.489177+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56442	156.229.233.170	6149	TCP
2025-02-16T14:51:22.133203+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56444	156.229.233.170	6149	TCP
2025-02-16T14:51:22.138371+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56444	156.229.233.170	6149	TCP
2025-02-16T14:51:23.789416+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56446	156.229.233.170	6149	TCP
2025-02-16T14:51:23.795002+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56446	156.229.233.170	6149	TCP
2025-02-16T14:51:25.448724+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56448	156.229.233.170	6149	TCP
2025-02-16T14:51:25.453619+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56448	156.229.233.170	6149	TCP
2025-02-16T14:51:27.105839+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56450	156.229.233.170	6149	TCP
2025-02-16T14:51:27.110687+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56450	156.229.233.170	6149	TCP
2025-02-16T14:51:28.767403+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56452	156.229.233.170	6149	TCP
2025-02-16T14:51:28.775372+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56452	156.229.233.170	6149	TCP
2025-02-16T14:51:30.415804+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56454	156.229.233.170	6149	TCP
2025-02-16T14:51:30.421032+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56454	156.229.233.170	6149	TCP
2025-02-16T14:51:32.072229+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56456	156.229.233.170	6149	TCP
2025-02-16T14:51:32.077286+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56456	156.229.233.170	6149	TCP
2025-02-16T14:51:33.762113+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56458	156.229.233.170	6149	TCP
2025-02-16T14:51:33.767022+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56458	156.229.233.170	6149	TCP
2025-02-16T14:51:35.418464+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56460	156.229.233.170	6149	TCP
2025-02-16T14:51:35.423433+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56460	156.229.233.170	6149	TCP
2025-02-16T14:51:37.092454+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.23	56462	156.229.233.170	6149	TCP
2025-02-16T14:51:37.099667+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	56462	156.229.233.170	6149	TCP

Network Port Distribution

Total Packets: 643
• 6149 undefined
• 443 (HTTPS)
• 80 (HTTP)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 16, 2025 14:48:04.622548103 CET	56210	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:04.751945019 CET	6149	56210	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:04.752161980 CET	56210	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:04.753083944 CET	56210	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:04.757874966 CET	6149	56210	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:04.757936954 CET	56210	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:04.762722015 CET	6149	56210	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:06.465783119 CET	6149	56210	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:06.466084003 CET	56210	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:06.466485023 CET	56212	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:06.470998049 CET	6149	56210	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:06.471302986 CET	6149	56212	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:06.471369982 CET	56212	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:06.471404076 CET	56212	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:06.476176023 CET	6149	56212	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:06.476238966 CET	56212	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:06.481142044 CET	6149	56212	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:08.184597015 CET	6149	56212	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:08.184886932 CET	56212	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:08.185400009 CET	56214	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:08.189708948 CET	6149	56212	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:08.190283060 CET	6149	56214	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:08.190346956 CET	56214	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:08.190371990 CET	56214	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:08.195193052 CET	6149	56214	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:08.195264101 CET	56214	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:08.200402975 CET	6149	56214	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:08.378631115 CET	42836	443	192.168.2.23	91.189.91.43
Feb 16, 2025 14:48:09.402302980 CET	42516	80	192.168.2.23	109.202.202.202
Feb 16, 2025 14:48:09.890052080 CET	6149	56214	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:09.890326023 CET	56214	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:09.890851021 CET	56216	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:09.895150900 CET	6149	56214	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:09.895675898 CET	6149	56216	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:09.895741940 CET	56216	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:09.895766973 CET	56216	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:09.900582075 CET	6149	56216	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:09.900650978 CET	56216	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:09.905491114 CET	6149	56216	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:11.528891087 CET	6149	56216	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:11.529009104 CET	56216	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:11.529544115 CET	56218	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:11.533883095 CET	6149	56216	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:11.534466982 CET	6149	56218	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:11.534569025 CET	56218	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:11.534584045 CET	56218	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:11.539479971 CET	6149	56218	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:11.539551973 CET	56218	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:11.544409037 CET	6149	56218	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:13.250967979 CET	6149	56218	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:13.251281023 CET	56218	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:13.251812935 CET	56220	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:13.256309032 CET	6149	56218	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:13.256736040 CET	6149	56220	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:13.256803036 CET	56220	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:13.256834984 CET	56220	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:13.261698008 CET	6149	56220	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:13.261773109 CET	56220	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:13.266557932 CET	6149	56220	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:14.945537090 CET	6149	56220	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:14.945903063 CET	56220	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:14.946381092 CET	56222	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:14.950809956 CET	6149	56220	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:14.951399088 CET	6149	56222	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:14.951476097 CET	56222	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:14.951519966 CET	56222	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:14.956712008 CET	6149	56222	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:14.956795931 CET	56222	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:14.961822987 CET	6149	56222	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:16.624000072 CET	6149	56222	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:16.624156952 CET	56222	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:16.625216007 CET	56224	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:16.629041910 CET	6149	56222	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:16.631414890 CET	6149	56224	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:16.631495953 CET	56224	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:16.631544113 CET	56224	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:16.636639118 CET	6149	56224	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:16.636708975 CET	56224	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:16.641920090 CET	6149	56224	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:18.342992067 CET	6149	56224	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:18.343142033 CET	56224	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:18.343683004 CET	56226	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:18.347959995 CET	6149	56224	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:18.348498106 CET	6149	56226	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:18.348561049 CET	56226	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:18.348598957 CET	56226	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:18.353380919 CET	6149	56226	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:18.353432894 CET	56226	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:18.358355999 CET	6149	56226	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:20.015369892 CET	6149	56226	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:20.015777111 CET	56226	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:20.016529083 CET	56228	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:20.020699024 CET	6149	56226	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:20.021465063 CET	6149	56228	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:20.021539927 CET	56228	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:20.021646976 CET	56228	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:20.026462078 CET	6149	56228	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:20.026534081 CET	56228	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:20.031418085 CET	6149	56228	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:21.747718096 CET	6149	56228	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:21.747982025 CET	56228	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:21.748697996 CET	56230	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:21.752986908 CET	6149	56228	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:21.753604889 CET	6149	56230	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:21.753671885 CET	56230	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:21.753726959 CET	56230	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:21.758577108 CET	6149	56230	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:21.758636951 CET	56230	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:21.763569117 CET	6149	56230	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:23.470237017 CET	6149	56230	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:23.470483065 CET	56230	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:23.471242905 CET	56232	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:23.475406885 CET	6149	56230	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:23.476130962 CET	6149	56232	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:23.476207972 CET	56232	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:23.476320982 CET	56232	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:23.480277061 CET	43928	443	192.168.2.23	91.189.91.42
Feb 16, 2025 14:48:23.481142998 CET	6149	56232	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:23.481204033 CET	56232	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:23.485990047 CET	6149	56232	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:25.138140917 CET	6149	56232	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:25.138456106 CET	56232	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:25.139740944 CET	56234	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:25.146589994 CET	6149	56232	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:25.146632910 CET	6149	56234	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:25.146712065 CET	56234	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:25.146791935 CET	56234	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:25.152623892 CET	6149	56234	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:25.152712107 CET	56234	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:25.158618927 CET	6149	56234	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:26.913240910 CET	6149	56234	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:26.913551092 CET	56234	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:26.914300919 CET	56236	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:26.920645952 CET	6149	56234	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:26.921189070 CET	6149	56236	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:26.921267033 CET	56236	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:26.921355009 CET	56236	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:26.928378105 CET	6149	56236	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:26.928452015 CET	56236	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:26.935570955 CET	6149	56236	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:28.579576969 CET	6149	56236	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:28.579978943 CET	56236	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:28.580852032 CET	56238	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:28.585061073 CET	6149	56236	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:28.585805893 CET	6149	56238	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:28.585897923 CET	56238	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:28.585975885 CET	56238	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:28.595999956 CET	6149	56238	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:28.596112013 CET	56238	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:28.601021051 CET	6149	56238	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:30.312453985 CET	6149	56238	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:30.313100100 CET	56238	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:30.313996077 CET	56240	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:30.319139004 CET	6149	56238	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:30.319171906 CET	6149	56240	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:30.319526911 CET	56240	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:30.319612026 CET	56240	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:30.324616909 CET	6149	56240	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:30.324728966 CET	56240	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:30.329829931 CET	6149	56240	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:32.002441883 CET	6149	56240	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:32.002872944 CET	56240	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:32.003515005 CET	56242	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:32.008462906 CET	6149	56240	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:32.008507013 CET	6149	56242	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:32.008757114 CET	56242	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:32.008801937 CET	56242	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:32.013737917 CET	6149	56242	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:32.013988972 CET	56242	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:32.019052982 CET	6149	56242	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:33.702235937 CET	6149	56242	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:33.702613115 CET	56242	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:33.703516960 CET	56244	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:33.707561016 CET	6149	56242	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:33.708430052 CET	6149	56244	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:33.708504915 CET	56244	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:33.708535910 CET	56244	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:33.713429928 CET	6149	56244	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:33.713486910 CET	56244	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:33.718271017 CET	6149	56244	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:35.361527920 CET	6149	56244	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:35.361949921 CET	56244	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:35.362786055 CET	56246	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:35.366960049 CET	6149	56244	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:35.367702961 CET	6149	56246	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:35.367808104 CET	56246	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:35.367837906 CET	56246	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:35.372767925 CET	6149	56246	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:35.372888088 CET	56246	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:35.377815962 CET	6149	56246	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:35.766850948 CET	42836	443	192.168.2.23	91.189.91.43
Feb 16, 2025 14:48:37.045912981 CET	6149	56246	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:37.046359062 CET	56246	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:37.047147036 CET	56248	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:37.051297903 CET	6149	56246	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:37.051990032 CET	6149	56248	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:37.052052021 CET	56248	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:37.052141905 CET	56248	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:37.056905985 CET	6149	56248	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:37.056947947 CET	56248	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:37.061705112 CET	6149	56248	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:38.816029072 CET	6149	56248	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:38.816215038 CET	56248	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:38.816827059 CET	56250	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:38.822829008 CET	6149	56248	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:38.823355913 CET	6149	56250	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:38.823437929 CET	56250	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:38.823515892 CET	56250	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:38.829962015 CET	6149	56250	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:38.830025911 CET	56250	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:38.837692022 CET	6149	56250	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:39.862061977 CET	42516	80	192.168.2.23	109.202.202.202
Feb 16, 2025 14:48:40.525999069 CET	6149	56250	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:40.526387930 CET	56250	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:40.527287960 CET	56252	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:40.531349897 CET	6149	56250	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:40.532196999 CET	6149	56252	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:40.532305002 CET	56252	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:40.532347918 CET	56252	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:40.537152052 CET	6149	56252	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:40.537271976 CET	56252	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:40.542150021 CET	6149	56252	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:42.247788906 CET	6149	56252	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:42.248222113 CET	56252	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:42.248889923 CET	56254	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:42.253133059 CET	6149	56252	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:42.253875017 CET	6149	56254	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:42.253932953 CET	56254	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:42.253972054 CET	56254	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:42.258824110 CET	6149	56254	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:42.258867979 CET	56254	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:42.263963938 CET	6149	56254	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:43.889480114 CET	6149	56254	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:43.889867067 CET	56254	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:43.891190052 CET	56256	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:43.894722939 CET	6149	56254	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:43.896186113 CET	6149	56256	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:43.896276951 CET	56256	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:43.896472931 CET	56256	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:43.901437044 CET	6149	56256	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:43.901537895 CET	56256	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:43.906387091 CET	6149	56256	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:45.577991962 CET	6149	56256	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:45.578371048 CET	56256	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:45.579386950 CET	56258	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:45.583220959 CET	6149	56256	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:45.584377050 CET	6149	56258	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:45.584466934 CET	56258	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:45.584547997 CET	56258	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:45.589319944 CET	6149	56258	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:45.589387894 CET	56258	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:45.594160080 CET	6149	56258	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:47.251939058 CET	6149	56258	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:47.252331972 CET	56258	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:47.253191948 CET	56260	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:47.257697105 CET	6149	56258	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:47.258518934 CET	6149	56260	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:47.258577108 CET	56260	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:47.258660078 CET	56260	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:47.263740063 CET	6149	56260	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:47.263793945 CET	56260	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:47.269079924 CET	6149	56260	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:48.908996105 CET	6149	56260	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:48.909490108 CET	56260	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:48.910159111 CET	56262	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:48.914493084 CET	6149	56260	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:48.915381908 CET	6149	56262	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:48.915468931 CET	56262	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:48.915569067 CET	56262	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:48.920449018 CET	6149	56262	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:48.920540094 CET	56262	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:48.925386906 CET	6149	56262	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:50.580271006 CET	6149	56262	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:50.580827951 CET	56262	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:50.582226038 CET	56264	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:50.586045027 CET	6149	56262	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:50.587383032 CET	6149	56264	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:50.587647915 CET	56264	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:50.587774038 CET	56264	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:50.592668056 CET	6149	56264	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:50.592760086 CET	56264	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:50.597927094 CET	6149	56264	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:52.232860088 CET	6149	56264	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:52.233325958 CET	56264	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:52.234010935 CET	56266	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:52.238221884 CET	6149	56264	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:52.238949060 CET	6149	56266	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:52.239022970 CET	56266	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:52.239109993 CET	56266	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:52.243925095 CET	6149	56266	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:52.243987083 CET	56266	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:52.248869896 CET	6149	56266	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:54.002425909 CET	6149	56266	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:54.002902031 CET	56266	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:54.003577948 CET	56268	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:54.008635044 CET	6149	56266	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:54.009243011 CET	6149	56268	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:54.009318113 CET	56268	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:54.009406090 CET	56268	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:54.014735937 CET	6149	56268	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:54.014857054 CET	56268	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:54.020009041 CET	6149	56268	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:55.736320019 CET	6149	56268	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:55.736605883 CET	56268	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:55.737699032 CET	56270	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:55.741591930 CET	6149	56268	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:55.742634058 CET	6149	56270	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:55.742707014 CET	56270	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:55.742862940 CET	56270	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:55.747709990 CET	6149	56270	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:55.747793913 CET	56270	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:55.752722979 CET	6149	56270	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:57.455507040 CET	6149	56270	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:57.455791950 CET	56270	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:57.456641912 CET	56272	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:57.460711956 CET	6149	56270	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:57.464840889 CET	6149	56272	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:57.464976072 CET	56272	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:57.465032101 CET	56272	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:57.469870090 CET	6149	56272	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:57.469944954 CET	56272	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:57.477560997 CET	6149	56272	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:59.108413935 CET	6149	56272	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:59.108603954 CET	56272	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:59.109180927 CET	56274	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:59.113635063 CET	6149	56272	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:59.114247084 CET	6149	56274	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:59.114314079 CET	56274	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:59.114356041 CET	56274	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:59.119395971 CET	6149	56274	156.229.233.170	192.168.2.23
Feb 16, 2025 14:48:59.119505882 CET	56274	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:48:59.124466896 CET	6149	56274	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:00.875950098 CET	6149	56274	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:00.876400948 CET	56274	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:00.877228975 CET	56276	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:00.881285906 CET	6149	56274	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:00.882225037 CET	6149	56276	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:00.882344961 CET	56276	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:00.882380962 CET	56276	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:00.887218952 CET	6149	56276	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:00.887296915 CET	56276	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:00.892090082 CET	6149	56276	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:02.838419914 CET	6149	56276	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:02.838504076 CET	6149	56276	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:02.838686943 CET	56276	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:02.838687897 CET	56276	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:02.839433908 CET	56278	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:03.031284094 CET	6149	56276	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:03.031569958 CET	56276	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:03.033595085 CET	6149	56276	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:03.035840034 CET	6149	56278	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:03.035948038 CET	56278	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:03.036026001 CET	56278	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:03.043004036 CET	6149	56278	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:03.043098927 CET	56278	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:03.050862074 CET	6149	56278	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:04.434704065 CET	43928	443	192.168.2.23	91.189.91.42
Feb 16, 2025 14:49:04.750344992 CET	6149	56278	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:04.750761986 CET	56278	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:04.751650095 CET	56280	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:04.755810022 CET	6149	56278	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:04.757288933 CET	6149	56280	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:04.757411957 CET	56280	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:04.757452011 CET	56280	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:04.762305975 CET	6149	56280	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:04.762381077 CET	56280	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:04.767290115 CET	6149	56280	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:06.393047094 CET	6149	56280	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:06.393495083 CET	56280	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:06.394026041 CET	56282	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:06.401411057 CET	6149	56280	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:06.401447058 CET	6149	56282	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:06.401561975 CET	56282	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:06.401607990 CET	56282	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:06.408790112 CET	6149	56282	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:06.408873081 CET	56282	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:06.416934013 CET	6149	56282	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:08.123148918 CET	6149	56282	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:08.123727083 CET	56282	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:08.124671936 CET	56284	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:08.128626108 CET	6149	56282	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:08.129622936 CET	6149	56284	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:08.129725933 CET	56284	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:08.129851103 CET	56284	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:08.134635925 CET	6149	56284	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:08.134716988 CET	56284	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:08.139595985 CET	6149	56284	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:09.764686108 CET	6149	56284	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:09.765316010 CET	56284	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:09.766088963 CET	56286	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:09.770626068 CET	6149	56284	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:09.771018028 CET	6149	56286	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:09.771121025 CET	56286	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:09.771198988 CET	56286	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:09.776017904 CET	6149	56286	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:09.776096106 CET	56286	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:09.781143904 CET	6149	56286	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:11.518073082 CET	6149	56286	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:11.518249035 CET	56286	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:11.518826962 CET	56288	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:11.523211956 CET	6149	56286	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:11.523775101 CET	6149	56288	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:11.523879051 CET	56288	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:11.523973942 CET	56288	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:11.528763056 CET	6149	56288	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:11.528827906 CET	56288	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:11.533658981 CET	6149	56288	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:13.268378973 CET	6149	56288	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:13.268822908 CET	56288	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:13.269570112 CET	56290	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:13.273737907 CET	6149	56288	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:13.274750948 CET	6149	56290	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:13.274822950 CET	56290	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:13.274908066 CET	56290	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:13.279858112 CET	6149	56290	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:13.279942036 CET	56290	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:13.284866095 CET	6149	56290	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:15.060976028 CET	6149	56290	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:15.061165094 CET	56290	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:15.061822891 CET	56292	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:15.066114902 CET	6149	56290	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:15.066732883 CET	6149	56292	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:15.066812992 CET	56292	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:15.066910028 CET	56292	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:15.071820021 CET	6149	56292	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:15.071893930 CET	56292	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:15.076792002 CET	6149	56292	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:16.748430014 CET	6149	56292	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:16.748768091 CET	56292	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:16.749545097 CET	56294	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:16.753664970 CET	6149	56292	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:16.754430056 CET	6149	56294	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:16.754483938 CET	56294	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:16.754548073 CET	56294	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:16.759356022 CET	6149	56294	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:16.759430885 CET	56294	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:16.764303923 CET	6149	56294	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:18.420676947 CET	6149	56294	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:18.421179056 CET	56294	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:18.423456907 CET	56296	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:18.426373959 CET	6149	56294	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:18.428616047 CET	6149	56296	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:18.428711891 CET	56296	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:18.428792000 CET	56296	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:18.433722973 CET	6149	56296	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:18.433793068 CET	56296	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:18.438674927 CET	6149	56296	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:20.174915075 CET	6149	56296	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:20.175431013 CET	56296	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:20.177438974 CET	56298	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:20.184354067 CET	6149	56296	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:20.185781002 CET	6149	56298	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:20.186053991 CET	56298	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:20.186147928 CET	56298	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:20.192693949 CET	6149	56298	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:20.192902088 CET	56298	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:20.199521065 CET	6149	56298	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:21.828964949 CET	6149	56298	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:21.829412937 CET	56298	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:21.831602097 CET	56300	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:21.834657907 CET	6149	56298	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:21.836648941 CET	6149	56300	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:21.836710930 CET	56300	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:21.836767912 CET	56300	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:21.842005968 CET	6149	56300	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:21.842164040 CET	56300	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:21.847465038 CET	6149	56300	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:23.535773993 CET	6149	56300	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:23.536453009 CET	56300	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:23.538405895 CET	56302	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:23.542073011 CET	6149	56300	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:23.543999910 CET	6149	56302	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:23.544078112 CET	56302	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:23.544125080 CET	56302	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:23.549197912 CET	6149	56302	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:23.549263000 CET	56302	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:23.554968119 CET	6149	56302	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:25.233403921 CET	6149	56302	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:25.233624935 CET	56302	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:25.234652996 CET	56304	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:25.238703966 CET	6149	56302	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:25.239573002 CET	6149	56304	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:25.239712000 CET	56304	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:25.239818096 CET	56304	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:25.244647980 CET	6149	56304	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:25.244755030 CET	56304	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:25.249735117 CET	6149	56304	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:26.891443968 CET	6149	56304	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:26.891840935 CET	56304	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:26.893536091 CET	56306	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:26.896816015 CET	6149	56304	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:26.898341894 CET	6149	56306	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:26.898430109 CET	56306	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:26.898507118 CET	56306	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:26.903301001 CET	6149	56306	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:26.903373003 CET	56306	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:26.908195019 CET	6149	56306	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:28.625658989 CET	6149	56306	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:28.625966072 CET	56306	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:28.627100945 CET	56308	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:28.630831003 CET	6149	56306	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:28.632105112 CET	6149	56308	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:28.632194996 CET	56308	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:28.632431984 CET	56308	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:28.637351036 CET	6149	56308	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:28.637439013 CET	56308	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:28.642266989 CET	6149	56308	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:30.329328060 CET	6149	56308	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:30.329621077 CET	56308	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:30.330291033 CET	56310	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:30.335165024 CET	6149	56308	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:30.335197926 CET	6149	56310	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:30.335395098 CET	56310	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:30.335427999 CET	56310	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:30.340699911 CET	6149	56310	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:30.340768099 CET	56310	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:30.347148895 CET	6149	56310	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:32.057331085 CET	6149	56310	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:32.057945013 CET	56310	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:32.058752060 CET	56312	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:32.063154936 CET	6149	56310	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:32.063755035 CET	6149	56312	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:32.063859940 CET	56312	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:32.064053059 CET	56312	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:32.068907976 CET	6149	56312	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:32.069075108 CET	56312	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:32.074214935 CET	6149	56312	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:33.781960964 CET	6149	56312	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:33.782278061 CET	56312	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:33.784214973 CET	56314	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:33.787610054 CET	6149	56312	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:33.789747000 CET	6149	56314	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:33.789836884 CET	56314	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:33.789921045 CET	56314	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:33.795219898 CET	6149	56314	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:33.795304060 CET	56314	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:33.800280094 CET	6149	56314	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:35.440629005 CET	6149	56314	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:35.441056967 CET	56314	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:35.442142010 CET	56316	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:35.446422100 CET	6149	56314	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:35.447722912 CET	6149	56316	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:35.447966099 CET	56316	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:35.447966099 CET	56316	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:35.453166008 CET	6149	56316	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:35.453360081 CET	56316	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:35.458915949 CET	6149	56316	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:37.170394897 CET	6149	56316	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:37.170864105 CET	56316	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:37.172132969 CET	56318	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:37.176023006 CET	6149	56316	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:37.177531958 CET	6149	56318	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:37.177745104 CET	56318	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:37.177745104 CET	56318	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:37.182914972 CET	6149	56318	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:37.183085918 CET	56318	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:37.188347101 CET	6149	56318	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:38.879899979 CET	6149	56318	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:38.880497932 CET	56318	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:38.881576061 CET	56320	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:38.885694027 CET	6149	56318	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:38.886759043 CET	6149	56320	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:38.886924982 CET	56320	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:38.887000084 CET	56320	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:38.892191887 CET	6149	56320	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:38.892327070 CET	56320	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:38.897578955 CET	6149	56320	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:40.599245071 CET	6149	56320	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:40.599631071 CET	56320	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:40.601713896 CET	56322	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:40.605602980 CET	6149	56320	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:40.606458902 CET	6149	56322	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:40.606509924 CET	56322	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:40.606667042 CET	56322	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:40.613543987 CET	6149	56322	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:40.613620043 CET	56322	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:40.620595932 CET	6149	56322	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:42.282380104 CET	6149	56322	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:42.282881975 CET	56322	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:42.283781052 CET	56324	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:42.287915945 CET	6149	56322	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:42.288734913 CET	6149	56324	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:42.288803101 CET	56324	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:42.288947105 CET	56324	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:42.293786049 CET	6149	56324	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:42.293883085 CET	56324	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:42.298686981 CET	6149	56324	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:43.921017885 CET	6149	56324	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:43.921724081 CET	56324	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:43.922872066 CET	56326	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:43.926939964 CET	6149	56324	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:43.928453922 CET	6149	56326	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:43.928622007 CET	56326	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:43.928622007 CET	56326	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:43.934186935 CET	6149	56326	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:43.934530020 CET	56326	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:43.939764977 CET	6149	56326	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:45.639503956 CET	6149	56326	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:45.639993906 CET	56326	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:45.640804052 CET	56328	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:45.644823074 CET	6149	56326	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:45.645721912 CET	6149	56328	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:45.645796061 CET	56328	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:45.645908117 CET	56328	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:45.650660992 CET	6149	56328	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:45.650729895 CET	56328	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:45.655520916 CET	6149	56328	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:47.364015102 CET	6149	56328	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:47.364173889 CET	56328	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:47.364757061 CET	56330	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:47.369240999 CET	6149	56328	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:47.370066881 CET	6149	56330	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:47.370156050 CET	56330	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:47.370201111 CET	56330	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:47.375077963 CET	6149	56330	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:47.375150919 CET	56330	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:47.381920099 CET	6149	56330	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:49.017029047 CET	6149	56330	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:49.017445087 CET	56330	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:49.018383980 CET	56332	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:49.022401094 CET	6149	56330	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:49.023391962 CET	6149	56332	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:49.023500919 CET	56332	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:49.023500919 CET	56332	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:49.028331995 CET	6149	56332	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:49.028462887 CET	56332	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:49.033518076 CET	6149	56332	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:50.687417030 CET	6149	56332	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:50.687920094 CET	56332	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:50.689903021 CET	56334	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:50.692934036 CET	6149	56332	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:50.694911957 CET	6149	56334	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:50.695034027 CET	56334	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:50.695034027 CET	56334	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:50.700047016 CET	6149	56334	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:50.700139999 CET	56334	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:50.705096960 CET	6149	56334	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:52.345038891 CET	6149	56334	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:52.345731020 CET	56334	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:52.347209930 CET	56336	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:52.350801945 CET	6149	56334	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:52.352252007 CET	6149	56336	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:52.352325916 CET	56336	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:52.352361917 CET	56336	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:52.357748032 CET	6149	56336	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:52.357805014 CET	56336	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:52.363372087 CET	6149	56336	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:54.020692110 CET	6149	56336	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:54.021116972 CET	56336	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:54.023392916 CET	56338	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:54.026107073 CET	6149	56336	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:54.028326035 CET	6149	56338	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:54.028456926 CET	56338	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:54.028542995 CET	56338	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:54.033318996 CET	6149	56338	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:54.033440113 CET	56338	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:54.038295031 CET	6149	56338	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:55.671022892 CET	6149	56338	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:55.671339989 CET	56338	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:55.672369003 CET	56340	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:55.676217079 CET	6149	56338	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:55.677288055 CET	6149	56340	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:55.677345037 CET	56340	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:55.677396059 CET	56340	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:55.682197094 CET	6149	56340	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:55.682254076 CET	56340	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:55.687131882 CET	6149	56340	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:57.311851025 CET	6149	56340	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:57.312215090 CET	56340	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:57.313966036 CET	56342	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:57.317148924 CET	6149	56340	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:57.319036961 CET	6149	56342	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:57.319128990 CET	56342	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:57.319262981 CET	56342	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:57.324079990 CET	6149	56342	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:57.324182987 CET	56342	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:57.329193115 CET	6149	56342	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:58.972059965 CET	6149	56342	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:58.972404957 CET	56342	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:58.973185062 CET	56344	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:58.977309942 CET	6149	56342	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:58.978096962 CET	6149	56344	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:58.978171110 CET	56344	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:58.978264093 CET	56344	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:58.983201981 CET	6149	56344	156.229.233.170	192.168.2.23
Feb 16, 2025 14:49:58.983282089 CET	56344	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:49:58.988044977 CET	6149	56344	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:00.639906883 CET	6149	56344	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:00.640388966 CET	56344	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:00.641602039 CET	56346	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:00.645349026 CET	6149	56344	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:00.646584034 CET	6149	56346	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:00.646661997 CET	56346	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:00.646764040 CET	56346	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:00.651633024 CET	6149	56346	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:00.651705027 CET	56346	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:00.656714916 CET	6149	56346	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:02.282077074 CET	6149	56346	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:02.282458067 CET	56346	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:02.283535004 CET	56348	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:02.287444115 CET	6149	56346	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:02.288853884 CET	6149	56348	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:02.288928032 CET	56348	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:02.288969040 CET	56348	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:02.294181108 CET	6149	56348	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:02.294269085 CET	56348	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:02.299439907 CET	6149	56348	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:03.938802958 CET	6149	56348	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:03.939224005 CET	56348	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:03.939974070 CET	56350	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:03.944854975 CET	6149	56348	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:03.944889069 CET	6149	56350	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:03.944950104 CET	56350	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:03.945049047 CET	56350	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:03.949909925 CET	6149	56350	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:03.949975967 CET	56350	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:03.954925060 CET	6149	56350	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:05.594724894 CET	6149	56350	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:05.595060110 CET	56350	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:05.595515013 CET	56352	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:05.599968910 CET	6149	56350	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:05.600313902 CET	6149	56352	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:05.600502968 CET	56352	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:05.600569963 CET	56352	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:05.605288029 CET	6149	56352	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:05.605351925 CET	56352	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:05.610199928 CET	6149	56352	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:07.251779079 CET	6149	56352	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:07.252477884 CET	56352	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:07.254226923 CET	56354	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:07.257461071 CET	6149	56352	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:07.259094000 CET	6149	56354	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:07.259370089 CET	56354	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:07.259445906 CET	56354	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:07.264334917 CET	6149	56354	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:07.264518023 CET	56354	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:07.269324064 CET	6149	56354	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:08.907691956 CET	6149	56354	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:08.908298016 CET	56354	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:08.909912109 CET	56356	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:08.913283110 CET	6149	56354	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:08.914788008 CET	6149	56356	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:08.915050030 CET	56356	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:08.915085077 CET	56356	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:08.919946909 CET	6149	56356	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:08.920028925 CET	56356	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:08.925020933 CET	6149	56356	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:10.566229105 CET	6149	56356	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:10.567023993 CET	56356	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:10.569448948 CET	56358	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:10.572077036 CET	6149	56356	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:10.574461937 CET	6149	56358	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:10.574579954 CET	56358	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:10.574771881 CET	56358	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:10.579807997 CET	6149	56358	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:10.580158949 CET	56358	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:10.585148096 CET	6149	56358	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:12.239804029 CET	6149	56358	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:12.240633965 CET	56358	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:12.242893934 CET	56360	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:12.245794058 CET	6149	56358	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:12.247956038 CET	6149	56360	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:12.248308897 CET	56360	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:12.248534918 CET	56360	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:12.253499031 CET	6149	56360	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:12.253864050 CET	56360	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:12.258753061 CET	6149	56360	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:13.890362024 CET	6149	56360	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:13.890961885 CET	56360	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:13.892604113 CET	56362	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:13.896084070 CET	6149	56360	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:13.897710085 CET	6149	56362	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:13.897934914 CET	56362	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:13.898241997 CET	56362	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:13.903191090 CET	6149	56362	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:13.903506994 CET	56362	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:13.908457994 CET	6149	56362	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:15.531532049 CET	6149	56362	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:15.532097101 CET	56362	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:15.533694029 CET	56364	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:15.538487911 CET	6149	56362	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:15.540402889 CET	6149	56364	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:15.540513992 CET	56364	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:15.540571928 CET	56364	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:15.547094107 CET	6149	56364	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:15.547235012 CET	56364	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:15.554377079 CET	6149	56364	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:17.187305927 CET	6149	56364	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:17.188209057 CET	56364	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:17.190320015 CET	56366	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:17.193331957 CET	6149	56364	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:17.195329905 CET	6149	56366	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:17.195791006 CET	56366	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:17.195791006 CET	56366	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:17.200869083 CET	6149	56366	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:17.201266050 CET	56366	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:17.206412077 CET	6149	56366	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:18.828963041 CET	6149	56366	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:18.829571962 CET	56366	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:18.831022024 CET	56368	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:18.834836006 CET	6149	56366	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:18.835961103 CET	6149	56368	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:18.836194038 CET	56368	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:18.836272955 CET	56368	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:18.841061115 CET	6149	56368	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:18.841417074 CET	56368	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:18.846432924 CET	6149	56368	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:20.666814089 CET	6149	56368	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:20.667131901 CET	56368	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:20.668447018 CET	56370	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:20.672596931 CET	6149	56368	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:20.673702955 CET	6149	56370	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:20.673757076 CET	56370	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:20.673794031 CET	56370	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:20.678637028 CET	6149	56370	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:20.678714991 CET	56370	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:20.683660984 CET	6149	56370	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:22.314049959 CET	6149	56370	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:22.314712048 CET	56370	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:22.317230940 CET	56372	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:22.320074081 CET	6149	56370	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:22.322473049 CET	6149	56372	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:22.322561026 CET	56372	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:22.322763920 CET	56372	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:22.327718019 CET	6149	56372	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:22.327852964 CET	56372	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:22.333257914 CET	6149	56372	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:23.970375061 CET	6149	56372	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:23.970869064 CET	56372	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:23.971805096 CET	56374	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:23.975848913 CET	6149	56372	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:23.976706028 CET	6149	56374	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:23.976787090 CET	56374	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:23.976990938 CET	56374	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:23.981822968 CET	6149	56374	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:23.981894970 CET	56374	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:23.986845016 CET	6149	56374	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:25.625322104 CET	6149	56374	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:25.625915051 CET	56374	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:25.627289057 CET	56376	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:25.631092072 CET	6149	56374	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:25.632302999 CET	6149	56376	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:25.632452011 CET	56376	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:25.632627964 CET	56376	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:25.637623072 CET	6149	56376	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:25.637985945 CET	56376	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:25.642913103 CET	6149	56376	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:27.265729904 CET	6149	56376	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:27.266047955 CET	56376	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:27.266819954 CET	56378	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:27.271003008 CET	6149	56376	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:27.271744013 CET	6149	56378	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:27.271797895 CET	56378	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:27.271833897 CET	56378	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:27.276813030 CET	6149	56378	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:27.276860952 CET	56378	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:27.281929016 CET	6149	56378	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:28.906618118 CET	6149	56378	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:28.907289982 CET	56378	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:28.909467936 CET	56380	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:28.912734985 CET	6149	56378	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:28.914632082 CET	6149	56380	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:28.914791107 CET	56380	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:28.914973974 CET	56380	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:28.923881054 CET	6149	56380	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:28.924135923 CET	56380	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:28.929605961 CET	6149	56380	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:30.564652920 CET	6149	56380	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:30.565347910 CET	56380	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:30.567532063 CET	56382	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:30.571010113 CET	6149	56380	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:30.572654963 CET	6149	56382	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:30.572778940 CET	56382	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:30.572978973 CET	56382	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:30.577970028 CET	6149	56382	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:30.578182936 CET	56382	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:30.583581924 CET	6149	56382	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:32.221116066 CET	6149	56382	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:32.221690893 CET	56382	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:32.223665953 CET	56384	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:32.227437973 CET	6149	56382	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:32.228904963 CET	6149	56384	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:32.229142904 CET	56384	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:32.229482889 CET	56384	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:32.234417915 CET	6149	56384	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:32.234770060 CET	56384	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:32.239989042 CET	6149	56384	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:33.890727997 CET	6149	56384	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:33.890897989 CET	56384	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:33.891797066 CET	56386	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:33.896009922 CET	6149	56384	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:33.897207022 CET	6149	56386	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:33.897290945 CET	56386	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:33.897336960 CET	56386	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:33.902240992 CET	6149	56386	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:33.902322054 CET	56386	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:33.907391071 CET	6149	56386	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:35.702871084 CET	6149	56386	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:35.703340054 CET	56386	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:35.704194069 CET	56388	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:35.708348989 CET	6149	56386	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:35.709199905 CET	6149	56388	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:35.709311962 CET	56388	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:35.709372044 CET	56388	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:35.714302063 CET	6149	56388	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:35.714384079 CET	56388	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:35.719307899 CET	6149	56388	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:37.347300053 CET	6149	56388	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:37.348005056 CET	56388	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:37.349044085 CET	56390	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:37.352982044 CET	6149	56388	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:37.353956938 CET	6149	56390	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:37.354063988 CET	56390	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:37.354132891 CET	56390	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:37.358937979 CET	6149	56390	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:37.359014988 CET	56390	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:37.363842010 CET	6149	56390	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:39.000838041 CET	6149	56390	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:39.001300097 CET	56390	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:39.002706051 CET	56392	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:39.007059097 CET	6149	56390	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:39.007839918 CET	6149	56392	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:39.007936954 CET	56392	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:39.008016109 CET	56392	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:39.012955904 CET	6149	56392	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:39.013067961 CET	56392	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:39.018152952 CET	6149	56392	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:40.640798092 CET	6149	56392	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:40.641439915 CET	56392	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:40.641439915 CET	56392	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:40.643871069 CET	56394	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:40.646866083 CET	6149	56392	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:40.649059057 CET	6149	56394	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:40.649306059 CET	56394	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:40.649563074 CET	56394	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:40.658617973 CET	6149	56394	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:40.658684015 CET	56394	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:40.663563967 CET	6149	56394	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:42.301075935 CET	6149	56394	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:42.301531076 CET	56394	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:42.302489996 CET	56396	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:42.306648016 CET	6149	56394	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:42.307440996 CET	6149	56396	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:42.307534933 CET	56396	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:42.307612896 CET	56396	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:42.312494993 CET	6149	56396	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:42.312578917 CET	56396	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:42.317720890 CET	6149	56396	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:43.976352930 CET	6149	56396	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:43.976531029 CET	56396	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:43.977179050 CET	56398	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:43.983552933 CET	6149	56396	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:43.984184980 CET	6149	56398	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:43.984275103 CET	56398	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:43.984345913 CET	56398	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:43.991352081 CET	6149	56398	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:43.991415024 CET	56398	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:43.998399019 CET	6149	56398	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:45.625579119 CET	6149	56398	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:45.626100063 CET	56398	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:45.627335072 CET	56400	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:45.631082058 CET	6149	56398	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:45.632222891 CET	6149	56400	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:45.632344007 CET	56400	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:45.632430077 CET	56400	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:45.637295008 CET	6149	56400	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:45.637367964 CET	56400	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:45.642355919 CET	6149	56400	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:47.285887003 CET	6149	56400	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:47.286010027 CET	56400	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:47.286972046 CET	56402	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:47.291007996 CET	6149	56400	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:47.291872025 CET	6149	56402	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:47.291930914 CET	56402	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:47.291995049 CET	56402	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:47.296847105 CET	6149	56402	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:47.296911955 CET	56402	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:47.301733971 CET	6149	56402	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:48.939692974 CET	6149	56402	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:48.939888000 CET	56402	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:48.941325903 CET	56404	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:48.944791079 CET	6149	56402	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:48.946253061 CET	6149	56404	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:48.946329117 CET	56404	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:48.946363926 CET	56404	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:48.951265097 CET	6149	56404	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:48.951299906 CET	56404	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:48.956089020 CET	6149	56404	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:50.579026937 CET	6149	56404	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:50.579596996 CET	56404	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:50.580948114 CET	56406	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:50.585078955 CET	6149	56404	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:50.585978031 CET	6149	56406	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:50.586116076 CET	56406	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:50.586272001 CET	56406	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:50.591052055 CET	6149	56406	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:50.591197968 CET	56406	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:50.596048117 CET	6149	56406	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:52.221359015 CET	6149	56406	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:52.221771002 CET	56406	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:52.222323895 CET	56408	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:52.228542089 CET	6149	56406	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:52.229619026 CET	6149	56408	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:52.229686022 CET	56408	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:52.229736090 CET	56408	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:52.235204935 CET	6149	56408	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:52.235264063 CET	56408	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:52.243441105 CET	6149	56408	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:53.895095110 CET	6149	56408	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:53.895541906 CET	56408	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:53.896178961 CET	56410	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:53.901565075 CET	6149	56408	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:53.902981997 CET	6149	56410	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:53.903039932 CET	56410	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:53.903074026 CET	56410	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:53.907995939 CET	6149	56410	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:53.908057928 CET	56410	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:53.912949085 CET	6149	56410	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:55.551343918 CET	6149	56410	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:55.551800013 CET	56410	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:55.552480936 CET	56412	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:55.558464050 CET	6149	56410	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:55.559003115 CET	6149	56412	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:55.559058905 CET	56412	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:55.559099913 CET	56412	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:55.564946890 CET	6149	56412	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:55.565002918 CET	56412	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:55.570718050 CET	6149	56412	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:57.203739882 CET	6149	56412	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:57.203989029 CET	56412	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:57.204853058 CET	56414	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:57.209466934 CET	6149	56412	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:57.209844112 CET	6149	56414	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:57.209899902 CET	56414	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:57.209938049 CET	56414	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:57.214920998 CET	6149	56414	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:57.214981079 CET	56414	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:57.220093012 CET	6149	56414	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:58.863847017 CET	6149	56414	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:58.864049911 CET	56414	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:58.864988089 CET	56416	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:58.868932962 CET	6149	56414	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:58.869942904 CET	6149	56416	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:58.870064020 CET	56416	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:58.870105028 CET	56416	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:58.874898911 CET	6149	56416	156.229.233.170	192.168.2.23
Feb 16, 2025 14:50:58.874983072 CET	56416	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:50:58.879795074 CET	6149	56416	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:00.519814014 CET	6149	56416	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:00.520242929 CET	56416	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:00.521011114 CET	56418	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:00.525125027 CET	6149	56416	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:00.525865078 CET	6149	56418	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:00.525929928 CET	56418	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:00.525965929 CET	56418	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:00.530778885 CET	6149	56418	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:00.530833960 CET	56418	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:00.535614967 CET	6149	56418	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:02.195444107 CET	6149	56418	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:02.195728064 CET	56418	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:02.196650028 CET	56420	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:02.200737953 CET	6149	56418	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:02.201591015 CET	6149	56420	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:02.201658010 CET	56420	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:02.201733112 CET	56420	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:02.206530094 CET	6149	56420	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:02.206589937 CET	56420	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:02.211402893 CET	6149	56420	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:03.853133917 CET	6149	56420	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:03.853552103 CET	56420	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:03.854825020 CET	56422	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:03.858452082 CET	6149	56420	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:03.859704971 CET	6149	56422	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:03.859761953 CET	56422	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:03.859805107 CET	56422	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:03.864609003 CET	6149	56422	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:03.864660978 CET	56422	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:03.869479895 CET	6149	56422	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:05.520596027 CET	6149	56422	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:05.521064997 CET	56422	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:05.522568941 CET	56424	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:05.526021957 CET	6149	56422	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:05.527492046 CET	6149	56424	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:05.527581930 CET	56424	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:05.527667046 CET	56424	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:05.532500029 CET	6149	56424	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:05.532664061 CET	56424	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:05.537535906 CET	6149	56424	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:07.209863901 CET	6149	56424	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:07.210036039 CET	56424	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:07.211045980 CET	56426	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:07.215010881 CET	6149	56424	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:07.215950966 CET	6149	56426	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:07.216005087 CET	56426	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:07.216043949 CET	56426	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:07.220933914 CET	6149	56426	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:07.221066952 CET	56426	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:07.226656914 CET	6149	56426	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:08.881683111 CET	6149	56426	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:08.882009029 CET	56426	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:08.883292913 CET	56428	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:08.887079000 CET	6149	56426	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:08.888309002 CET	6149	56428	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:08.888375044 CET	56428	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:08.888453007 CET	56428	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:08.893220901 CET	6149	56428	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:08.893281937 CET	56428	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:08.898113012 CET	6149	56428	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:10.531814098 CET	6149	56428	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:10.532016039 CET	56428	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:10.533544064 CET	56430	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:10.536883116 CET	6149	56428	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:10.538379908 CET	6149	56430	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:10.538453102 CET	56430	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:10.538547993 CET	56430	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:10.543286085 CET	6149	56430	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:10.543348074 CET	56430	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:10.548929930 CET	6149	56430	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:12.190222025 CET	6149	56430	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:12.190388918 CET	56430	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:12.191301107 CET	56432	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:12.195579052 CET	6149	56430	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:12.196373940 CET	6149	56432	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:12.196479082 CET	56432	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:12.196547985 CET	56432	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:12.202299118 CET	6149	56432	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:12.202676058 CET	56432	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:12.208417892 CET	6149	56432	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:13.846265078 CET	6149	56432	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:13.846916914 CET	56432	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:13.849021912 CET	56434	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:13.852744102 CET	6149	56432	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:13.855408907 CET	6149	56434	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:13.855495930 CET	56434	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:13.855575085 CET	56434	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:13.860454082 CET	6149	56434	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:13.860522985 CET	56434	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:13.867386103 CET	6149	56434	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:15.501283884 CET	6149	56434	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:15.501806974 CET	56434	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:15.503199100 CET	56436	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:15.506707907 CET	6149	56434	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:15.508198023 CET	6149	56436	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:15.508287907 CET	56436	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:15.508557081 CET	56436	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:15.513474941 CET	6149	56436	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:15.513689041 CET	56436	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:15.518604040 CET	6149	56436	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:17.167686939 CET	6149	56436	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:17.168102026 CET	56436	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:17.169275045 CET	56438	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:17.173784018 CET	6149	56436	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:17.174182892 CET	6149	56438	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:17.174379110 CET	56438	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:17.174379110 CET	56438	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:17.179353952 CET	6149	56438	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:17.179554939 CET	56438	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:17.184556007 CET	6149	56438	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:18.814094067 CET	6149	56438	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:18.814361095 CET	56438	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:18.815274000 CET	56440	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:18.819289923 CET	6149	56438	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:18.820252895 CET	6149	56440	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:18.820327997 CET	56440	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:18.820390940 CET	56440	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:18.825767994 CET	6149	56440	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:18.825823069 CET	56440	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:18.830704927 CET	6149	56440	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:20.471695900 CET	6149	56440	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:20.471992970 CET	56440	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:20.473232031 CET	56442	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:20.479765892 CET	6149	56440	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:20.480858088 CET	6149	56442	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:20.480957985 CET	56442	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:20.481020927 CET	56442	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:20.489109993 CET	6149	56442	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:20.489176989 CET	56442	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:20.494518995 CET	6149	56442	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:22.125960112 CET	6149	56442	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:22.126306057 CET	56442	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:22.128032923 CET	56444	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:22.131243944 CET	6149	56442	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:22.132999897 CET	6149	56444	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:22.133203030 CET	56444	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:22.133203030 CET	56444	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:22.138148069 CET	6149	56444	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:22.138370991 CET	56444	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:22.143311024 CET	6149	56444	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:23.782201052 CET	6149	56444	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:23.782891989 CET	56444	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:23.784259081 CET	56446	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:23.787947893 CET	6149	56444	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:23.789201975 CET	6149	56446	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:23.789414883 CET	56446	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:23.789416075 CET	56446	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:23.794611931 CET	6149	56446	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:23.795001984 CET	56446	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:23.800795078 CET	6149	56446	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:25.440817118 CET	6149	56446	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:25.441454887 CET	56446	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:25.443353891 CET	56448	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:25.446485996 CET	6149	56446	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:25.448548079 CET	6149	56448	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:25.448637962 CET	56448	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:25.448724031 CET	56448	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:25.453541994 CET	6149	56448	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:25.453619003 CET	56448	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:25.458615065 CET	6149	56448	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:27.098601103 CET	6149	56448	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:27.099119902 CET	56448	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:27.100708008 CET	56450	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:27.104089022 CET	6149	56448	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:27.105669975 CET	6149	56450	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:27.105756998 CET	56450	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:27.105839014 CET	56450	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:27.110615015 CET	6149	56450	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:27.110687017 CET	56450	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:27.115511894 CET	6149	56450	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:28.757713079 CET	6149	56450	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:28.757919073 CET	56450	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:28.759367943 CET	56452	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:28.765981913 CET	6149	56450	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:28.767256975 CET	6149	56452	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:28.767357111 CET	56452	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:28.767402887 CET	56452	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:28.775193930 CET	6149	56452	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:28.775372028 CET	56452	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:28.783289909 CET	6149	56452	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:30.407546043 CET	6149	56452	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:30.408196926 CET	56452	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:30.409857035 CET	56454	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:30.413413048 CET	6149	56452	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:30.415286064 CET	6149	56454	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:30.415482998 CET	56454	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:30.415803909 CET	56454	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:30.420903921 CET	6149	56454	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:30.421031952 CET	56454	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:30.425934076 CET	6149	56454	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:32.065840960 CET	6149	56454	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:32.066273928 CET	56454	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:32.067209959 CET	56456	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:32.071233034 CET	6149	56454	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:32.072096109 CET	6149	56456	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:32.072163105 CET	56456	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:32.072228909 CET	56456	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:32.077230930 CET	6149	56456	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:32.077286005 CET	56456	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:32.082142115 CET	6149	56456	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:33.755366087 CET	6149	56456	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:33.755785942 CET	56456	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:33.757138968 CET	56458	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:33.760683060 CET	6149	56456	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:33.761965990 CET	6149	56458	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:33.762027979 CET	56458	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:33.762113094 CET	56458	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:33.766959906 CET	6149	56458	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:33.767021894 CET	56458	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:33.771862984 CET	6149	56458	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:35.411746025 CET	6149	56458	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:35.412046909 CET	56458	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:35.413230896 CET	56460	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:35.416950941 CET	6149	56458	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:35.418170929 CET	6149	56460	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:35.418229103 CET	56460	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:35.418463945 CET	56460	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:35.423269987 CET	6149	56460	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:35.423433065 CET	56460	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:35.428294897 CET	6149	56460	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:37.084836960 CET	6149	56460	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:37.085175991 CET	56460	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:37.086199045 CET	56462	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:37.091808081 CET	6149	56460	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:37.092350006 CET	6149	56462	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:37.092413902 CET	56462	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:37.092453957 CET	56462	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:37.099587917 CET	6149	56462	156.229.233.170	192.168.2.23
Feb 16, 2025 14:51:37.099667072 CET	56462	6149	192.168.2.23	156.229.233.170
Feb 16, 2025 14:51:37.106390953 CET	6149	56462	156.229.233.170	192.168.2.23

System Behavior

Analysis Process: pXdN91.x68.elf PID: 6247, Parent PID: 6162

General

Start time (UTC):	13:48:03
Start date (UTC):	16/02/2025
Path:	/tmp/pXdN91.x68.elf
Arguments:	/tmp/pXdN91.x68.elf
File size:	120952 bytes
MD5 hash:	e9a3fc1cc9b49e2480c67a02c8dbef8b

File Activities

File Opened

File Read

Process Activities

Process Forked

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: pXdN91.x68.elf PID: 6248, Parent PID: 6247

General

Start time (UTC):	13:48:03
Start date (UTC):	16/02/2025
Path:	/tmp/pXdN91.x68.elf
Arguments:	-
File size:	120952 bytes
MD5 hash:	e9a3fc1cc9b49e2480c67a02c8dbef8b

File Activities

File Opened

Directory Enumerated

Process Activities

Thread Sleep

Chronological Activities

Analysis Process: pXdN91.x68.elf PID: 6249, Parent PID: 6247

General

Start time (UTC):	13:48:03
Start date (UTC):	16/02/2025
Path:	/tmp/pXdN91.x68.elf
Arguments:	-
File size:	120952 bytes
MD5 hash:	e9a3fc1cc9b49e2480c67a02c8dbef8b

Process Activities

Process Forked

Chronological Activities

Analysis Process: pXdN91.x68.elf PID: 6250, Parent PID: 6249

General

Start time (UTC):	13:48:03
Start date (UTC):	16/02/2025
Path:	/tmp/pXdN91.x68.elf
Arguments:	-
File size:	120952 bytes
MD5 hash:	e9a3fc1cc9b49e2480c67a02c8dbef8b

Description:	Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping or `net view` using Net .
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report pXdN91.x68.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Threatname: Gafgyt

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: pXdN91.x68.elf PID: 6247, Parent PID: 6162

General

File Activities

File Opened

File Read

Process Activities

Process Forked

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: pXdN91.x68.elf PID: 6248, Parent PID: 6247

General

File Activities

File Opened

Directory Enumerated

Process Activities

Thread Sleep

Chronological Activities

Linux Analysis Report
pXdN91.x68.elf