Edit tour

Linux Analysis Report
sh.elf

Overview

General Information

Sample name:	sh.elf
Analysis ID:	1617651
MD5:	1940b8dced2360655dab0992c1816b87
SHA1:	3556d62bdf298e07c7766a68ca6c942bfca52776
SHA256:	245d18ab2fdfdb46e6c80ce283c546caa2c41da9854b4a682d8cb9df58457334
Tags:	elfuser-abuse_ch
Infos:

Detection

Gafgyt, Mirai

Score:	92
Range:	0 - 100

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Gafgyt

Yara detected Mirai

Opens /proc/net/* files useful for finding connected devices and routers

Detected TCP or UDP traffic on non-standard ports

Sample and/or dropped files contains symbols with suspicious names

Sample contains strings that are user agent strings indicative of HTTP manipulation

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1617651
Start date and time:	2025-02-18 06:32:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	sh.elf
Detection:	MAL
Classification:	mal92.spre.troj.linELF@0/1@0/0

Warnings

VT rate limit hit for: 84.200.154.119:4567

Runtime Messages

Command:	/tmp/sh.elf
PID:	6242
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	BUILD HERAV1 BUILD HERAV1
Standard Error:

Process Tree

system is lnxubuntu20

sh.elf (PID: 6242, Parent: 6166, MD5: 7dc1c0e23cd5e102bb12e5c29403410e) Arguments: /tmp/sh.elf

sh.elf New Fork (PID: 6244, Parent: 6242)

sh.elf New Fork (PID: 6246, Parent: 6244)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
sh.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
sh.elf	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
sh.elf	Linux_Trojan_Gafgyt_fb14e81f	unknown	unknown	0x147bc:$a: 4E 45 52 00 53 43 41 4E 4E 45 52 20 4F 4E 20 7C 20 4F 46 46 00

Memory Dumps

Source	Rule	Description	Author	Strings
6242.1.00007fc8f4011000.00007fc8f4028000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
6242.1.00007fc8f4011000.00007fc8f4028000.r-x.sdmp	Linux_Trojan_Gafgyt_fb14e81f	unknown	unknown	0x147bc:$a: 4E 45 52 00 53 43 41 4E 4E 45 52 20 4F 4E 20 7C 20 4F 46 46 00
6244.1.00007fc8f4011000.00007fc8f4028000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
6244.1.00007fc8f4011000.00007fc8f4028000.r-x.sdmp	Linux_Trojan_Gafgyt_fb14e81f	unknown	unknown	0x147bc:$a: 4E 45 52 00 53 43 41 4E 4E 45 52 20 4F 4E 20 7C 20 4F 46 46 00

Suricata Signatures

ETPRO MALWARE ELF/BASHLITE Variant CnC Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-18T06:32:59.765213+0100	2847180	1	A Network Trojan was detected	192.168.2.23	47632	84.200.154.119	4567	TCP

Joe Sandbox Signatures

• AV Detection
• Spreading
• Networking
• System Summary
• Malware Analysis System Evasion
• Stealing of Sensitive Information
• Remote Access Functionality

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: sh.elf

Malware Configuration Extractor: Gafgyt {"C2 url": "84.200.154.119:4567"}

Multi AV Scanner detection for submitted file

Source: sh.elf	ReversingLabs: Detection: 64%
Source: sh.elf	Virustotal: Detection: 55%			Perma Link

Spreading

Opens /proc/net/* files useful for finding connected devices and routers

Source: /tmp/sh.elf (PID: 6242)

Opens: /proc/net/route

Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2847180 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.23:47632 -> 84.200.154.119:4567

Source: global traffic

TCP traffic: 192.168.2.23:47632 -> 84.200.154.119:4567

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 84.200.154.119
Source: unknown	TCP traffic detected without corresponding DNS query: 84.200.154.119
Source: unknown	TCP traffic detected without corresponding DNS query: 84.200.154.119
Source: unknown	TCP traffic detected without corresponding DNS query: 84.200.154.119
Source: unknown	TCP traffic detected without corresponding DNS query: 84.200.154.119
Source: unknown	TCP traffic detected without corresponding DNS query: 84.200.154.119
Source: unknown	TCP traffic detected without corresponding DNS query: 84.200.154.119
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 84.200.154.119
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 84.200.154.119
Source: unknown	TCP traffic detected without corresponding DNS query: 84.200.154.119
Source: unknown	TCP traffic detected without corresponding DNS query: 84.200.154.119
Source: unknown	TCP traffic detected without corresponding DNS query: 84.200.154.119
Source: unknown	TCP traffic detected without corresponding DNS query: 84.200.154.119
Source: unknown	TCP traffic detected without corresponding DNS query: 84.200.154.119
Source: unknown	TCP traffic detected without corresponding DNS query: 84.200.154.119
Source: unknown	TCP traffic detected without corresponding DNS query: 84.200.154.119
Source: unknown	TCP traffic detected without corresponding DNS query: 84.200.154.119
Source: unknown	TCP traffic detected without corresponding DNS query: 84.200.154.119
Source: unknown	TCP traffic detected without corresponding DNS query: 84.200.154.119
Source: unknown	TCP traffic detected without corresponding DNS query: 84.200.154.119
Source: unknown	TCP traffic detected without corresponding DNS query: 84.200.154.119
Source: unknown	TCP traffic detected without corresponding DNS query: 84.200.154.119
Source: unknown	TCP traffic detected without corresponding DNS query: 84.200.154.119
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 84.200.154.119
Source: unknown	TCP traffic detected without corresponding DNS query: 84.200.154.119
Source: unknown	TCP traffic detected without corresponding DNS query: 84.200.154.119
Source: unknown	TCP traffic detected without corresponding DNS query: 84.200.154.119
Source: unknown	TCP traffic detected without corresponding DNS query: 84.200.154.119
Source: unknown	TCP traffic detected without corresponding DNS query: 84.200.154.119
Source: unknown	TCP traffic detected without corresponding DNS query: 84.200.154.119
Source: unknown	TCP traffic detected without corresponding DNS query: 84.200.154.119
Source: unknown	TCP traffic detected without corresponding DNS query: 84.200.154.119
Source: unknown	TCP traffic detected without corresponding DNS query: 84.200.154.119
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 84.200.154.119
Source: unknown	TCP traffic detected without corresponding DNS query: 84.200.154.119
Source: unknown	TCP traffic detected without corresponding DNS query: 84.200.154.119
Source: unknown	TCP traffic detected without corresponding DNS query: 84.200.154.119
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 84.200.154.119
Source: unknown	TCP traffic detected without corresponding DNS query: 84.200.154.119
Source: unknown	TCP traffic detected without corresponding DNS query: 84.200.154.119
Source: unknown	TCP traffic detected without corresponding DNS query: 84.200.154.119
Source: unknown	TCP traffic detected without corresponding DNS query: 84.200.154.119
Source: unknown	TCP traffic detected without corresponding DNS query: 84.200.154.119
Source: unknown	TCP traffic detected without corresponding DNS query: 84.200.154.119

Source: sh.elf

String found in binary or memory: http://84.200.154.119/bins.sh;

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: sh.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_fb14e81f Author: unknown
Source: 6242.1.00007fc8f4011000.00007fc8f4028000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_fb14e81f Author: unknown
Source: 6244.1.00007fc8f4011000.00007fc8f4028000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_fb14e81f Author: unknown

Source: sh.elf	ELF static info symbol of initial sample: passwords
Source: sh.elf	ELF static info symbol of initial sample: usernames

Source: sh.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_fb14e81f severity = 100, os = linux, arch_context = x86, creation_date = 2022-01-05, scan_context = file, memory, reference = 0fd07e6068a721774716eb4940e2c19faef02d5bdacf3b018bf5995fa98a3a27, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 12b430108256bd0f57f48b9dbbea12eba7405c0b3b66a1c4b882647051f1ec52, id = fb14e81f-be2a-4428-9877-958e394a7ae2, last_modified = 2022-01-26
Source: 6242.1.00007fc8f4011000.00007fc8f4028000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_fb14e81f severity = 100, os = linux, arch_context = x86, creation_date = 2022-01-05, scan_context = file, memory, reference = 0fd07e6068a721774716eb4940e2c19faef02d5bdacf3b018bf5995fa98a3a27, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 12b430108256bd0f57f48b9dbbea12eba7405c0b3b66a1c4b882647051f1ec52, id = fb14e81f-be2a-4428-9877-958e394a7ae2, last_modified = 2022-01-26
Source: 6244.1.00007fc8f4011000.00007fc8f4028000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_fb14e81f severity = 100, os = linux, arch_context = x86, creation_date = 2022-01-05, scan_context = file, memory, reference = 0fd07e6068a721774716eb4940e2c19faef02d5bdacf3b018bf5995fa98a3a27, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 12b430108256bd0f57f48b9dbbea12eba7405c0b3b66a1c4b882647051f1ec52, id = fb14e81f-be2a-4428-9877-958e394a7ae2, last_modified = 2022-01-26

Source: classification engine

Classification label: mal92.spre.troj.linELF@0/1@0/0

Source: sh.elf	ELF static info symbol of initial sample: libc/string/sparc/memchr.S
Source: sh.elf	ELF static info symbol of initial sample: libc/string/sparc/memcpy.S
Source: sh.elf	ELF static info symbol of initial sample: libc/string/sparc/memset.S
Source: sh.elf	ELF static info symbol of initial sample: libc/string/sparc/strchr.S
Source: sh.elf	ELF static info symbol of initial sample: libc/string/sparc/strcmp.S
Source: sh.elf	ELF static info symbol of initial sample: libc/string/sparc/strcpy.S
Source: sh.elf	ELF static info symbol of initial sample: libc/string/sparc/strlen.S
Source: sh.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/sparc/crt1.S
Source: sh.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/sparc/crti.S
Source: sh.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/sparc/crtn.S
Source: sh.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/sparc/fork.S
Source: sh.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/sparc/rem.S
Source: sh.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/sparc/udiv.S
Source: sh.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/sparc/umul.S
Source: sh.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/sparc/urem.S
Source: sh.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/sparc/vfork.S

Source: /tmp/sh.elf (PID: 6242)

Queries kernel information via 'uname':

Jump to behavior

Source: sh.elf, 6242.1.00005620591ed000.0000562059252000.rw-.sdmp, sh.elf, 6244.1.00005620591ed000.0000562059252000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sparc
Source: sh.elf, 6242.1.00007ffdcaa04000.00007ffdcaa25000.rw-.sdmp	Binary or memory string: \GpU V/tmp/qemu-open.QrTuxa\4
Source: sh.elf, 6242.1.00007ffdcaa04000.00007ffdcaa25000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.QrTuxa
Source: sh.elf, 6242.1.00005620591ed000.0000562059252000.rw-.sdmp, sh.elf, 6244.1.00005620591ed000.0000562059252000.rw-.sdmp	Binary or memory string: Y V!/etc/qemu-binfmt/sparc
Source: sh.elf, 6242.1.00007ffdcaa04000.00007ffdcaa25000.rw-.sdmp, sh.elf, 6244.1.00007ffdcaa04000.00007ffdcaa25000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-sparc/tmp/sh.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/sh.elf
Source: sh.elf, 6242.1.00007ffdcaa04000.00007ffdcaa25000.rw-.sdmp, sh.elf, 6244.1.00007ffdcaa04000.00007ffdcaa25000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sparc

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match

File source: sh.elf, type: SAMPLE

Yara detected Mirai

Source: Yara match	File source: sh.elf, type: SAMPLE
Source: Yara match	File source: 6242.1.00007fc8f4011000.00007fc8f4028000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6244.1.00007fc8f4011000.00007fc8f4028000.r-x.sdmp, type: MEMORY

Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:48.0) Gecko/20100101 Firefox/48.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en; rv:1.8.1.11) Gecko/20071128 Camino/1.5.4
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; rv:2.2) Gecko/20110201
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; cs; rv:1.9.2.6) Gecko/20100628 myibrow/4alpha2
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Win 9x 4.90; SG; rv:1.9.2.4) Gecko/20101104 Netscape/9.1.0285
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.2.0 Lightning/4.0.2
Source: Initial sample	User agent string found: Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U;) Presto/2.7.62 Version/11.01
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; Linux x86_64; U; de; rv:1.9.1.6) Gecko/20091201 Firefox/3.5.6 Opera 10.62
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Linux; Android 4.4.3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.89 Mobile Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0) Gecko/20110517 Firefox/5.0 Fennec/5.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Android; Linux armv7l; rv:9.0) Gecko/20111216 Firefox/9.0 Fennec/9.0
Source: Initial sample	User agent string found: Mozilla/5.0 (compatible; Teleca Q7; Brew 3.1.5; U; en) 480X800 LGE VX11000

Remote Access Functionality

Yara detected Gafgyt

Source: Yara match

File source: sh.elf, type: SAMPLE

Yara detected Mirai

Source: Yara match	File source: sh.elf, type: SAMPLE
Source: Yara match	File source: 6242.1.00007fc8f4011000.00007fc8f4028000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6244.1.00007fc8f4011000.00007fc8f4028000.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	1 Remote System Discovery	Remote Desktop Protocol	Data from Removable Media	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

Threatname: Gafgyt

{
  "C2 url": "84.200.154.119:4567"
}

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
sh.elf	65%	ReversingLabs	Linux.Trojan.Gafgyt
sh.elf	55%	Virustotal		Browse

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
84.200.154.119:4567	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

⊘No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
84.200.154.119:4567	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://84.200.154.119/bins.sh;	sh.elf	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
84.200.154.119	unknown	Germany	31400	ACCELERATED-ITDE	true
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
84.200.154.119	ftp.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	pftp.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	bash.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	openssh.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	ntpd.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	na.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	wget.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	cron.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	sh.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	pftp.elf	Get hash	malicious	Gafgyt, Mirai	Browse
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.43	ftp.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	bash.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	boatnet.x86.elf	Get hash	malicious	Mirai	Browse
	ntpd.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	boatnet.mips.elf	Get hash	malicious	Mirai	Browse
	193.32.162.38-boatnet.arm7-2025-02-18T00_55_21.elf	Get hash	malicious	Mirai	Browse
	bin.sh.elf	Get hash	malicious	Mirai	Browse
	boatnet.sh4.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Prometei	Browse
91.189.91.42	ftp.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	bash.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	boatnet.x86.elf	Get hash	malicious	Mirai	Browse
	ntpd.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	boatnet.mips.elf	Get hash	malicious	Mirai	Browse
	193.32.162.38-boatnet.arm7-2025-02-18T00_55_21.elf	Get hash	malicious	Mirai	Browse
	bin.sh.elf	Get hash	malicious	Mirai	Browse
	boatnet.sh4.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Prometei	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	ftp.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	bash.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	boatnet.x86.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	ntpd.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	boatnet.mips.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	193.32.162.38-boatnet.arm7-2025-02-18T00_55_21.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	bin.sh.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	boatnet.ppc.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	boatnet.sh4.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
CANONICAL-ASGB	ftp.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	bash.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	boatnet.x86.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	ntpd.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	boatnet.mips.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	193.32.162.38-boatnet.arm7-2025-02-18T00_55_21.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	bin.sh.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	boatnet.ppc.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	boatnet.sh4.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
INIT7CH	ftp.elf	Get hash	malicious	Gafgyt, Mirai	Browse	109.202.202.202
	bash.elf	Get hash	malicious	Gafgyt, Mirai	Browse	109.202.202.202
	boatnet.x86.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	ntpd.elf	Get hash	malicious	Gafgyt, Mirai	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	boatnet.mips.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	193.32.162.38-boatnet.arm7-2025-02-18T00_55_21.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	bin.sh.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	boatnet.sh4.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
ACCELERATED-ITDE	ftp.elf	Get hash	malicious	Gafgyt, Mirai	Browse	84.200.154.119
	pftp.elf	Get hash	malicious	Gafgyt, Mirai	Browse	84.200.154.119
	bash.elf	Get hash	malicious	Gafgyt, Mirai	Browse	84.200.154.119
	openssh.elf	Get hash	malicious	Gafgyt, Mirai	Browse	84.200.154.119
	ntpd.elf	Get hash	malicious	Gafgyt, Mirai	Browse	84.200.154.119
	na.elf	Get hash	malicious	Gafgyt, Mirai	Browse	84.200.154.119
	wget.elf	Get hash	malicious	Gafgyt, Mirai	Browse	84.200.154.119
	cron.elf	Get hash	malicious	Gafgyt, Mirai	Browse	84.200.154.119
	sh.elf	Get hash	malicious	Gafgyt, Mirai	Browse	84.200.154.119
	pftp.elf	Get hash	malicious	Gafgyt, Mirai	Browse	84.200.154.119

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/tmp/qemu-open.QrTuxa (deleted)

Download File

Process:	/tmp/sh.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	230
Entropy (8bit):	3.709552666863289
Encrypted:	false
SSDEEP:	6:iekrEcvwAsE5KlwSd4pzKaV6Lpms/a/1VCxGF:ur+m5MwSdIKaV6L1adVRF
MD5:	2E667F43AE18CD1FE3C108641708A82C
SHA1:	12B90DE2DA0FBCFE66F3D6130905E56C8D6A68D3
SHA-256:	6F721492E7A337C5B498A8F55F5EB7AC745AFF716D0B5B08EFF2C1B6B250F983
SHA-512:	D2A0EE2509154EC1098994F38BE172F98F4150399C534A04D5C675D7C05630802225019F19344CC9070C576BC465A4FEB382AC7712DE6BF25E9244B54A9DB830
Malicious:	false
Reputation:	high, very likely benign file
Preview:	Iface.Destination.Gateway .Flags.RefCnt.Use.Metric.Mask..MTU.Window.IRTT .ens160.00000000.c0a80201.0003.0.0.0.00000000.0.0.0.ens160.c0a80200.00000000.0001.0.0.0.ffffff00.0.0.0.

Static File Info

General

File type:	ELF 32-bit MSB executable, SPARC, version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	5.597461704090659
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	sh.elf
File size:	172'218 bytes
MD5:	1940b8dced2360655dab0992c1816b87
SHA1:	3556d62bdf298e07c7766a68ca6c942bfca52776
SHA256:	245d18ab2fdfdb46e6c80ce283c546caa2c41da9854b4a682d8cb9df58457334
SHA512:	28816e57674023709debc358cbf2635210dd37cfd5a9e45c0960d5690057b5b2aadcb77dbc466e5078594b816693eb8d5132f6c777f741c216336dbee647612e
SSDEEP:	1536:NR+q8OYV62VZOVN95gMtTtg+3fBywm73UUYxPKbglHZ7:NbEQ2V8VNPfK+3IwmDUUYxSbgpZ7
TLSH:	DDF376A363F70D32C1871475E58F272C57A8FFD6A4958B95AC83BC202BBDB88354A354
File Content Preview:	.ELF...........................4..L0.....4. ...(......................a...a................................@........dt.Q................................@..(....@.L.................#.....c...`.....!..... ...@.....".........`......$ ... ...@...........`....

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	Sparc
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x101a4
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	150576
Section Header Size:	40
Number of Section Headers:	24
Header String Table Index:	21

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x10094	0x94	0x1c	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x100b0	0xb0	0x13314	0x0	0x6	AX	0	0	4
.fini	PROGBITS	0x233c4	0x133c4	0x14	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x233d8	0x133d8	0x2da8	0x0	0x2	A	0	0	8
.eh_frame	PROGBITS	0x26180	0x16180	0x4	0x0	0x2	A	0	0	4
.ctors	PROGBITS	0x38000	0x18000	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x38008	0x18008	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x38010	0x18010	0x4	0x0	0x3	WA	0	0	4
.data	PROGBITS	0x38018	0x18018	0xbbac	0x0	0x3	WA	0	0	8
.bss	NOBITS	0x43bc8	0x23bc4	0x6378	0x0	0x3	WA	0	0	8
.comment	PROGBITS	0x0	0x23bc4	0xab0	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x24674	0x20	0x0	0x0		0	0	1
.debug_pubnames	PROGBITS	0x0	0x24694	0x1f	0x0	0x0		0	0	1
.debug_info	PROGBITS	0x0	0x246b3	0x16e	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x24821	0xfb	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x2491c	0x7c	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x24998	0x28	0x0	0x0		0	0	4
.debug_str	PROGBITS	0x0	0x249c0	0x10b	0x1	0x30	MS	0	0	1
.debug_loc	PROGBITS	0x0	0x24acb	0x6e	0x0	0x0		0	0	1
.debug_ranges	PROGBITS	0x0	0x24b39	0x18	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x24b51	0xdc	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x24ff0	0x2df0	0x10	0x0		23	270	4
.strtab	STRTAB	0x0	0x27de0	0x22da	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x10000	0x10000	0x16184	0x16184	5.9624	0x5	R E	0x10000	.init .text .fini .rodata .eh_frame
LOAD	0x18000	0x38000	0x38000	0xbbc4	0x11f40	3.8896	0x6	RW	0x10000	.ctors .dtors .jcr .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x10094	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x100b0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x233c4	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x233d8	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x26180	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x38000	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x38008	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x38010	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x38018	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x43bc8	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	19
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	20
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	21
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	22
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	23
.rem	.symtab	0x194d0	44	FUNC	<unknown>	DEFAULT	2
.udiv	.symtab	0x194b0	20	FUNC	<unknown>	DEFAULT	2
.umul	.symtab	0x194c4	12	FUNC	<unknown>	DEFAULT	2
.urem	.symtab	0x19490	32	FUNC	<unknown>	DEFAULT	2
Q	.symtab	0x43c00	16384	OBJECT	<unknown>	DEFAULT	10
StartTheLelz	.symtab	0x13320	7832	FUNC	<unknown>	DEFAULT	2
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x38004	0	OBJECT	<unknown>	DEFAULT	6
__CTOR_LIST__	.symtab	0x38000	0	OBJECT	<unknown>	DEFAULT	6
__C_ctype_b	.symtab	0x4385c	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x249f8	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x43bbc	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x25e80	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x43864	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x24cf8	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x3800c	0	OBJECT	<unknown>	DEFAULT	7
__DTOR_LIST__	.symtab	0x38008	0	OBJECT	<unknown>	DEFAULT	7
__EH_FRAME_BEGIN__	.symtab	0x26180	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x26180	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x4385c	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_b_data	.symtab	0x249f8	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_tolower	.symtab	0x43bbc	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_tolower_data	.symtab	0x25e80	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_toupper	.symtab	0x43864	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_toupper_data	.symtab	0x24cf8	768	OBJECT	<unknown>	HIDDEN	4
__GI___ctype_b	.symtab	0x43860	4	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_tolower	.symtab	0x43bc0	4	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_toupper	.symtab	0x43868	4	OBJECT	<unknown>	HIDDEN	9
__GI___errno_location	.symtab	0x19bcc	12	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x22ef0	328	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x1d59c	32	FUNC	<unknown>	HIDDEN	2
__GI___h_errno_location	.symtab	0x1f448	12	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x194fc	136	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl64	.symtab	0x19584	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x19854	120	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x1ee1c	132	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x1eef4	104	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x1d5bc	284	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x195e8	64	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x21158	316	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x1e980	24	FUNC	<unknown>	HIDDEN	2
__GI_atol	.symtab	0x1e980	24	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x212b0	60	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0x19628	68	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x1966c	68	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x1dba0	76	FUNC	<unknown>	HIDDEN	2
__GI_dup2	.symtab	0x196b0	72	FUNC	<unknown>	HIDDEN	2
__GI_errno	.symtab	0x49e44	4	OBJECT	<unknown>	HIDDEN	10
__GI_execl	.symtab	0x1ebd8	152	FUNC	<unknown>	HIDDEN	2
__GI_execve	.symtab	0x1f210	76	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x1eb58	128	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x21388	324	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x194fc	136	FUNC	<unknown>	HIDDEN	2
__GI_fcntl64	.symtab	0x19584	100	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x21b9c	420	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x22ef0	328	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x21a24	100	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x21d40	192	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x214cc	24	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x19428	52	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x1ae60	60	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x214e4	36	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x21508	272	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x1ae9c	176	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x22ef0	328	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x196f8	40	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x1f25c	64	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x1f29c	64	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x1f2dc	64	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname	.symtab	0x1d864	60	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x1d8a0	768	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x19720	64	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x19760	72	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x1dbec	76	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x1f31c	64	FUNC	<unknown>	HIDDEN	2
__GI_h_errno	.symtab	0x49e48	4	OBJECT	<unknown>	HIDDEN	10
__GI_inet_addr	.symtab	0x1d83c	40	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x20580	220	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa	.symtab	0x1d818	36	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa_r	.symtab	0x1d7a8	112	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x224e4	684	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x22120	544	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x1e75c	228	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x197a8	100	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x1d6f0	32	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x1980c	72	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x22e5c	112	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x2026c	280	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x1b578	4212	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x1af94	1508	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x20384	32	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x203a4	272	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x1c620	416	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x1f35c	72	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x19854	120	FUNC	<unknown>	HIDDEN	2
__GI_pipe	.symtab	0x198e4	68	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x2133c	76	FUNC	<unknown>	HIDDEN	2
__GI_printf	.symtab	0x19bd8	56	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x22e44	24	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x1e35c	80	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x1e5dc	156	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x21e00	204	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x1997c	76	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x1dc8c	32	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x1f3a4	84	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x199c8	84	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x1dcac	32	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x1dccc	88	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x19a1c	64	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x1dd24	44	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x1e4b8	292	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x210b8	160	FUNC	<unknown>	HIDDEN	2
__GI_sigaddset	.symtab	0x1dd9c	56	FUNC	<unknown>	HIDDEN	2
__GI_sigemptyset	.symtab	0x1ddd4	32	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x1ddf4	188	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x19a5c	140	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x1ec70	428	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x1dd50	76	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x19c10	52	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x1e678	228	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x23038	92	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x1c834	524	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x1cb94	648	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x1cb94	648	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x1ce84	804	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x2201c	56	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x1d210	120	FUNC	<unknown>	HIDDEN	2
__GI_strncat	.symtab	0x21ecc	224	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x1d288	248	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x1d380	252	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x20530	80	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x1ca40	192	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x21fac	112	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x1d47c	288	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x1d6d8	24	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x204b4	124	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x1e998	20	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x1d710	112	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x19ae8	72	FUNC	<unknown>	HIDDEN	2
__GI_tolower	.symtab	0x22ecc	36	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x19ba8	36	FUNC	<unknown>	HIDDEN	2
__GI_vfork	.symtab	0x1945c	52	FUNC	<unknown>	HIDDEN	2
__GI_vfprintf	.symtab	0x19e44	148	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x19c44	156	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x1f3f8	80	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x19b30	20	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x1f454	72	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x1f4b8	188	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x1f49c	28	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x19b44	76	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x38010	0	OBJECT	<unknown>	DEFAULT	8
__JCR_LIST__	.symtab	0x38010	0	OBJECT	<unknown>	DEFAULT	8
__app_fini	.symtab	0x49e38	4	OBJECT	<unknown>	HIDDEN	10
__atexit_lock	.symtab	0x43b6c	24	OBJECT	<unknown>	DEFAULT	9
__bsd_signal	.symtab	0x1ddf4	188	FUNC	<unknown>	HIDDEN	2
__bss_start	.symtab	0x43bc4	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x1eeb0	68	FUNC	<unknown>	DEFAULT	2
__ctype_b	.symtab	0x43860	4	OBJECT	<unknown>	DEFAULT	9
__ctype_tolower	.symtab	0x43bc0	4	OBJECT	<unknown>	DEFAULT	9
__ctype_toupper	.symtab	0x43868	4	OBJECT	<unknown>	DEFAULT	9
__curbrk	.symtab	0x49e6c	4	OBJECT	<unknown>	HIDDEN	10
__data_start	.symtab	0x38020	0	NOTYPE	<unknown>	DEFAULT	9
__decode_answer	.symtab	0x22a18	240	FUNC	<unknown>	HIDDEN	2
__decode_dotted	.symtab	0x23138	196	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x228ac	208	FUNC	<unknown>	HIDDEN	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__dns_lookup	.symtab	0x2065c	1852	FUNC	<unknown>	HIDDEN	2
__do_global_ctors_aux	.symtab	0x2337c	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x100b0	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x38018	0	OBJECT	<unknown>	HIDDEN	9
__encode_dotted	.symtab	0x23094	164	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x22790	284	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x2297c	120	FUNC	<unknown>	HIDDEN	2
__environ	.symtab	0x49e30	4	OBJECT	<unknown>	DEFAULT	10
__errno_location	.symtab	0x19bcc	12	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x49e28	4	OBJECT	<unknown>	HIDDEN	10
__fgetc_unlocked	.symtab	0x22ef0	328	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x38000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fini_array_start	.symtab	0x38000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__get_hosts_byname_r	.symtab	0x21080	56	FUNC	<unknown>	HIDDEN	2
__glibc_strerror_r	.symtab	0x1d59c	32	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__h_errno_location	.symtab	0x1f448	12	FUNC	<unknown>	DEFAULT	2
__h_errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__heap_alloc	.symtab	0x1e158	160	FUNC	<unknown>	DEFAULT	2
__heap_free	.symtab	0x1e240	268	FUNC	<unknown>	DEFAULT	2
__heap_link_free_area	.symtab	0x1e1f8	48	FUNC	<unknown>	DEFAULT	2
__heap_link_free_area_after	.symtab	0x1e228	24	FUNC	<unknown>	DEFAULT	2
__init_array_end	.symtab	0x38000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__init_array_start	.symtab	0x38000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__length_dotted	.symtab	0x231fc	72	FUNC	<unknown>	HIDDEN	2
__length_question	.symtab	0x229f4	36	FUNC	<unknown>	HIDDEN	2
__libc_close	.symtab	0x1966c	68	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x1dba0	76	FUNC	<unknown>	DEFAULT	2
__libc_creat	.symtab	0x198cc	24	FUNC	<unknown>	DEFAULT	2
__libc_fcntl	.symtab	0x194fc	136	FUNC	<unknown>	DEFAULT	2
__libc_fcntl64	.symtab	0x19584	100	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x19428	52	FUNC	<unknown>	DEFAULT	2
__libc_getpid	.symtab	0x19720	64	FUNC	<unknown>	DEFAULT	2
__libc_lseek64	.symtab	0x22e5c	112	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0x1f35c	72	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x19854	120	FUNC	<unknown>	DEFAULT	2
__libc_poll	.symtab	0x2133c	76	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x1997c	76	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x1dc8c	32	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x199c8	84	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x1dcac	32	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x1dccc	88	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x210b8	160	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x49e2c	4	OBJECT	<unknown>	DEFAULT	10
__libc_system	.symtab	0x1e840	320	FUNC	<unknown>	DEFAULT	2
__libc_waitpid	.symtab	0x19b30	20	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x19b44	76	FUNC	<unknown>	DEFAULT	2
__malloc_heap	.symtab	0x439a8	4	OBJECT	<unknown>	DEFAULT	9
__malloc_heap_lock	.symtab	0x49e10	24	OBJECT	<unknown>	DEFAULT	10
__malloc_sbrk_lock	.symtab	0x49efc	24	OBJECT	<unknown>	DEFAULT	10
__muldi3	.symtab	0x19354	212	FUNC	<unknown>	DEFAULT	2
__nameserver	.symtab	0x49f24	12	OBJECT	<unknown>	HIDDEN	10
__nameservers	.symtab	0x49f30	4	OBJECT	<unknown>	HIDDEN	10
__open_etc_hosts	.symtab	0x22b08	56	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x20d98	744	FUNC	<unknown>	HIDDEN	2
__pagesize	.symtab	0x49e34	4	OBJECT	<unknown>	DEFAULT	10
__preinit_array_end	.symtab	0x38000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__preinit_array_start	.symtab	0x38000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__pthread_initialize_minimal	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0x1eea0	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x1eea0	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x1eea0	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x1eea0	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x1eea0	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_void	.symtab	0x1eea8	8	FUNC	<unknown>	DEFAULT	2
__raise	.symtab	0x22e44	24	FUNC	<unknown>	HIDDEN	2
__read_etc_hosts_r	.symtab	0x22b40	772	FUNC	<unknown>	HIDDEN	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__resolv_lock	.symtab	0x43b8c	24	OBJECT	<unknown>	DEFAULT	9
__rtld_fini	.symtab	0x49e3c	4	OBJECT	<unknown>	HIDDEN	10
__searchdomain	.symtab	0x49f14	16	OBJECT	<unknown>	HIDDEN	10
__searchdomains	.symtab	0x49f34	4	OBJECT	<unknown>	HIDDEN	10
__sigaddset	.symtab	0x1ded8	44	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x1df04	44	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x1deb0	40	FUNC	<unknown>	DEFAULT	2
__socketcall	.symtab	0x1f1c8	72	FUNC	<unknown>	HIDDEN	2
__socketcall.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__stdin	.symtab	0x43878	4	OBJECT	<unknown>	DEFAULT	9
__stdio_READ	.symtab	0x23244	104	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x1f574	196	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x21618	252	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x1f638	320	FUNC	<unknown>	HIDDEN	2
__stdio_init_mutex	.symtab	0x19d40	28	FUNC	<unknown>	HIDDEN	2
__stdio_mutex_initializer.3860	.symtab	0x24ff8	24	OBJECT	<unknown>	DEFAULT	4
__stdio_rfill	.symtab	0x232ac	56	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x219f0	52	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x232e4	152	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x1f778	252	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x19e0c	56	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x4387c	4	OBJECT	<unknown>	DEFAULT	9
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_rt_sigaction	.symtab	0x212ec	80	FUNC	<unknown>	HIDDEN	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uClibc_fini	.symtab	0x1ee1c	132	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x1eef4	104	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x1ef5c	620	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__ubp_memchr	.symtab	0x2026c	280	FUNC	<unknown>	DEFAULT	2
__uclibc_progname	.symtab	0x43b84	4	OBJECT	<unknown>	HIDDEN	9
__vfork	.symtab	0x1945c	52	FUNC	<unknown>	HIDDEN	2
__xpg_strerror_r	.symtab	0x1d5bc	284	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_charpad	.symtab	0x19ed8	60	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_dl_aux_init	.symtab	0x21294	28	FUNC	<unknown>	DEFAULT	2
_dl_phdr	.symtab	0x49f38	4	OBJECT	<unknown>	DEFAULT	10
_dl_phnum	.symtab	0x49f3c	4	OBJECT	<unknown>	DEFAULT	10
_edata	.symtab	0x43bc4	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x49f40	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_errno	.symtab	0x49e44	4	OBJECT	<unknown>	DEFAULT	10
_exit	.symtab	0x195e8	64	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x233c4	8	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x47c18	8192	OBJECT	<unknown>	DEFAULT	10
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x19f14	128	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x1fa78	1908	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_h_errno	.symtab	0x49e48	4	OBJECT	<unknown>	DEFAULT	10
_init	.symtab	0x10094	8	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x1f874	144	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_init	.symtab	0x1a610	164	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x1a918	1352	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x1a6b4	60	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x1a6f0	480	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x1a8d0	72	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x1eea8	8	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x1eea8	8	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_sigintr	.symtab	0x49e7c	128	OBJECT	<unknown>	HIDDEN	10
_start	.symtab	0x101a4	56	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x21714	732	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x19ce0	96	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x43880	4	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_add_lock	.symtab	0x43884	24	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_dec_use	.symtab	0x21a88	276	FUNC	<unknown>	DEFAULT	2
_stdio_openlist_del_count	.symtab	0x47c14	4	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_del_lock	.symtab	0x4389c	24	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_use_count	.symtab	0x47c10	4	OBJECT	<unknown>	DEFAULT	10
_stdio_streams	.symtab	0x438b8	240	OBJECT	<unknown>	DEFAULT	9
_stdio_term	.symtab	0x19d5c	176	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x438b4	4	OBJECT	<unknown>	DEFAULT	9
_stdlib_strto_l	.symtab	0x1e9ac	428	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x1f904	60	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x25158	2934	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x1f940	312	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x19f94	1660	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x21158	316	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
atoi	.symtab	0x1e980	24	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x1e980	24	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bcopy	.symtab	0x1af88	12	FUNC	<unknown>	DEFAULT	2
been_there_done_that	.symtab	0x49e68	4	OBJECT	<unknown>	DEFAULT	10
been_there_done_that.2818	.symtab	0x49e40	4	OBJECT	<unknown>	DEFAULT	10
bot.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
brk	.symtab	0x212b0	60	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x1ddf4	188	FUNC	<unknown>	DEFAULT	2
buf.2628	.symtab	0x49c20	16	OBJECT	<unknown>	DEFAULT	10
buf.4861	.symtab	0x49c30	460	OBJECT	<unknown>	DEFAULT	10
bzero	.symtab	0x1c5ec	52	FUNC	<unknown>	DEFAULT	2
c	.symtab	0x43854	4	OBJECT	<unknown>	DEFAULT	9
call___do_global_ctors_aux	.symtab	0x233b8	0	FUNC	<unknown>	DEFAULT	2
call___do_global_dtors_aux	.symtab	0x1012c	0	FUNC	<unknown>	DEFAULT	2
call_frame_dummy	.symtab	0x10198	0	FUNC	<unknown>	DEFAULT	2
chdir	.symtab	0x19628	68	FUNC	<unknown>	DEFAULT	2
chdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x1966c	68	FUNC	<unknown>	DEFAULT	2
close.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
commServer	.symtab	0x38028	4	OBJECT	<unknown>	DEFAULT	9
completed.2248	.symtab	0x43bc8	1	OBJECT	<unknown>	DEFAULT	10
connect	.symtab	0x1dba0	76	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connectTimeout	.symtab	0x120b0	672	FUNC	<unknown>	DEFAULT	2
creat	.symtab	0x198cc	24	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
csum	.symtab	0x12fcc	312	FUNC	<unknown>	DEFAULT	2
currentServer	.symtab	0x437f0	4	OBJECT	<unknown>	DEFAULT	9
data_start	.symtab	0x38020	0	NOTYPE	<unknown>	DEFAULT	9
decodea.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dnslookup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dup2	.symtab	0x196b0	72	FUNC	<unknown>	DEFAULT	2
dup2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ	.symtab	0x49e30	4	OBJECT	<unknown>	DEFAULT	10
errno	.symtab	0x49e44	4	OBJECT	<unknown>	DEFAULT	10
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
estridx	.symtab	0x250c8	126	OBJECT	<unknown>	DEFAULT	4
execl	.symtab	0x1ebd8	152	FUNC	<unknown>	DEFAULT	2
execl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execve	.symtab	0x1f210	76	FUNC	<unknown>	DEFAULT	2
execve.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x1eb58	128	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x25d78	72	OBJECT	<unknown>	DEFAULT	4
fclose	.symtab	0x21388	324	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x194fc	136	FUNC	<unknown>	DEFAULT	2
fcntl64	.symtab	0x19584	100	FUNC	<unknown>	DEFAULT	2
fdgets	.symtab	0x1150c	224	FUNC	<unknown>	DEFAULT	2
fdopen_pids	.symtab	0x47c00	4	OBJECT	<unknown>	DEFAULT	10
fdpclose	.symtab	0x1133c	464	FUNC	<unknown>	DEFAULT	2
fdpopen	.symtab	0x11004	824	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x21b9c	420	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x22ef0	328	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x21a24	100	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x21d40	192	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fmt	.symtab	0x25d60	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x214cc	24	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0x19428	52	FUNC	<unknown>	DEFAULT	2
fputs_unlocked	.symtab	0x1ae60	60	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x10138	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x1e070	232	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x214e4	36	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x214e4	36	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x21508	272	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fwrite_unlocked	.symtab	0x1ae9c	176	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getBogos	.symtab	0x11948	704	FUNC	<unknown>	DEFAULT	2
getBuild	.symtab	0x186c0	28	FUNC	<unknown>	DEFAULT	2
getCores	.symtab	0x11c08	280	FUNC	<unknown>	DEFAULT	2
getHost	.symtab	0x1187c	100	FUNC	<unknown>	DEFAULT	2
getOurIP	.symtab	0x1834c	884	FUNC	<unknown>	DEFAULT	2
getRandomIP	.symtab	0x12f6c	96	FUNC	<unknown>	DEFAULT	2
getRandomPublicIP	.symtab	0x12b78	1012	FUNC	<unknown>	DEFAULT	2
get_hosts_byname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getc_unlocked	.symtab	0x22ef0	328	FUNC	<unknown>	DEFAULT	2
getdtablesize	.symtab	0x196f8	40	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x1f25c	64	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x1f29c	64	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x1f2dc	64	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname	.symtab	0x1d864	60	FUNC	<unknown>	DEFAULT	2
gethostbyname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r	.symtab	0x1d8a0	768	FUNC	<unknown>	DEFAULT	2
gethostbyname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x19720	64	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x19760	72	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockname	.symtab	0x1dbec	76	FUNC	<unknown>	DEFAULT	2
getsockname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x1dc38	84	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x1f31c	64	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gotIP	.symtab	0x43bec	4	OBJECT	<unknown>	DEFAULT	10
h.4860	.symtab	0x49dfc	20	OBJECT	<unknown>	DEFAULT	10
h_errno	.symtab	0x49e48	4	OBJECT	<unknown>	DEFAULT	10
heap_alloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
heap_free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
hextable	.symtab	0x2423c	1024	OBJECT	<unknown>	DEFAULT	4
htonl	.symtab	0x1d794	8	FUNC	<unknown>	DEFAULT	2
htons	.symtab	0x1d79c	12	FUNC	<unknown>	DEFAULT	2
i.4153	.symtab	0x43858	4	OBJECT	<unknown>	DEFAULT	9
index	.symtab	0x1c834	524	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x1d83c	40	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x20580	220	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa	.symtab	0x1d818	36	FUNC	<unknown>	DEFAULT	2
inet_ntoa.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa_r	.symtab	0x1d7a8	112	FUNC	<unknown>	DEFAULT	2
inet_ntop	.symtab	0x224e4	684	FUNC	<unknown>	DEFAULT	2
inet_ntop4	.symtab	0x22340	420	FUNC	<unknown>	DEFAULT	2
inet_pton	.symtab	0x22120	544	FUNC	<unknown>	DEFAULT	2
inet_pton4	.symtab	0x22054	204	FUNC	<unknown>	DEFAULT	2
infectline	.symtab	0x38024	4	OBJECT	<unknown>	DEFAULT	9
initConnection	.symtab	0x1810c	576	FUNC	<unknown>	DEFAULT	2
init_rand	.symtab	0x10200	228	FUNC	<unknown>	DEFAULT	2
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initial_fa	.symtab	0x439b0	264	OBJECT	<unknown>	DEFAULT	9
initstate	.symtab	0x1e40c	96	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x1e75c	228	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x197a8	100	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ipState	.symtab	0x47c08	5	OBJECT	<unknown>	DEFAULT	10
isatty	.symtab	0x1d6f0	32	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isspace	.symtab	0x19b90	24	FUNC	<unknown>	DEFAULT	2
isspace.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0x1980c	72	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lengthd.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lengthq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/sparc/memchr.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/sparc/memcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/sparc/memset.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/sparc/strchr.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/sparc/strcmp.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/sparc/strcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/sparc/strlen.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/sparc/crt1.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/sparc/crti.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/sparc/crtn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/sparc/fork.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/sparc/rem.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/sparc/udiv.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/sparc/umul.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/sparc/urem.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/sparc/vfork.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libgcc2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
listFork	.symtab	0x12350	432	FUNC	<unknown>	DEFAULT	2
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x22e5c	112	FUNC	<unknown>	DEFAULT	2
macAddress	.symtab	0x43bf8	6	OBJECT	<unknown>	DEFAULT	10
main	.symtab	0x186dc	3192	FUNC	<unknown>	DEFAULT	2
mainCommSock	.symtab	0x43be8	4	OBJECT	<unknown>	DEFAULT	10
makeIPPacket	.symtab	0x131f8	220	FUNC	<unknown>	DEFAULT	2
makeRandomStr	.symtab	0x11d20	128	FUNC	<unknown>	DEFAULT	2
malloc	.symtab	0x1df30	320	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
matchPrompt	.symtab	0x126d4	440	FUNC	<unknown>	DEFAULT	2
memchr	.symtab	0x2026c	280	FUNC	<unknown>	DEFAULT	2
memcpy	.symtab	0x1b578	4212	FUNC	<unknown>	DEFAULT	2
memmove	.symtab	0x1af94	1508	FUNC	<unknown>	DEFAULT	2
mempcpy	.symtab	0x20384	32	FUNC	<unknown>	DEFAULT	2
mempcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memrchr	.symtab	0x203a4	272	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x1c620	416	FUNC	<unknown>	DEFAULT	2
mylock	.symtab	0x43ab8	24	OBJECT	<unknown>	DEFAULT	9
mylock	.symtab	0x49e4c	24	OBJECT	<unknown>	DEFAULT	10
mylock	.symtab	0x43ba4	24	OBJECT	<unknown>	DEFAULT	9
nanosleep	.symtab	0x1f35c	72	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
negotiate	.symtab	0x12500	468	FUNC	<unknown>	DEFAULT	2
next_start.1092	.symtab	0x49c18	4	OBJECT	<unknown>	DEFAULT	10
ntohl	.symtab	0x1d780	8	FUNC	<unknown>	DEFAULT	2
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0x1d788	12	FUNC	<unknown>	DEFAULT	2
ntop.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
numpids	.symtab	0x43bf0	8	OBJECT	<unknown>	DEFAULT	10
object.2329	.symtab	0x43bcc	24	OBJECT	<unknown>	DEFAULT	10
open	.symtab	0x19854	120	FUNC	<unknown>	DEFAULT	2
open.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opennameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ourIP	.symtab	0x49e70	4	OBJECT	<unknown>	DEFAULT	10
p.2246	.symtab	0x3801c	0	OBJECT	<unknown>	DEFAULT	9
parseHex	.symtab	0x115ec	136	FUNC	<unknown>	DEFAULT	2
passwords	.symtab	0x43814	64	OBJECT	<unknown>	DEFAULT	9
pids	.symtab	0x49e78	4	OBJECT	<unknown>	DEFAULT	10
pipe	.symtab	0x198e4	68	FUNC	<unknown>	DEFAULT	2
pipe.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
poll	.symtab	0x2133c	76	FUNC	<unknown>	DEFAULT	2
poll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prctl	.symtab	0x19928	84	FUNC	<unknown>	DEFAULT	2
prctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prefix.4072	.symtab	0x25020	12	OBJECT	<unknown>	DEFAULT	4
print	.symtab	0x109e0	1144	FUNC	<unknown>	DEFAULT	2
printchar	.symtab	0x105a0	108	FUNC	<unknown>	DEFAULT	2
printf	.symtab	0x19bd8	56	FUNC	<unknown>	DEFAULT	2
printf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
printi	.symtab	0x107c8	536	FUNC	<unknown>	DEFAULT	2
prints	.symtab	0x1060c	444	FUNC	<unknown>	DEFAULT	2
processCmd	.symtab	0x16d38	5076	FUNC	<unknown>	DEFAULT	2
qual_chars.4078	.symtab	0x25038	20	OBJECT	<unknown>	DEFAULT	4
raise	.symtab	0x22e44	24	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x1e34c	16	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand_cmwc	.symtab	0x102e4	356	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x1e35c	80	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x25cd0	40	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x1e5dc	156	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randtbl	.symtab	0x43aec	128	OBJECT	<unknown>	DEFAULT	9
rawmemchr	.symtab	0x21e00	204	FUNC	<unknown>	DEFAULT	2
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read	.symtab	0x1997c	76	FUNC	<unknown>	DEFAULT	2
read.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
readUntil	.symtab	0x1288c	748	FUNC	<unknown>	DEFAULT	2
read_etc_hosts_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recv	.symtab	0x1dc8c	32	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recvLine	.symtab	0x11da0	784	FUNC	<unknown>	DEFAULT	2
rindex	.symtab	0x1ca40	192	FUNC	<unknown>	DEFAULT	2
sbrk	.symtab	0x1f3a4	84	FUNC	<unknown>	DEFAULT	2
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
scanPid	.symtab	0x49e74	4	OBJECT	<unknown>	DEFAULT	10
sclose	.symtab	0x132d4	76	FUNC	<unknown>	DEFAULT	2
select	.symtab	0x199c8	84	FUNC	<unknown>	DEFAULT	2
select.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send	.symtab	0x1dcac	32	FUNC	<unknown>	DEFAULT	2
send.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sendCNC	.symtab	0x1598c	236	FUNC	<unknown>	DEFAULT	2
sendHOLD	.symtab	0x166fc	1596	FUNC	<unknown>	DEFAULT	2
sendHTTP	.symtab	0x157e4	424	FUNC	<unknown>	DEFAULT	2
sendJUNK	.symtab	0x16154	1448	FUNC	<unknown>	DEFAULT	2
sendTCP	.symtab	0x15a78	1756	FUNC	<unknown>	DEFAULT	2
sendUDP	.symtab	0x151b8	1248	FUNC	<unknown>	DEFAULT	2
sendto	.symtab	0x1dccc	88	FUNC	<unknown>	DEFAULT	2
sendto.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsid	.symtab	0x19a1c	64	FUNC	<unknown>	DEFAULT	2
setsid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsockopt	.symtab	0x1dd24	44	FUNC	<unknown>	DEFAULT	2
setsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate	.symtab	0x1e3ac	96	FUNC	<unknown>	DEFAULT	2
setstate_r	.symtab	0x1e4b8	292	FUNC	<unknown>	DEFAULT	2
sigaction	.symtab	0x210b8	160	FUNC	<unknown>	DEFAULT	2
sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigaddset	.symtab	0x1dd9c	56	FUNC	<unknown>	DEFAULT	2
sigaddset.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigempty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigemptyset	.symtab	0x1ddd4	32	FUNC	<unknown>	DEFAULT	2
signal	.symtab	0x1ddf4	188	FUNC	<unknown>	DEFAULT	2
signal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigprocmask	.symtab	0x19a5c	140	FUNC	<unknown>	DEFAULT	2
sigprocmask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigsetops.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sleep	.symtab	0x1ec70	428	FUNC	<unknown>	DEFAULT	2
sleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket	.symtab	0x1dd50	76	FUNC	<unknown>	DEFAULT	2
socket.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket_connect	.symtab	0x15698	332	FUNC	<unknown>	DEFAULT	2
sockprintf	.symtab	0x10efc	264	FUNC	<unknown>	DEFAULT	2
spec_and_mask.4077	.symtab	0x2504c	16	OBJECT	<unknown>	DEFAULT	4
spec_base.4071	.symtab	0x25030	7	OBJECT	<unknown>	DEFAULT	4
spec_chars.4074	.symtab	0x25080	21	OBJECT	<unknown>	DEFAULT	4
spec_flags.4073	.symtab	0x25098	8	OBJECT	<unknown>	DEFAULT	4
spec_or_mask.4076	.symtab	0x2505c	16	OBJECT	<unknown>	DEFAULT	4
spec_ranges.4075	.symtab	0x25070	9	OBJECT	<unknown>	DEFAULT	4
sprintf	.symtab	0x19c10	52	FUNC	<unknown>	DEFAULT	2
sprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
srand	.symtab	0x1e46c	76	FUNC	<unknown>	DEFAULT	2
srandom	.symtab	0x1e46c	76	FUNC	<unknown>	DEFAULT	2
srandom_r	.symtab	0x1e678	228	FUNC	<unknown>	DEFAULT	2
static_id	.symtab	0x43b88	2	OBJECT	<unknown>	DEFAULT	9
static_ns	.symtab	0x49e64	4	OBJECT	<unknown>	DEFAULT	10
stderr	.symtab	0x43874	4	OBJECT	<unknown>	DEFAULT	9
stdin	.symtab	0x4386c	4	OBJECT	<unknown>	DEFAULT	9
stdout	.symtab	0x43870	4	OBJECT	<unknown>	DEFAULT	9
strcasecmp	.symtab	0x23038	92	FUNC	<unknown>	DEFAULT	2
strcasecmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchr	.symtab	0x1c834	524	FUNC	<unknown>	DEFAULT	2
strcmp	.symtab	0x1cb94	648	FUNC	<unknown>	DEFAULT	2
strcoll	.symtab	0x1cb94	648	FUNC	<unknown>	DEFAULT	2
strcpy	.symtab	0x1ce84	804	FUNC	<unknown>	DEFAULT	2
strdup	.symtab	0x2201c	56	FUNC	<unknown>	DEFAULT	2
strdup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strerror_r	.symtab	0x1d5bc	284	FUNC	<unknown>	DEFAULT	2
strlen	.symtab	0x1d210	120	FUNC	<unknown>	DEFAULT	2
strncat	.symtab	0x21ecc	224	FUNC	<unknown>	DEFAULT	2
strncat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncpy	.symtab	0x1d288	248	FUNC	<unknown>	DEFAULT	2
strncpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strnlen	.symtab	0x1d380	252	FUNC	<unknown>	DEFAULT	2
strnlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strpbrk	.symtab	0x20530	80	FUNC	<unknown>	DEFAULT	2
strpbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strrchr	.symtab	0x1ca40	192	FUNC	<unknown>	DEFAULT	2
strspn	.symtab	0x21fac	112	FUNC	<unknown>	DEFAULT	2
strspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strstr	.symtab	0x1d47c	288	FUNC	<unknown>	DEFAULT	2
strstr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok	.symtab	0x1d6d8	24	FUNC	<unknown>	DEFAULT	2
strtok.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok_r	.symtab	0x204b4	124	FUNC	<unknown>	DEFAULT	2
strtok_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtol	.symtab	0x1e998	20	FUNC	<unknown>	DEFAULT	2
strtol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
system	.symtab	0x1e840	320	FUNC	<unknown>	DEFAULT	2
system.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
szprintf	.symtab	0x10ea8	84	FUNC	<unknown>	DEFAULT	2
tcgetattr	.symtab	0x1d710	112	FUNC	<unknown>	DEFAULT	2
tcgetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcpcsum	.symtab	0x13104	244	FUNC	<unknown>	DEFAULT	2
time	.symtab	0x19ae8	72	FUNC	<unknown>	DEFAULT	2
time.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tolower	.symtab	0x22ecc	36	FUNC	<unknown>	DEFAULT	2
tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
toupper	.symtab	0x19ba8	36	FUNC	<unknown>	DEFAULT	2
toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
trim	.symtab	0x10448	344	FUNC	<unknown>	DEFAULT	2
type_codes	.symtab	0x250a0	24	OBJECT	<unknown>	DEFAULT	4
type_sizes	.symtab	0x250b8	12	OBJECT	<unknown>	DEFAULT	4
uastrings	.symtab	0x3802c	47044	OBJECT	<unknown>	DEFAULT	9
unknown.1115	.symtab	0x25148	14	OBJECT	<unknown>	DEFAULT	4
unsafe_state	.symtab	0x43ad0	28	OBJECT	<unknown>	DEFAULT	9
uppercase	.symtab	0x118e0	104	FUNC	<unknown>	DEFAULT	2
usernames	.symtab	0x437f4	32	OBJECT	<unknown>	DEFAULT	9
vfork	.symtab	0x1945c	52	FUNC	<unknown>	DEFAULT	2
vfprintf	.symtab	0x19e44	148	FUNC	<unknown>	DEFAULT	2
vfprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
vsnprintf	.symtab	0x19c44	156	FUNC	<unknown>	DEFAULT	2
vsnprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wait4	.symtab	0x1f3f8	80	FUNC	<unknown>	DEFAULT	2
wait4.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
waitpid	.symtab	0x19b30	20	FUNC	<unknown>	DEFAULT	2
waitpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcrtomb	.symtab	0x1f454	72	FUNC	<unknown>	DEFAULT	2
wcrtomb.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsnrtombs	.symtab	0x1f4b8	188	FUNC	<unknown>	DEFAULT	2
wcsnrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsrtombs	.symtab	0x1f49c	28	FUNC	<unknown>	DEFAULT	2
wcsrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wildString	.symtab	0x11674	520	FUNC	<unknown>	DEFAULT	2
write	.symtab	0x19b44	76	FUNC	<unknown>	DEFAULT	2
write.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
xdigits.3071	.symtab	0x25e38	17	OBJECT	<unknown>	DEFAULT	4
zprintf	.symtab	0x10e58	80	FUNC	<unknown>	DEFAULT	2

Network Behavior

Download Network PCAP: filtered – full

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-02-18T06:32:59.765213+0100	2847180	ETPRO MALWARE ELF/BASHLITE Variant CnC Activity	1	192.168.2.23	47632	84.200.154.119	4567	TCP

Network Port Distribution

Total Packets: 229
• 4567 undefined
• 443 (HTTPS)
• 80 (HTTP)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 18, 2025 06:32:58.431329012 CET	43928	443	192.168.2.23	91.189.91.42
Feb 18, 2025 06:32:59.620126009 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:32:59.625170946 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:32:59.625241041 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:32:59.765213013 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:32:59.770056009 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:33:00.364777088 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:33:00.365349054 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:33:01.273554087 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:33:01.273713112 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:33:02.275665998 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:33:02.275839090 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:33:03.274702072 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:33:03.274843931 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:33:04.062814951 CET	42836	443	192.168.2.23	91.189.91.43
Feb 18, 2025 06:33:04.280360937 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:33:04.281222105 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:33:04.830516100 CET	42516	80	192.168.2.23	109.202.202.202
Feb 18, 2025 06:33:05.275686979 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:33:05.275873899 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:33:06.276292086 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:33:06.276530981 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:33:07.276521921 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:33:07.276710033 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:33:08.277168036 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:33:08.277631998 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:33:09.277143002 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:33:09.277383089 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:33:10.277672052 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:33:10.277894020 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:33:11.278245926 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:33:11.278517962 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:33:12.278475046 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:33:12.278629065 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:33:13.278944969 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:33:13.279107094 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:33:14.278914928 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:33:14.279335022 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:33:15.279551983 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:33:15.280073881 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:33:16.282448053 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:33:16.282685041 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:33:17.280143976 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:33:17.280324936 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:33:18.280313015 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:33:18.280437946 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:33:19.280653000 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:33:19.281037092 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:33:19.932395935 CET	43928	443	192.168.2.23	91.189.91.42
Feb 18, 2025 06:33:20.281280994 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:33:20.281554937 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:33:21.281477928 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:33:21.281661034 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:33:22.281492949 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:33:22.281644106 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:33:23.281599998 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:33:23.281908035 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:33:24.282649994 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:33:24.283066988 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:33:25.283472061 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:33:25.283798933 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:33:26.283907890 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:33:26.284236908 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:33:27.284209967 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:33:27.284703970 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:33:28.284888983 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:33:28.285152912 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:33:29.285104036 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:33:29.285573959 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:33:30.171066999 CET	42836	443	192.168.2.23	91.189.91.43
Feb 18, 2025 06:33:30.285677910 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:33:30.286020994 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:33:31.285919905 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:33:31.286318064 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:33:32.286739111 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:33:32.287306070 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:33:33.287441969 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:33:33.287785053 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:33:34.266352892 CET	42516	80	192.168.2.23	109.202.202.202
Feb 18, 2025 06:33:34.287134886 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:33:34.287384033 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:33:35.288713932 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:33:35.288857937 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:33:36.287890911 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:33:36.288063049 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:33:37.289643049 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:33:37.289786100 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:33:38.288984060 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:33:38.289235115 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:33:39.289702892 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:33:39.290002108 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:33:40.290520906 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:33:40.290713072 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:33:41.291093111 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:33:41.291364908 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:33:42.292335987 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:33:42.292716026 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:33:43.292048931 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:33:43.292356014 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:33:44.292984009 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:33:44.293211937 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:33:45.293234110 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:33:45.293457031 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:33:46.293385029 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:33:46.293718100 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:33:47.296726942 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:33:47.296947956 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:33:48.293785095 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:33:48.294085026 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:33:49.294154882 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:33:49.294430017 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:33:50.294701099 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:33:50.295018911 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:33:51.295069933 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:33:51.295223951 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:33:52.296000957 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:33:52.296293974 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:33:53.295466900 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:33:53.295586109 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:33:54.296354055 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:33:54.296467066 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:33:55.297240973 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:33:55.297363997 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:33:56.298070908 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:33:56.298263073 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:33:57.298182964 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:33:57.298310041 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:33:58.299027920 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:33:58.299264908 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:33:59.298796892 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:33:59.299004078 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:34:00.299757004 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:34:00.300071955 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:34:00.886743069 CET	43928	443	192.168.2.23	91.189.91.42
Feb 18, 2025 06:34:01.301139116 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:34:01.301539898 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:34:02.302200079 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:34:02.302439928 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:34:03.302287102 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:34:03.302462101 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:34:04.303086996 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:34:04.303303003 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:34:05.303911924 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:34:05.304130077 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:34:06.304377079 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:34:06.304586887 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:34:07.304294109 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:34:07.304512024 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:34:08.304482937 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:34:08.304824114 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:34:09.304904938 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:34:09.305167913 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:34:10.305951118 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:34:10.306442976 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:34:11.306169033 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:34:11.306323051 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:34:12.306574106 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:34:12.306900978 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:34:13.306983948 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:34:13.307290077 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:34:14.307853937 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:34:14.308118105 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:34:15.308640003 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:34:15.308814049 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:34:16.309287071 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:34:16.309545994 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:34:17.309170008 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:34:17.309429884 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:34:18.309742928 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:34:18.309943914 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:34:19.309801102 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:34:19.310213089 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:34:20.310590982 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:34:20.311069965 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:34:21.310676098 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:34:21.310842037 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:34:22.311055899 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:34:22.311580896 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:34:23.331841946 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:34:23.332169056 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:34:24.311885118 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:34:24.312074900 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:34:25.312213898 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:34:25.312414885 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:34:26.321372032 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:34:26.321710110 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:34:27.322542906 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:34:27.322906971 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:34:28.322535992 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:34:28.322941065 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:34:29.323225975 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:34:29.323430061 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:34:30.344832897 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:34:30.345279932 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:34:31.323932886 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:34:31.324305058 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:34:32.404920101 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:34:32.405282974 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:34:33.325136900 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:34:33.325305939 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:34:34.325920105 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:34:34.326191902 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:34:35.901377916 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:34:35.901427984 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:34:35.901459932 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:34:35.901772976 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:34:35.901772976 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:34:35.901772976 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:34:36.327785015 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:34:36.328088999 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:34:37.327943087 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:34:37.328227997 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:34:38.329319000 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:34:38.329793930 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:34:39.332098961 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:34:39.332501888 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:34:40.329428911 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:34:40.330132961 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:34:41.329231024 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:34:41.329555035 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:34:42.329653978 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:34:42.330020905 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:34:43.329849005 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:34:43.330065012 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:34:44.330487013 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:34:44.330800056 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:34:45.330790997 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:34:45.331170082 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:34:46.331593990 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:34:46.332120895 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:34:47.332045078 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:34:47.332566023 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:34:48.331904888 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:34:48.332307100 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:34:49.332010984 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:34:49.332262993 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:34:50.332324982 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:34:50.332742929 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:34:51.332640886 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:34:51.333059072 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:34:52.333192110 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:34:52.333584070 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:34:53.333348989 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:34:53.333758116 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:34:54.334105015 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:34:54.334472895 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:34:55.336466074 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:34:55.336884022 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:34:56.336283922 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:34:56.336772919 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:34:57.337125063 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:34:57.337665081 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:34:58.337207079 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:34:58.337727070 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:34:59.337801933 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:34:59.338203907 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:35:00.339026928 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:35:00.339207888 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:35:01.340581894 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:35:01.340984106 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:35:02.341404915 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:35:02.341820955 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:35:03.346276999 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:35:03.346554995 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:35:04.343898058 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:35:04.344233036 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:35:05.345007896 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:35:05.345392942 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:35:06.345396042 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:35:06.345807076 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:35:07.344643116 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:35:07.345005989 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:35:08.345585108 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:35:08.346127033 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:35:09.345318079 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:35:09.345848083 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:35:10.345788002 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:35:10.346168995 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:35:11.346550941 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:35:11.346708059 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:35:12.347625971 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:35:12.347929001 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:35:13.347434044 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:35:13.347858906 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:35:14.347985983 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:35:14.348351002 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:35:15.348565102 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:35:15.348934889 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:35:16.349139929 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:35:16.349452019 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:35:17.349246025 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:35:17.349569082 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:35:18.349869967 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:35:18.350213051 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:35:19.349936962 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:35:19.350364923 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:35:20.350244999 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:35:20.350532055 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:35:21.350723982 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:35:21.351206064 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:35:22.351258039 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:35:22.351571083 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:35:23.351367950 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:35:23.351788998 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:35:24.351823092 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:35:24.352226973 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:35:25.352777958 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:35:25.353276968 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:35:26.353665113 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:35:26.354017019 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:35:27.354391098 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:35:27.354556084 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:35:28.354258060 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:35:28.354687929 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:35:29.355339050 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:35:29.355465889 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:35:30.355648994 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:35:30.355921984 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:35:31.356026888 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:35:31.356304884 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:35:32.358208895 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:35:32.358485937 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:35:33.356365919 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:35:33.356590986 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:35:34.356699944 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:35:34.356990099 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:35:35.356810093 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:35:35.357019901 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:35:36.358124971 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:35:36.358421087 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:35:37.358870029 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:35:37.359293938 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:35:38.359723091 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:35:38.360150099 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:35:39.360691071 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:35:39.361155987 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:35:40.361509085 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:35:40.361880064 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:35:41.361838102 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:35:41.362020016 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:35:42.362440109 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:35:42.362637997 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:35:43.362957954 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:35:43.363023043 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:35:44.362987041 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:35:44.363049984 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:35:45.363095045 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:35:45.363325119 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:35:46.363672972 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:35:46.363893032 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:35:47.364104033 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:35:47.364375114 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:35:48.363843918 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:35:48.363964081 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:35:49.803754091 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:35:49.803813934 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:35:49.803863049 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:35:49.803968906 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:35:49.803968906 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:35:49.803968906 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:35:50.365607023 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:35:50.365902901 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:35:51.366734982 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:35:51.367054939 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:35:52.368851900 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:35:52.369323015 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:35:53.368412971 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:35:53.368699074 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:35:54.367217064 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:35:54.367377043 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:35:55.368237019 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:35:55.368742943 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:35:56.368755102 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:35:56.369057894 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:35:57.369565010 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:35:57.369920969 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:35:58.369890928 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:35:58.370176077 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:35:59.370054960 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:35:59.370367050 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:36:00.370270967 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:36:00.370553017 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:36:01.370939970 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:36:01.371150017 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:36:02.371504068 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:36:02.371802092 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:36:03.371665001 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:36:03.371872902 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:36:04.372054100 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:36:04.372546911 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:36:05.372623920 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:36:05.372821093 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:36:06.372991085 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:36:06.373130083 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:36:07.373604059 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:36:07.373701096 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:36:08.373919010 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:36:08.374089956 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:36:09.374247074 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:36:09.374397993 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:36:10.375531912 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:36:10.375736952 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:36:11.376898050 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:36:11.377075911 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:36:12.376610041 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:36:12.376754999 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:36:13.382091045 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:36:13.382272005 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:36:14.377202034 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:36:14.377361059 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:36:15.377846003 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:36:15.378153086 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:36:16.378343105 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:36:16.378626108 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:36:17.378606081 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:36:17.378921986 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:36:18.379053116 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:36:18.379188061 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:36:19.379508972 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:36:19.379997969 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:36:20.379753113 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:36:20.380045891 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:36:21.380867004 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:36:21.381005049 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:36:22.380474091 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:36:22.380589962 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:36:23.382301092 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:36:23.382502079 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:36:24.388386011 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:36:24.388509035 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:36:25.383009911 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:36:25.383255959 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:36:26.383930922 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:36:26.384207964 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:36:27.386400938 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:36:27.386693954 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:36:28.391621113 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:36:28.391908884 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:36:29.384233952 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:36:29.384480953 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:36:30.385122061 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:36:30.385386944 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:36:31.384957075 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:36:31.385287046 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:36:32.385725975 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:36:32.385880947 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:36:33.387378931 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:36:33.387466908 CET	47632	4567	192.168.2.23	84.200.154.119
Feb 18, 2025 06:36:34.385642052 CET	4567	47632	84.200.154.119	192.168.2.23
Feb 18, 2025 06:36:34.385818958 CET	47632	4567	192.168.2.23	84.200.154.119

System Behavior

Analysis Process: sh.elf PID: 6242, Parent PID: 6166

General

Start time (UTC):	05:32:58
Start date (UTC):	18/02/2025
Path:	/tmp/sh.elf
Arguments:	/tmp/sh.elf
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

File Activities

File Opened

File Deleted

File Read

File Written

Process Activities

Process Forked

Prctl Requested

Thread Sleep

System Activities

Query System Information (uname)

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: sh.elf PID: 6244, Parent PID: 6242

General

Start time (UTC):	05:32:58
Start date (UTC):	18/02/2025
Path:	/tmp/sh.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Process Activities

Process Forked

Thread Sleep

Chronological Activities

Analysis Process: sh.elf PID: 6246, Parent PID: 6244

General

Start time (UTC):	05:32:58
Start date (UTC):	18/02/2025
Path:	/tmp/sh.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping or `net view` using Net .
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report sh.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Threatname: Gafgyt

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.QrTuxa (deleted)

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: sh.elf PID: 6242, Parent PID: 6166

General

File Activities

File Opened

File Deleted

File Read

File Written

Process Activities

Process Forked

Prctl Requested

Thread Sleep

System Activities

Query System Information (uname)

Network Activities

Socket Connecting

Linux Analysis Report
sh.elf