Edit tour

Linux Analysis Report
hidakibest.ppc.elf

Overview

General Information

Sample name:	hidakibest.ppc.elf
Analysis ID:	1624018
MD5:	3d144871e5d0506cf25f0595a89edf03
SHA1:	5218e78f7593d6a6a79753c65506ed18750ded14
SHA256:	b0924575cadc66f65bba6f383cb0dd0093680b9e87a262b806322c8fbb3b11a7
Tags:	elfuser-abuse_ch
Infos:

Detection

Gafgyt, Mirai

Score:	92
Range:	0 - 100

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Gafgyt

Yara detected Mirai

Opens /proc/net/* files useful for finding connected devices and routers

Detected TCP or UDP traffic on non-standard ports

Executes the "rm" command used to delete files or directories

Sample contains strings that are user agent strings indicative of HTTP manipulation

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1624018
Start date and time:	2025-02-25 18:58:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	hidakibest.ppc.elf
Detection:	MAL
Classification:	mal92.spre.troj.linELF@0/1@2/0

Warnings

VT rate limit hit for: 44.210.138.111:4258

Runtime Messages

Command:	/tmp/hidakibest.ppc.elf
PID:	5541
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

hidakibest.ppc.elf (PID: 5541, Parent: 5461, MD5: ae65271c943d3451b7f026d1fadccea6) Arguments: /tmp/hidakibest.ppc.elf

hidakibest.ppc.elf New Fork (PID: 5543, Parent: 5541)

hidakibest.ppc.elf New Fork (PID: 5545, Parent: 5543)

dash New Fork (PID: 5575, Parent: 3671)

rm (PID: 5575, Parent: 3671, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.oT8oZwPOQP /tmp/tmp.dRWZa8bK2T /tmp/tmp.JndOZQ6O2H

dash New Fork (PID: 5576, Parent: 3671)

rm (PID: 5576, Parent: 3671, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.oT8oZwPOQP /tmp/tmp.dRWZa8bK2T /tmp/tmp.JndOZQ6O2H

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
hidakibest.ppc.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
hidakibest.ppc.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
hidakibest.ppc.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x11788:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1179c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x117b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x117c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x117d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x117ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11800:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11814:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11828:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1183c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11850:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11864:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11878:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1188c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11904:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11918:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
hidakibest.ppc.elf	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x11738:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64

Memory Dumps

Source	Rule	Description	Author	Strings
5543.1.00007f3738001000.00007f3738015000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
5543.1.00007f3738001000.00007f3738015000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5543.1.00007f3738001000.00007f3738015000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x11788:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1179c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x117b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x117c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x117d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x117ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11800:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11814:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11828:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1183c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11850:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11864:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11878:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1188c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11904:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11918:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5543.1.00007f3738001000.00007f3738015000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x11738:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
5541.1.00007f3738001000.00007f3738015000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
5541.1.00007f3738001000.00007f3738015000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5541.1.00007f3738001000.00007f3738015000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x11788:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1179c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x117b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x117c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x117d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x117ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11800:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11814:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11828:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1183c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11850:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11864:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11878:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1188c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11904:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11918:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5541.1.00007f3738001000.00007f3738015000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x11738:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: hidakibest.ppc.elf PID: 5541	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: hidakibest.ppc.elf PID: 5541	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x3940:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3954:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3968:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x397c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3990:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x39a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x39b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x39cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x39e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x39f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3a08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3a1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3a30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3a44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3a58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3a6c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3a80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3a94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3aa8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3abc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3ad0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: hidakibest.ppc.elf PID: 5541	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x38f3:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x3d65:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: hidakibest.ppc.elf PID: 5543	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: hidakibest.ppc.elf PID: 5543	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x3e60:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3e74:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3e88:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3e9c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3eb0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3ec4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3ed8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3eec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3f00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3f14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3f28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3f3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3f50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3f64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3f78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3f8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3fa0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3fb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3fc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3fdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3ff0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: hidakibest.ppc.elf PID: 5543	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x3e13:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x4285:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Click to see the 9 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

• AV Detection
• Spreading
• Networking
• System Summary
• Persistence and Installation Behavior
• Malware Analysis System Evasion
• Stealing of Sensitive Information
• Remote Access Functionality

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: hidakibest.ppc.elf

Avira: detected

Found malware configuration

Source: hidakibest.ppc.elf

Malware Configuration Extractor: Gafgyt {"C2 url": "44.210.138.111:4258"}

Multi AV Scanner detection for submitted file

Source: hidakibest.ppc.elf	Virustotal: Detection: 63%			Perma Link
Source: hidakibest.ppc.elf	ReversingLabs: Detection: 65%

Spreading

Opens /proc/net/* files useful for finding connected devices and routers

Source: /tmp/hidakibest.ppc.elf (PID: 5541)

Opens: /proc/net/route

Jump to behavior

Source: global traffic

TCP traffic: 192.168.2.15:33888 -> 44.210.138.111:4258

Source: unknown	TCP traffic detected without corresponding DNS query: 34.254.182.186
Source: unknown	TCP traffic detected without corresponding DNS query: 34.254.182.186
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

Source: hidakibest.ppc.elf	String found in binary or memory: http://fast.no/support/crawler.asp)
Source: hidakibest.ppc.elf	String found in binary or memory: http://feedback.redkolibri.com/
Source: hidakibest.ppc.elf	String found in binary or memory: http://www.baidu.com/search/spider.htm)
Source: hidakibest.ppc.elf	String found in binary or memory: http://www.baidu.com/search/spider.html)
Source: hidakibest.ppc.elf	String found in binary or memory: http://www.billybobbot.com/crawler/)

Source: unknown	Network traffic detected: HTTP traffic on port 44522 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 44522

System Summary

Malicious sample detected (through community Yara rule)

Source: hidakibest.ppc.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: hidakibest.ppc.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5543.1.00007f3738001000.00007f3738015000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5543.1.00007f3738001000.00007f3738015000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5541.1.00007f3738001000.00007f3738015000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5541.1.00007f3738001000.00007f3738015000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: hidakibest.ppc.elf PID: 5541, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: hidakibest.ppc.elf PID: 5541, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: hidakibest.ppc.elf PID: 5543, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: hidakibest.ppc.elf PID: 5543, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown

Source: hidakibest.ppc.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: hidakibest.ppc.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5543.1.00007f3738001000.00007f3738015000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5543.1.00007f3738001000.00007f3738015000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5541.1.00007f3738001000.00007f3738015000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5541.1.00007f3738001000.00007f3738015000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: hidakibest.ppc.elf PID: 5541, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: hidakibest.ppc.elf PID: 5541, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: hidakibest.ppc.elf PID: 5543, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: hidakibest.ppc.elf PID: 5543, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16

Source: classification engine

Classification label: mal92.spre.troj.linELF@0/1@2/0

Source: /usr/bin/dash (PID: 5575)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.oT8oZwPOQP /tmp/tmp.dRWZa8bK2T /tmp/tmp.JndOZQ6O2H			Jump to behavior
Source: /usr/bin/dash (PID: 5576)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.oT8oZwPOQP /tmp/tmp.dRWZa8bK2T /tmp/tmp.JndOZQ6O2H			Jump to behavior

Source: /tmp/hidakibest.ppc.elf (PID: 5541)

Queries kernel information via 'uname':

Jump to behavior

Source: hidakibest.ppc.elf, 5541.1.00005562a215b000.00005562a220b000.rw-.sdmp, hidakibest.ppc.elf, 5543.1.00005562a215b000.00005562a220b000.rw-.sdmp	Binary or memory string: !/etc/qemu-binfmt/ppc11!hotpluggableq
Source: hidakibest.ppc.elf, 5541.1.00007fff8c2ca000.00007fff8c2eb000.rw-.sdmp, hidakibest.ppc.elf, 5543.1.00007fff8c2ca000.00007fff8c2eb000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-ppc/tmp/hidakibest.ppc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/hidakibest.ppc.elf
Source: hidakibest.ppc.elf, 5541.1.00007fff8c2ca000.00007fff8c2eb000.rw-.sdmp	Binary or memory string: bU/tmp/qemu-open.tp5nA9\$
Source: hidakibest.ppc.elf, 5541.1.00005562a215b000.00005562a220b000.rw-.sdmp, hidakibest.ppc.elf, 5543.1.00005562a215b000.00005562a220b000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/ppc
Source: hidakibest.ppc.elf, 5541.1.00007fff8c2ca000.00007fff8c2eb000.rw-.sdmp, hidakibest.ppc.elf, 5543.1.00007fff8c2ca000.00007fff8c2eb000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-ppc
Source: hidakibest.ppc.elf, 5541.1.00007fff8c2ca000.00007fff8c2eb000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.tp5nA9

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match	File source: hidakibest.ppc.elf, type: SAMPLE
Source: Yara match	File source: 5543.1.00007f3738001000.00007f3738015000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5541.1.00007f3738001000.00007f3738015000.r-x.sdmp, type: MEMORY

Yara detected Mirai

Source: Yara match	File source: hidakibest.ppc.elf, type: SAMPLE
Source: Yara match	File source: 5543.1.00007f3738001000.00007f3738015000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5541.1.00007f3738001000.00007f3738015000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: hidakibest.ppc.elf PID: 5541, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: hidakibest.ppc.elf PID: 5543, type: MEMORYSTR

Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36
Source: Initial sample	User agent string found: Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; rv:2.2) Gecko/20110201
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.2; U; ru) Presto/2.5.22 Version/10.51
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko
Source: Initial sample	User agent string found: Mozilla/5.0 (Android; Linux armv7l; rv:9.0) Gecko/20111216 Firefox/9.0 Fennec/9.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60
Source: Initial sample	User agent string found: Mozilla/5.0 (iPad; U; CPU OS 5_1 like Mac OS X) AppleWebKit/531.21.10 (KHTML, like Gecko) Version/4.0.4 Mobile/7B367 Safari/531.21.10 UCBrowser/3.4.3.532
Source: Initial sample	User agent string found: Mozilla/5.0 (Nintendo WiiU) AppleWebKit/536.30 (KHTML, like Gecko) NX/3.0.4.2.12 NintendoBrowser/4.3.1.11264.US
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:25.0) Gecko/20100101 Firefox/25.0
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; pl) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; en) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; ja) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; cn) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; fr) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20100101 Firefox/12.0
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; U; Linux x86_64; de; rv:1.9.2.8) Gecko/20100723 Ubuntu/10.04 (lucid) Firefox/3.6.8
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; rv:13.0) Gecko/20100101 Firefox/13.0.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:11.0) Gecko/20100101 Firefox/11.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:13.0) Gecko/20100101 Firefox/13.0.1
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.289 Version/12.01
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.02
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.0) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.112 Safari/535.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36

Remote Access Functionality

Yara detected Gafgyt

Source: Yara match	File source: hidakibest.ppc.elf, type: SAMPLE
Source: Yara match	File source: 5543.1.00007f3738001000.00007f3738015000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5541.1.00007f3738001000.00007f3738015000.r-x.sdmp, type: MEMORY

Yara detected Mirai

Source: Yara match	File source: hidakibest.ppc.elf, type: SAMPLE
Source: Yara match	File source: 5543.1.00007f3738001000.00007f3738015000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5541.1.00007f3738001000.00007f3738015000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: hidakibest.ppc.elf PID: 5541, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: hidakibest.ppc.elf PID: 5543, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 File Deletion	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	1 Remote System Discovery	Remote Desktop Protocol	Data from Removable Media	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	2 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact

Malware Configuration

Threatname: Gafgyt

{
  "C2 url": "44.210.138.111:4258"
}

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
hidakibest.ppc.elf	63%	Virustotal		Browse
hidakibest.ppc.elf	66%	ReversingLabs	Linux.Trojan.Mirai
hidakibest.ppc.elf	100%	Avira	EXP/ELF.Mirai.Z.A

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
44.210.138.111:4258	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.25	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
44.210.138.111:4258	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://www.baidu.com/search/spider.html)	hidakibest.ppc.elf	false	high
http://www.billybobbot.com/crawler/)	hidakibest.ppc.elf	false	high
http://fast.no/support/crawler.asp)	hidakibest.ppc.elf	false	high
http://feedback.redkolibri.com/	hidakibest.ppc.elf	false	high
http://www.baidu.com/search/spider.htm)	hidakibest.ppc.elf	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
44.210.138.111	unknown	United States		14618	AMAZON-AESUS	true
34.254.182.186	unknown	United States		16509	AMAZON-02US	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
34.254.182.186	main_arm7.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	rebirth.ppc.elf	Get hash	malicious	Gafgyt	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	jackmyi686.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	rebirth.arm6.elf	Get hash	malicious	Gafgyt	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse
	armv7l.elf	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	arm.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	aarch64.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	nshkarm6.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	i686.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	mips.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	aarch64.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	sh4.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	res.arm6.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	mpsl.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	spc.elf	Get hash	malicious	Unknown	Browse	162.213.35.25

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	lNV3432.eml	Get hash	malicious	HTMLPhisher	Browse	18.245.33.131
	res.mips.elf	Get hash	malicious	Unknown	Browse	13.248.177.203
	res.x86.elf	Get hash	malicious	Unknown	Browse	34.208.10.217
	nshkarm6.elf	Get hash	malicious	Unknown	Browse	54.217.10.153
	res.sh4.elf	Get hash	malicious	Unknown	Browse	35.163.158.245
	SecuriteInfo.com.Win32.AdwareX-gen.9554.24737.exe	Get hash	malicious	XWorm	Browse	185.166.143.49
	https://docs.google.com/presentation/d/e/2PACX-1vS-nN7hyacCYt95zNulla0L9qX2DSAc5P5i0gxMOo_AM5wUPw1qtPfPGfFm-j95A08CW22rEIA_1zoH/pub?start=false&loop=false&delayms=1000	Get hash	malicious	HTMLPhisher	Browse	52.209.153.220
	na.elf	Get hash	malicious	Prometei	Browse	54.171.230.55
	res.arm.elf	Get hash	malicious	Unknown	Browse	15.206.235.145
	res.arm5.elf	Get hash	malicious	Unknown	Browse	52.211.188.133
AMAZON-AESUS	lNV3432.eml	Get hash	malicious	HTMLPhisher	Browse	54.84.150.176
	res.mpsl.elf	Get hash	malicious	Unknown	Browse	54.12.172.167
	res.mips.elf	Get hash	malicious	Unknown	Browse	52.54.231.195
	res.x86.elf	Get hash	malicious	Unknown	Browse	54.14.53.243
	https://docs.google.com/presentation/d/e/2PACX-1vS-nN7hyacCYt95zNulla0L9qX2DSAc5P5i0gxMOo_AM5wUPw1qtPfPGfFm-j95A08CW22rEIA_1zoH/pub?start=false&loop=false&delayms=1000	Get hash	malicious	HTMLPhisher	Browse	3.222.198.39
	res.arm5.elf	Get hash	malicious	Unknown	Browse	54.62.178.244
	res.spc.elf	Get hash	malicious	Unknown	Browse	54.31.32.226
	res.m68k.elf	Get hash	malicious	Unknown	Browse	52.7.125.150
	https://gamma.app/docs/Youve-received-a-new-PDF-Document--99mhwi81xduj4p7	Get hash	malicious	Gabagool	Browse	3.227.132.178
	http://lbhgcbtrk.giftrend.click/index.php?search=4&d154740&wcndf=302-5980&lm=274498GZOL251&sd=9&page=bz4MJnHq0VrSYgU	Get hash	malicious	Phisher	Browse	52.207.17.54

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/tmp/qemu-open.tp5nA9 (deleted)

Download File

Process:	/tmp/hidakibest.ppc.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	230
Entropy (8bit):	3.709552666863289
Encrypted:	false
SSDEEP:	6:iekrEcvwAsE5KlwSd4pzKaV6Lpms/a/1VCxGF:ur+m5MwSdIKaV6L1adVRF
MD5:	2E667F43AE18CD1FE3C108641708A82C
SHA1:	12B90DE2DA0FBCFE66F3D6130905E56C8D6A68D3
SHA-256:	6F721492E7A337C5B498A8F55F5EB7AC745AFF716D0B5B08EFF2C1B6B250F983
SHA-512:	D2A0EE2509154EC1098994F38BE172F98F4150399C534A04D5C675D7C05630802225019F19344CC9070C576BC465A4FEB382AC7712DE6BF25E9244B54A9DB830
Malicious:	false
Reputation:	high, very likely benign file
Preview:	Iface.Destination.Gateway .Flags.RefCnt.Use.Metric.Mask..MTU.Window.IRTT .ens160.00000000.c0a80201.0003.0.0.0.00000000.0.0.0.ens160.c0a80200.00000000.0001.0.0.0.ffffff00.0.0.0.

Static File Info

General

File type:	ELF 32-bit MSB executable, PowerPC or cisco 4500, version 1 (SYSV), statically linked, not stripped
Entropy (8bit):	6.152438662491137
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	hidakibest.ppc.elf
File size:	108'983 bytes
MD5:	3d144871e5d0506cf25f0595a89edf03
SHA1:	5218e78f7593d6a6a79753c65506ed18750ded14
SHA256:	b0924575cadc66f65bba6f383cb0dd0093680b9e87a262b806322c8fbb3b11a7
SHA512:	ea747dd58458ddec3bf5d0e1dbe2825dc872076e34c658de5504e7d085cbf3a7540fa96cc59a2daef424cae97b61c30e48e3a57a9f8362f58b4fcccd1890d374
SSDEEP:	3072:gQiBqcL95J6qEWLE3Sv5h7wLYm7ArEfT3n:gQiBClWLL5hkEm7ArEfT3n
TLSH:	9DB34C03A3190F43D5CB49B02DEB27F143AAE9E112B36182A61EAF9457B37791153FC6
File Content Preview:	.ELF...........................4..O......4. ...(......................>h..>h..............@...@...@.......t...............@T..@T..@T................dt.Q.............................!..\|......$H...H......$8!. \|...N.. .!..\|.......?.........D,..../...@..`= .

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	PowerPC
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x10000218
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	4
Section Header Offset:	85932
Section Header Size:	40
Number of Section Headers:	19
Header String Table Index:	16

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x100000b4	0xb4	0x24	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x100000d8	0xd8	0xfa1c	0x0	0x6	AX	0	0	4
.fini	PROGBITS	0x1000faf4	0xfaf4	0x20	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x1000fb18	0xfb18	0x4350	0x0	0x2	A	0	0	8
.eh_frame	PROGBITS	0x10024000	0x14000	0x54	0x0	0x3	WA	0	0	4
.tbss	NOBITS	0x10024054	0x14054	0x8	0x0	0x403	WAT	0	0	4
.ctors	PROGBITS	0x10024054	0x14054	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x1002405c	0x1405c	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x10024064	0x14064	0x4	0x0	0x3	WA	0	0	4
.data	PROGBITS	0x10024068	0x14068	0x2c2	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x1002432c	0x1432c	0x10	0x4	0x7	WAX	0	0	4
.sdata	PROGBITS	0x1002433c	0x1433c	0x56	0x0	0x3	WA	0	0	4
.sbss	NOBITS	0x10024398	0x14392	0x94	0x0	0x3	WA	0	0	8
.bss	NOBITS	0x1002442c	0x14392	0x708c	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x14392	0xb9a	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x14f2c	0x7e	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x152a4	0x30e0	0x10	0x0		18	281	4
.strtab	STRTAB	0x0	0x18384	0x2633	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x10000000	0x10000000	0x13e68	0x13e68	6.2418	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x14000	0x10024000	0x10024000	0x392	0x74b8	4.5409	0x7	RWE	0x10000	.eh_frame .tbss .ctors .dtors .jcr .data .got .sdata .sbss .bss
TLS	0x14054	0x10024054	0x10024054	0x0	0x8	0.0000	0x4	R	0x4	.tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x100000b4	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x100000d8	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x1000faf4	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x1000fb18	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x10024000	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x10024054	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x10024054	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x1002405c	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x10024064	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x10024068	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x1002432c	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x1002433c	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x10024398	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x1002442c	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
C.3.5322	.symtab	0x100139dc	12	OBJECT	<unknown>	DEFAULT	4
C.3.6030	.symtab	0x10012980	12	OBJECT	<unknown>	DEFAULT	4
C.3.6052	.symtab	0x10013d24	12	OBJECT	<unknown>	DEFAULT	4
C.3.6106	.symtab	0x10013d18	12	OBJECT	<unknown>	DEFAULT	4
C.4.5416	.symtab	0x10013d00	24	OBJECT	<unknown>	DEFAULT	4
C.4.6053	.symtab	0x10013d30	12	OBJECT	<unknown>	DEFAULT	4
C.6.6061	.symtab	0x10013d3c	12	OBJECT	<unknown>	DEFAULT	4
C.69.5522	.symtab	0x100111e0	104	OBJECT	<unknown>	DEFAULT	4
C.7.5462	.symtab	0x100139e8	12	OBJECT	<unknown>	DEFAULT	4
C.76.5621	.symtab	0x10011e74	1128	OBJECT	<unknown>	DEFAULT	4
Q	.symtab	0x10024448	16384	OBJECT	<unknown>	DEFAULT	14
Randhex	.symtab	0x100022a4	424	FUNC	<unknown>	DEFAULT	2
SendSTD	.symtab	0x10001e64	424	FUNC	<unknown>	DEFAULT	2
UDPRAW	.symtab	0x10002158	332	FUNC	<unknown>	DEFAULT	2
_Exit	.symtab	0x100047b8	92	FUNC	<unknown>	DEFAULT	2
_GLOBAL_OFFSET_TABLE_	.symtab	0x10024330	0	OBJECT	<unknown>	HIDDEN	11
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_SDA_BASE_	.symtab	0x1002c33c	0	NOTYPE	<unknown>	DEFAULT	12
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x10024058	0	OBJECT	<unknown>	DEFAULT	7
__CTOR_LIST__	.symtab	0x10024054	0	OBJECT	<unknown>	DEFAULT	7
__C_ctype_b	.symtab	0x10024348	4	OBJECT	<unknown>	DEFAULT	12
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x10012380	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x10024368	4	OBJECT	<unknown>	DEFAULT	12
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x100139fe	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x10024350	4	OBJECT	<unknown>	DEFAULT	12
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x10012680	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x10024060	0	OBJECT	<unknown>	DEFAULT	8
__DTOR_LIST__	.symtab	0x1002405c	0	OBJECT	<unknown>	DEFAULT	8
__EH_FRAME_BEGIN__	.symtab	0x10024000	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x10024050	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x10024348	4	OBJECT	<unknown>	HIDDEN	12
__GI___C_ctype_tolower	.symtab	0x10024368	4	OBJECT	<unknown>	HIDDEN	12
__GI___C_ctype_toupper	.symtab	0x10024350	4	OBJECT	<unknown>	HIDDEN	12
__GI___close	.symtab	0x10008da8	116	FUNC	<unknown>	HIDDEN	2
__GI___close_nocancel	.symtab	0x10008db4	16	FUNC	<unknown>	HIDDEN	2
__GI___ctype_b	.symtab	0x1002434c	4	OBJECT	<unknown>	HIDDEN	12
__GI___ctype_tolower	.symtab	0x1002436c	4	OBJECT	<unknown>	HIDDEN	12
__GI___ctype_toupper	.symtab	0x10024354	4	OBJECT	<unknown>	HIDDEN	12
__GI___errno_location	.symtab	0x100049b4	20	FUNC	<unknown>	HIDDEN	2
__GI___fcntl_nocancel	.symtab	0x10004658	116	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x1000bcc0	312	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x100062c4	48	FUNC	<unknown>	HIDDEN	2
__GI___libc_close	.symtab	0x10008da8	116	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x100046cc	236	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x10008e1c	132	FUNC	<unknown>	HIDDEN	2
__GI___libc_read	.symtab	0x10008f24	132	FUNC	<unknown>	HIDDEN	2
__GI___libc_waitpid	.symtab	0x10008fa8	132	FUNC	<unknown>	HIDDEN	2
__GI___libc_write	.symtab	0x10008ea0	132	FUNC	<unknown>	HIDDEN	2
__GI___open	.symtab	0x10008e1c	132	FUNC	<unknown>	HIDDEN	2
__GI___open_nocancel	.symtab	0x10008e28	16	FUNC	<unknown>	HIDDEN	2
__GI___read	.symtab	0x10008f24	132	FUNC	<unknown>	HIDDEN	2
__GI___read_nocancel	.symtab	0x10008f30	16	FUNC	<unknown>	HIDDEN	2
__GI___register_atfork	.symtab	0x100089dc	356	FUNC	<unknown>	HIDDEN	2
__GI___sigaddset	.symtab	0x10006bac	40	FUNC	<unknown>	HIDDEN	2
__GI___sigdelset	.symtab	0x10006bd4	40	FUNC	<unknown>	HIDDEN	2
__GI___sigismember	.symtab	0x10006b84	40	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x100091a8	144	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x10009298	100	FUNC	<unknown>	HIDDEN	2
__GI___waitpid	.symtab	0x10008fa8	132	FUNC	<unknown>	HIDDEN	2
__GI___write	.symtab	0x10008ea0	132	FUNC	<unknown>	HIDDEN	2
__GI___write_nocancel	.symtab	0x10008eac	16	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x100062f4	284	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x100047b8	92	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x10007a4c	248	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x10008064	12	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x1000d06c	52	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0x10004814	52	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x10008da8	116	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0x10009928	212	FUNC	<unknown>	HIDDEN	2
__GI_config_close	.symtab	0x1000a034	80	FUNC	<unknown>	HIDDEN	2
__GI_config_open	.symtab	0x1000a084	84	FUNC	<unknown>	HIDDEN	2
__GI_config_read	.symtab	0x10009d00	820	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x10006814	120	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x10008230	136	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x1000a200	640	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x100046cc	236	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x1000b9d8	744	FUNC	<unknown>	HIDDEN	2
__GI_fgetc	.symtab	0x1000b598	304	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x1000bcc0	312	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x1000b6c8	244	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x1000bdf8	196	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x1000a480	12	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x10008670	824	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x10005cac	92	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x1000d48c	16	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x1000d49c	404	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x1000d0d4	124	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x10005d08	192	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x1000bcc0	312	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x10009668	56	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x100096a0	16	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x100096b0	16	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x100096c0	16	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname	.symtab	0x10006790	8	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2	.symtab	0x10006798	72	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2_r	.symtab	0x1000c574	664	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x1000ef7c	748	FUNC	<unknown>	HIDDEN	2
__GI_gethostname	.symtab	0x1000f2c0	136	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x100096d0	28	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x10008b40	56	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x100096ec	52	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x1000688c	52	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x10009720	16	FUNC	<unknown>	HIDDEN	2
__GI_htonl	.symtab	0x100066a4	4	FUNC	<unknown>	HIDDEN	2
__GI_htons	.symtab	0x100066a8	4	FUNC	<unknown>	HIDDEN	2
__GI_inet_addr	.symtab	0x1000675c	52	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x1000c4a4	208	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa	.symtab	0x10006728	52	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa_r	.symtab	0x100066ac	124	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x1000df84	728	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x1000dc24	524	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x10007e98	236	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x10004574	228	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x1000c478	44	FUNC	<unknown>	HIDDEN	2
__GI_isspace	.symtab	0x1000497c	24	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x10004848	52	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x1000f4a4	112	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x1000bf60	264	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x10005dc8	156	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x1000bebc	164	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x1000c068	52	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x1000c09c	244	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x10005e64	144	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x10009730	52	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x1000d150	52	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x10009764	52	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x100097cc	112	FUNC	<unknown>	HIDDEN	2
__GI_ntohl	.symtab	0x1000669c	4	FUNC	<unknown>	HIDDEN	2
__GI_ntohs	.symtab	0x100066a0	4	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x10008e1c	132	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0x10009ab4	208	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x1000f37c	120	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x10008b78	148	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x10007b48	104	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x10007d18	140	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x1000d9d4	184	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x10008f24	132	FUNC	<unknown>	HIDDEN	2
__GI_readdir64	.symtab	0x10009c3c	196	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x10006928	128	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x1000983c	116	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x100048b0	136	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x100069dc	128	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x10004938	52	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x10006a5c	52	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x10007f84	224	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x1000c80c	36	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x10006ac4	192	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x100098b0	120	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x10008c0c	292	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x10006a90	52	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x100049c8	136	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x10007da4	244	FUNC	<unknown>	HIDDEN	2
__GI_stat	.symtab	0x1000f3f4	124	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x1000642c	80	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x10005ef4	256	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul	.symtab	0x1000c190	248	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x10005ff4	52	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x10005ff4	52	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x10006028	32	FUNC	<unknown>	HIDDEN	2
__GI_strcspn	.symtab	0x1000c288	96	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x1000f514	80	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x10006048	160	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x1000da8c	188	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x100060e8	236	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x1000c43c	60	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x1000c2e8	112	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x1000c358	72	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x100061d4	240	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x1000647c	12	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x1000c3a0	156	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x10008070	8	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x10008400	624	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x10006488	156	FUNC	<unknown>	HIDDEN	2
__GI_tcsetattr	.symtab	0x10006524	376	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x1000496c	16	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x10004994	32	FUNC	<unknown>	HIDDEN	2
__GI_uname	.symtab	0x1000f470	52	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x10004a50	224	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x10008fa8	132	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x1000a0d8	92	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x1000a144	188	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x1000a134	16	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x10008ea0	132	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x10024064	0	OBJECT	<unknown>	DEFAULT	9
__JCR_LIST__	.symtab	0x10024064	0	OBJECT	<unknown>	DEFAULT	9
__app_fini	.symtab	0x100243dc	4	OBJECT	<unknown>	HIDDEN	13
__atexit_lock	.symtab	0x10024244	24	OBJECT	<unknown>	DEFAULT	10
__bss_start	.symtab	0x10024392	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x10009238	96	FUNC	<unknown>	DEFAULT	2
__close	.symtab	0x10008da8	116	FUNC	<unknown>	DEFAULT	2
__close_nameservers	.symtab	0x1000ee94	144	FUNC	<unknown>	HIDDEN	2
__close_nocancel	.symtab	0x10008db4	16	FUNC	<unknown>	DEFAULT	2
__ctype_b	.symtab	0x1002434c	4	OBJECT	<unknown>	DEFAULT	12
__ctype_tolower	.symtab	0x1002436c	4	OBJECT	<unknown>	DEFAULT	12
__ctype_toupper	.symtab	0x10024354	4	OBJECT	<unknown>	DEFAULT	12
__curbrk	.symtab	0x10024414	4	OBJECT	<unknown>	DEFAULT	13
__data_start	.symtab	0x10024070	0	NOTYPE	<unknown>	DEFAULT	10
__decode_dotted	.symtab	0x1000e25c	280	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x1000f64c	188	FUNC	<unknown>	HIDDEN	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__dns_lookup	.symtab	0x1000e374	1672	FUNC	<unknown>	HIDDEN	2
__do_global_ctors_aux	.symtab	0x1000fa88	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x100000d8	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x10024068	0	OBJECT	<unknown>	HIDDEN	10
__encode_dotted	.symtab	0x1000f9bc	204	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x1000f564	232	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x1000f708	124	FUNC	<unknown>	HIDDEN	2
__environ	.symtab	0x100243d4	4	OBJECT	<unknown>	DEFAULT	13
__errno_location	.symtab	0x100049b4	20	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x100243c0	4	OBJECT	<unknown>	HIDDEN	13
__fcntl_nocancel	.symtab	0x10004658	116	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x1000bcc0	312	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x10024054	0	NOTYPE	<unknown>	HIDDEN	6
__fini_array_start	.symtab	0x10024054	0	NOTYPE	<unknown>	HIDDEN	6
__fork	.symtab	0x10008670	824	FUNC	<unknown>	DEFAULT	2
__fork_generation_pointer	.symtab	0x100243c4	4	OBJECT	<unknown>	HIDDEN	13
__fork_handlers	.symtab	0x100243c8	4	OBJECT	<unknown>	HIDDEN	13
__fork_lock	.symtab	0x100243cc	4	OBJECT	<unknown>	HIDDEN	13
__get_hosts_byname_r	.symtab	0x1000ef24	88	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x1000d334	344	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x100096d0	28	FUNC	<unknown>	DEFAULT	2
__getpid	.symtab	0x10008b40	56	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x100062c4	48	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__h_errno_location	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__init_array_end	.symtab	0x10024054	0	NOTYPE	<unknown>	HIDDEN	6
__init_array_start	.symtab	0x10024054	0	NOTYPE	<unknown>	HIDDEN	6
__libc_close	.symtab	0x10008da8	116	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x10006814	120	FUNC	<unknown>	DEFAULT	2
__libc_disable_asynccancel	.symtab	0x1000902c	124	FUNC	<unknown>	HIDDEN	2
__libc_enable_asynccancel	.symtab	0x100090a8	172	FUNC	<unknown>	HIDDEN	2
__libc_errno	.symtab	0x0	4	TLS	<unknown>	HIDDEN	6
__libc_fcntl	.symtab	0x100046cc	236	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x10008670	824	FUNC	<unknown>	DEFAULT	2
__libc_h_errno	.symtab	0x4	4	TLS	<unknown>	HIDDEN	6
__libc_nanosleep	.symtab	0x100097cc	112	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x10008e1c	132	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x10008f24	132	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x10006928	128	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x100048b0	136	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x100069dc	128	FUNC	<unknown>	DEFAULT	2
__libc_setup_tls	.symtab	0x1000cd5c	464	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x1000c80c	36	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x100243d0	4	OBJECT	<unknown>	DEFAULT	13
__libc_waitpid	.symtab	0x10008fa8	132	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x10008ea0	132	FUNC	<unknown>	DEFAULT	2
__linkin_atfork	.symtab	0x100089a8	52	FUNC	<unknown>	HIDDEN	2
__lll_lock_wait_private	.symtab	0x10008d30	120	FUNC	<unknown>	HIDDEN	2
__local_nameserver	.symtab	0x10013df0	16	OBJECT	<unknown>	HIDDEN	4
__malloc_consolidate	.symtab	0x10007634	460	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x10006bfc	112	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x10024168	24	OBJECT	<unknown>	DEFAULT	10
__malloc_state	.symtab	0x1002b140	888	OBJECT	<unknown>	DEFAULT	14
__malloc_trim	.symtab	0x1000757c	184	FUNC	<unknown>	DEFAULT	2
__nameserver	.symtab	0x10024420	4	OBJECT	<unknown>	HIDDEN	13
__nameservers	.symtab	0x10024424	4	OBJECT	<unknown>	HIDDEN	13
__nptl_deallocate_tsd	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__nptl_nthreads	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__open	.symtab	0x10008e1c	132	FUNC	<unknown>	DEFAULT	2
__open_etc_hosts	.symtab	0x1000f784	12	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x1000ea80	1044	FUNC	<unknown>	HIDDEN	2
__open_nocancel	.symtab	0x10008e28	16	FUNC	<unknown>	DEFAULT	2
__pagesize	.symtab	0x100243d8	4	OBJECT	<unknown>	DEFAULT	13
__preinit_array_end	.symtab	0x10024054	0	NOTYPE	<unknown>	HIDDEN	6
__preinit_array_start	.symtab	0x10024054	0	NOTYPE	<unknown>	HIDDEN	6
__progname	.symtab	0x10024360	4	OBJECT	<unknown>	DEFAULT	12
__progname_full	.symtab	0x10024364	4	OBJECT	<unknown>	DEFAULT	12
__pthread_initialize_minimal	.symtab	0x1000cf2c	12	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_init	.symtab	0x1000915c	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x10009154	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x10009154	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x10009154	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x10009154	8	FUNC	<unknown>	DEFAULT	2
__pthread_unwind	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__read	.symtab	0x10008f24	132	FUNC	<unknown>	DEFAULT	2
__read_etc_hosts_r	.symtab	0x1000f790	556	FUNC	<unknown>	HIDDEN	2
__read_nocancel	.symtab	0x10008f30	16	FUNC	<unknown>	DEFAULT	2
__register_atfork	.symtab	0x100089dc	356	FUNC	<unknown>	DEFAULT	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__res_sync	.symtab	0x10024418	4	OBJECT	<unknown>	HIDDEN	13
__resolv_attempts	.symtab	0x10024391	1	OBJECT	<unknown>	HIDDEN	12
__resolv_lock	.symtab	0x1002b0d8	24	OBJECT	<unknown>	DEFAULT	14
__resolv_timeout	.symtab	0x10024390	1	OBJECT	<unknown>	HIDDEN	12
__rtld_fini	.symtab	0x100243e0	4	OBJECT	<unknown>	HIDDEN	13
__searchdomain	.symtab	0x1002441c	4	OBJECT	<unknown>	HIDDEN	13
__searchdomains	.symtab	0x10024428	4	OBJECT	<unknown>	HIDDEN	13
__sigaddset	.symtab	0x10006bac	40	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x10006bd4	40	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x10006b84	40	FUNC	<unknown>	DEFAULT	2
__sigjmp_save	.symtab	0x1000f268	88	FUNC	<unknown>	HIDDEN	2
__sigsetjmp	.symtab	0x1000cfc0	172	FUNC	<unknown>	DEFAULT	2
__stdin	.symtab	0x1002437c	4	OBJECT	<unknown>	DEFAULT	12
__stdio_READ	.symtab	0x1000d630	120	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x1000d6a8	264	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x1000d7b0	212	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x1000a874	364	FUNC	<unknown>	HIDDEN	2
__stdio_rfill	.symtab	0x1000d884	72	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x1000d97c	88	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x1000d8cc	176	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x1000ab9c	260	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x1000aca0	76	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x10024380	4	OBJECT	<unknown>	DEFAULT	12
__sys_connect	.symtab	0x100067e0	52	FUNC	<unknown>	DEFAULT	2
__sys_recv	.symtab	0x100068f4	52	FUNC	<unknown>	DEFAULT	2
__sys_send	.symtab	0x100069a8	52	FUNC	<unknown>	DEFAULT	2
__syscall_error	.symtab	0x10009644	28	FUNC	<unknown>	HIDDEN	2
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_nanosleep	.symtab	0x10009798	52	FUNC	<unknown>	DEFAULT	2
__syscall_poll	.symtab	0x1000f348	52	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction	.symtab	0x1000d0a0	52	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_select	.symtab	0x1000487c	52	FUNC	<unknown>	DEFAULT	2
__uClibc_fini	.symtab	0x100091a8	144	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x10009298	100	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x100092fc	840	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x1002435c	4	OBJECT	<unknown>	HIDDEN	12
__waitpid	.symtab	0x10008fa8	132	FUNC	<unknown>	DEFAULT	2
__waitpid_nocancel	.symtab	0x10008fb4	16	FUNC	<unknown>	DEFAULT	2
__write	.symtab	0x10008ea0	132	FUNC	<unknown>	DEFAULT	2
__write_nocancel	.symtab	0x10008eac	16	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r	.symtab	0x100062f4	284	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__xstat32_conv	.symtab	0x1000d268	204	FUNC	<unknown>	HIDDEN	2
__xstat64_conv	.symtab	0x1000d184	228	FUNC	<unknown>	HIDDEN	2
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_bss_custom_printf_spec	.symtab	0x10028448	10	OBJECT	<unknown>	DEFAULT	14
_charpad	.symtab	0x10004b30	100	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_custom_printf_arginfo	.symtab	0x1002b0f0	40	OBJECT	<unknown>	HIDDEN	14
_custom_printf_handler	.symtab	0x1002b118	40	OBJECT	<unknown>	HIDDEN	14
_custom_printf_spec	.symtab	0x10024358	4	OBJECT	<unknown>	HIDDEN	12
_dl_aux_init	.symtab	0x1000cf38	28	FUNC	<unknown>	DEFAULT	2
_dl_init_static_tls	.symtab	0x1002438c	4	OBJECT	<unknown>	DEFAULT	12
_dl_nothread_init_static_tls	.symtab	0x1000cf54	108	FUNC	<unknown>	HIDDEN	2
_dl_phdr	.symtab	0x1002440c	4	OBJECT	<unknown>	DEFAULT	13
_dl_phnum	.symtab	0x10024410	4	OBJECT	<unknown>	DEFAULT	13
_dl_tls_dtv_gaps	.symtab	0x10024400	1	OBJECT	<unknown>	DEFAULT	13
_dl_tls_dtv_slotinfo_list	.symtab	0x100243fc	4	OBJECT	<unknown>	DEFAULT	13
_dl_tls_generation	.symtab	0x10024404	4	OBJECT	<unknown>	DEFAULT	13
_dl_tls_max_dtv_idx	.symtab	0x100243f4	4	OBJECT	<unknown>	DEFAULT	13
_dl_tls_setup	.symtab	0x1000cd0c	80	FUNC	<unknown>	DEFAULT	2
_dl_tls_static_align	.symtab	0x100243f0	4	OBJECT	<unknown>	DEFAULT	13
_dl_tls_static_nelem	.symtab	0x10024408	4	OBJECT	<unknown>	DEFAULT	13
_dl_tls_static_size	.symtab	0x100243f8	4	OBJECT	<unknown>	DEFAULT	13
_dl_tls_static_used	.symtab	0x100243ec	4	OBJECT	<unknown>	DEFAULT	13
_edata	.symtab	0x10024392	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x1002b4b8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_exit	.symtab	0x100047b8	92	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x1000faf4	0	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x10028b94	8192	OBJECT	<unknown>	DEFAULT	14
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x10004b94	152	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x1000aea0	1784	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_init	.symtab	0x100000b4	0	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x1000acec	128	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_init	.symtab	0x10005324	188	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x100056dc	1488	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x100053e0	92	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x1000543c	608	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x1000569c	64	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x10009170	56	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x10009164	12	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_setjmp	.symtab	0x10009660	8	FUNC	<unknown>	DEFAULT	2
_sigintr	.symtab	0x100243b8	8	OBJECT	<unknown>	HIDDEN	13
_start	.symtab	0x10000218	72	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x1000a48c	1000	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x1000a9e0	128	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x10024384	4	OBJECT	<unknown>	DEFAULT	12
_stdio_openlist_add_lock	.symtab	0x10028b7c	12	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_dec_use	.symtab	0x1000b7bc	540	FUNC	<unknown>	HIDDEN	2
_stdio_openlist_del_count	.symtab	0x100243e8	4	OBJECT	<unknown>	DEFAULT	13
_stdio_openlist_del_lock	.symtab	0x10028b88	12	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_use_count	.symtab	0x100243e4	4	OBJECT	<unknown>	DEFAULT	13
_stdio_streams	.symtab	0x1002425c	204	OBJECT	<unknown>	DEFAULT	10
_stdio_term	.symtab	0x1000aa60	316	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x10024388	4	OBJECT	<unknown>	DEFAULT	12
_stdlib_strto_l	.symtab	0x10008078	440	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x1000ad6c	60	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x10012a4c	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x1000ada8	248	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x10004c2c	1784	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x10007a4c	248	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
atoi	.symtab	0x10008064	12	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x10008064	12	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bcopy	.symtab	0x10006410	16	FUNC	<unknown>	DEFAULT	2
bcopy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
been_there_done_that	.symtab	0x10028634	4	OBJECT	<unknown>	DEFAULT	14
bot.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
brk	.symtab	0x1000d06c	52	FUNC	<unknown>	DEFAULT	2
bsd_signal	.symtab	0x10006ac4	192	FUNC	<unknown>	DEFAULT	2
buf.4826	.symtab	0x10028458	16	OBJECT	<unknown>	DEFAULT	14
buf.6501	.symtab	0x1002847c	440	OBJECT	<unknown>	DEFAULT	14
bzero	.symtab	0x10006420	12	FUNC	<unknown>	DEFAULT	2
bzero.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
c	.symtab	0x10024160	4	OBJECT	<unknown>	DEFAULT	10
call___do_global_ctors_aux	.symtab	0x1000fad8	0	FUNC	<unknown>	DEFAULT	2
call___do_global_dtors_aux	.symtab	0x10000170	0	FUNC	<unknown>	DEFAULT	2
call_frame_dummy	.symtab	0x100001fc	0	FUNC	<unknown>	DEFAULT	2
calloc	.symtab	0x1000c830	264	FUNC	<unknown>	DEFAULT	2
calloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
chdir	.symtab	0x10004814	52	FUNC	<unknown>	DEFAULT	2
chdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x10008da8	116	FUNC	<unknown>	DEFAULT	2
closedir	.symtab	0x10009928	212	FUNC	<unknown>	DEFAULT	2
closedir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
closenameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
commServer	.symtab	0x1002433c	4	OBJECT	<unknown>	DEFAULT	12
completed.5580	.symtab	0x1002442c	0	OBJECT	<unknown>	DEFAULT	14
connect	.symtab	0x10006814	120	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connectTimeout	.symtab	0x100018c0	656	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
currentServer	.symtab	0x10024344	4	OBJECT	<unknown>	DEFAULT	12
data_start	.symtab	0x10024070	0	NOTYPE	<unknown>	DEFAULT	10
decoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dns	.symtab	0x10024340	4	OBJECT	<unknown>	DEFAULT	12
dnslookup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ	.symtab	0x100243d4	4	OBJECT	<unknown>	DEFAULT	13
errno	.symtab	0x0	4	TLS	<unknown>	DEFAULT	6
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x10008230	136	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x10013d60	72	OBJECT	<unknown>	DEFAULT	4
fclose	.symtab	0x1000a200	640	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x100046cc	236	FUNC	<unknown>	DEFAULT	2
fd_to_DIR	.symtab	0x100099fc	184	FUNC	<unknown>	DEFAULT	2
fdgets	.symtab	0x10000510	232	FUNC	<unknown>	DEFAULT	2
fdopendir	.symtab	0x10009b84	184	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x1000b9d8	744	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc	.symtab	0x1000b598	304	FUNC	<unknown>	DEFAULT	2
fgetc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x1000bcc0	312	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x1000b6c8	244	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x1000bdf8	196	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fmt	.symtab	0x10013d48	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x1000a480	12	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0x10008670	824	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork_handler_pool	.symtab	0x10028638	1348	OBJECT	<unknown>	DEFAULT	14
fputs_unlocked	.symtab	0x10005cac	92	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x1000018c	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x10007800	524	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x1000d48c	16	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x1000d48c	16	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x1000d49c	404	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fstat	.symtab	0x1000d0d4	124	FUNC	<unknown>	DEFAULT	2
fstat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fwrite_unlocked	.symtab	0x10005d08	192	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getArch	.symtab	0x100031b8	40	FUNC	<unknown>	DEFAULT	2
getHost	.symtab	0x10001550	124	FUNC	<unknown>	DEFAULT	2
getOurIP	.symtab	0x100005f8	648	FUNC	<unknown>	DEFAULT	2
getRandomIP	.symtab	0x100004a0	112	FUNC	<unknown>	DEFAULT	2
get_hosts_byname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getc	.symtab	0x1000b598	304	FUNC	<unknown>	DEFAULT	2
getc_unlocked	.symtab	0x1000bcc0	312	FUNC	<unknown>	DEFAULT	2
getdents64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdtablesize	.symtab	0x10009668	56	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x100096a0	16	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x100096b0	16	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x100096c0	16	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname	.symtab	0x10006790	8	FUNC	<unknown>	DEFAULT	2
gethostbyname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname2	.symtab	0x10006798	72	FUNC	<unknown>	DEFAULT	2
gethostbyname2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname2_r	.symtab	0x1000c574	664	FUNC	<unknown>	DEFAULT	2
gethostbyname2_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r	.symtab	0x1000ef7c	748	FUNC	<unknown>	DEFAULT	2
gethostbyname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostname	.symtab	0x1000f2c0	136	FUNC	<unknown>	DEFAULT	2
gethostname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpagesize	.symtab	0x100096d0	28	FUNC	<unknown>	DEFAULT	2
getpagesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x10008b40	56	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x100096ec	52	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockname	.symtab	0x1000688c	52	FUNC	<unknown>	DEFAULT	2
getsockname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x100068c0	52	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x10009720	16	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
h_errno	.symtab	0x4	4	TLS	<unknown>	DEFAULT	6
hoste.6500	.symtab	0x10028468	20	OBJECT	<unknown>	DEFAULT	14
htonl	.symtab	0x100066a4	4	FUNC	<unknown>	DEFAULT	2
htons	.symtab	0x100066a8	4	FUNC	<unknown>	DEFAULT	2
i.4865	.symtab	0x10024164	4	OBJECT	<unknown>	DEFAULT	10
index	.symtab	0x10005ef4	256	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x1000675c	52	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x1000c4a4	208	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa	.symtab	0x10006728	52	FUNC	<unknown>	DEFAULT	2
inet_ntoa.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa_r	.symtab	0x100066ac	124	FUNC	<unknown>	DEFAULT	2
inet_ntop	.symtab	0x1000df84	728	FUNC	<unknown>	DEFAULT	2
inet_ntop4	.symtab	0x1000de30	340	FUNC	<unknown>	DEFAULT	2
inet_pton	.symtab	0x1000dc24	524	FUNC	<unknown>	DEFAULT	2
inet_pton4	.symtab	0x1000db48	220	FUNC	<unknown>	DEFAULT	2
initConnection	.symtab	0x10003bd0	412	FUNC	<unknown>	DEFAULT	2
init_rand	.symtab	0x10000260	232	FUNC	<unknown>	DEFAULT	2
init_static_tls	.symtab	0x1000ccd0	60	FUNC	<unknown>	DEFAULT	2
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initstate	.symtab	0x10007c2c	132	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x10007e98	236	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x10004574	228	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isatty	.symtab	0x1000c478	44	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isspace	.symtab	0x1000497c	24	FUNC	<unknown>	DEFAULT	2
isspace.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0x10004848	52	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
last_id.6558	.symtab	0x10024328	2	OBJECT	<unknown>	DEFAULT	10
last_ns_num.6557	.symtab	0x1002b0d0	4	OBJECT	<unknown>	DEFAULT	14
libc-cancellation.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc-lowlevellock.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc-tls.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
listFork	.symtab	0x10001b50	460	FUNC	<unknown>	DEFAULT	2
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x1000f4a4	112	FUNC	<unknown>	DEFAULT	2
macAddress	.symtab	0x100243a8	6	OBJECT	<unknown>	DEFAULT	13
main	.symtab	0x10003d6c	2056	FUNC	<unknown>	DEFAULT	2
mainCommSock	.symtab	0x10024398	4	OBJECT	<unknown>	DEFAULT	13
malloc	.symtab	0x10006c6c	2320	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
malloc_trim	.symtab	0x10007a0c	64	FUNC	<unknown>	DEFAULT	2
memchr	.symtab	0x1000bf60	264	FUNC	<unknown>	DEFAULT	2
memchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memcpy	.symtab	0x10005dc8	156	FUNC	<unknown>	DEFAULT	2
memcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memmove	.symtab	0x1000bebc	164	FUNC	<unknown>	DEFAULT	2
memmove.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mempcpy	.symtab	0x1000c068	52	FUNC	<unknown>	DEFAULT	2
mempcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memrchr	.symtab	0x1000c09c	244	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x10005e64	144	FUNC	<unknown>	DEFAULT	2
memset.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mmap	.symtab	0x10009730	52	FUNC	<unknown>	DEFAULT	2
mmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mremap	.symtab	0x1000d150	52	FUNC	<unknown>	DEFAULT	2
mremap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
munmap	.symtab	0x10009764	52	FUNC	<unknown>	DEFAULT	2
munmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mylock	.symtab	0x10024180	24	OBJECT	<unknown>	DEFAULT	10
mylock	.symtab	0x10024198	24	OBJECT	<unknown>	DEFAULT	10
nanosleep	.symtab	0x100097cc	112	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
next_start.1347	.symtab	0x10028454	4	OBJECT	<unknown>	DEFAULT	14
nprocessors_onln	.symtab	0x100082b8	328	FUNC	<unknown>	DEFAULT	2
ntohl	.symtab	0x1000669c	4	FUNC	<unknown>	DEFAULT	2
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0x100066a0	4	FUNC	<unknown>	DEFAULT	2
ntop.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
numpids	.symtab	0x100243a0	8	OBJECT	<unknown>	DEFAULT	13
object.5595	.symtab	0x10024430	0	OBJECT	<unknown>	DEFAULT	14
open	.symtab	0x10008e1c	132	FUNC	<unknown>	DEFAULT	2
opendir	.symtab	0x10009ab4	208	FUNC	<unknown>	DEFAULT	2
opendir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opennameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ourIP	.symtab	0x100243b0	4	OBJECT	<unknown>	DEFAULT	13
ovhl7	.symtab	0x1000244c	3436	FUNC	<unknown>	DEFAULT	2
p.5578	.symtab	0x1002406c	0	OBJECT	<unknown>	DEFAULT	10
parse_config.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pids	.symtab	0x100243b4	4	OBJECT	<unknown>	DEFAULT	13
poll	.symtab	0x1000f37c	120	FUNC	<unknown>	DEFAULT	2
poll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prefix.6256	.symtab	0x10012994	12	OBJECT	<unknown>	DEFAULT	4
print	.symtab	0x10000e00	1568	FUNC	<unknown>	DEFAULT	2
printchar	.symtab	0x100009dc	128	FUNC	<unknown>	DEFAULT	2
printi	.symtab	0x10000c00	512	FUNC	<unknown>	DEFAULT	2
prints	.symtab	0x10000a5c	420	FUNC	<unknown>	DEFAULT	2
processCmd	.symtab	0x100031e0	2544	FUNC	<unknown>	DEFAULT	2
program_invocation_name	.symtab	0x10024364	4	OBJECT	<unknown>	DEFAULT	12
program_invocation_short_name	.symtab	0x10024360	4	OBJECT	<unknown>	DEFAULT	12
qual_chars.6264	.symtab	0x100129dc	20	OBJECT	<unknown>	DEFAULT	4
raise	.symtab	0x10008b78	148	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x10007b44	4	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand_cmwc	.symtab	0x10000348	344	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x10007b48	104	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x100135a8	40	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x10007d18	140	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randtbl	.symtab	0x100241c4	128	OBJECT	<unknown>	DEFAULT	10
rawmemchr	.symtab	0x1000d9d4	184	FUNC	<unknown>	DEFAULT	2
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read	.symtab	0x10008f24	132	FUNC	<unknown>	DEFAULT	2
read_etc_hosts_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
readdir64	.symtab	0x10009c3c	196	FUNC	<unknown>	DEFAULT	2
readdir64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
realloc	.symtab	0x1000c938	920	FUNC	<unknown>	DEFAULT	2
realloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recv	.symtab	0x10006928	128	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recvLine	.symtab	0x100015cc	756	FUNC	<unknown>	DEFAULT	2
register-atfork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
resolv_conf_mtime.6540	.symtab	0x1002b0d4	4	OBJECT	<unknown>	DEFAULT	14
rindex	.symtab	0x1000c2e8	112	FUNC	<unknown>	DEFAULT	2
sbrk	.symtab	0x1000983c	116	FUNC	<unknown>	DEFAULT	2
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
select	.symtab	0x100048b0	136	FUNC	<unknown>	DEFAULT	2
select.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send	.symtab	0x100069dc	128	FUNC	<unknown>	DEFAULT	2
send.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsid	.symtab	0x10004938	52	FUNC	<unknown>	DEFAULT	2
setsid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsockopt	.symtab	0x10006a5c	52	FUNC	<unknown>	DEFAULT	2
setsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate	.symtab	0x10007bb0	124	FUNC	<unknown>	DEFAULT	2
setstate_r	.symtab	0x10007f84	224	FUNC	<unknown>	DEFAULT	2
sigaction	.symtab	0x1000c80c	36	FUNC	<unknown>	DEFAULT	2
sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigjmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
signal	.symtab	0x10006ac4	192	FUNC	<unknown>	DEFAULT	2
signal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigprocmask	.symtab	0x100098b0	120	FUNC	<unknown>	DEFAULT	2
sigprocmask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigsetops.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
skip_and_NUL_space	.symtab	0x1000ea3c	68	FUNC	<unknown>	DEFAULT	2
skip_nospace	.symtab	0x1000e9fc	64	FUNC	<unknown>	DEFAULT	2
sleep	.symtab	0x10008c0c	292	FUNC	<unknown>	DEFAULT	2
sleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket	.symtab	0x10006a90	52	FUNC	<unknown>	DEFAULT	2
socket.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket_connect	.symtab	0x10001d1c	328	FUNC	<unknown>	DEFAULT	2
sockprintf	.symtab	0x10001420	304	FUNC	<unknown>	DEFAULT	2
spec_and_mask.6263	.symtab	0x10012a0a	16	OBJECT	<unknown>	DEFAULT	4
spec_base.6255	.symtab	0x1001298c	7	OBJECT	<unknown>	DEFAULT	4
spec_chars.6260	.symtab	0x10012a1c	21	OBJECT	<unknown>	DEFAULT	4
spec_flags.6259	.symtab	0x10012a34	8	OBJECT	<unknown>	DEFAULT	4
spec_or_mask.6262	.symtab	0x100129fa	16	OBJECT	<unknown>	DEFAULT	4
spec_ranges.6261	.symtab	0x100129f0	9	OBJECT	<unknown>	DEFAULT	4
sprintf	.symtab	0x100049c8	136	FUNC	<unknown>	DEFAULT	2
sprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
srand	.symtab	0x10007cb0	104	FUNC	<unknown>	DEFAULT	2
srandom	.symtab	0x10007cb0	104	FUNC	<unknown>	DEFAULT	2
srandom_r	.symtab	0x10007da4	244	FUNC	<unknown>	DEFAULT	2
stat	.symtab	0x1000f3f4	124	FUNC	<unknown>	DEFAULT	2
stat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
static_dtv	.symtab	0x1002ae9c	512	OBJECT	<unknown>	DEFAULT	14
static_map	.symtab	0x1002b09c	52	OBJECT	<unknown>	DEFAULT	14
static_slotinfo	.symtab	0x1002ab94	776	OBJECT	<unknown>	DEFAULT	14
stderr	.symtab	0x10024378	4	OBJECT	<unknown>	DEFAULT	12
stdin	.symtab	0x10024370	4	OBJECT	<unknown>	DEFAULT	12
stdout	.symtab	0x10024374	4	OBJECT	<unknown>	DEFAULT	12
strcasecmp	.symtab	0x1000642c	80	FUNC	<unknown>	DEFAULT	2
strcasecmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchr	.symtab	0x10005ef4	256	FUNC	<unknown>	DEFAULT	2
strchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchrnul	.symtab	0x1000c190	248	FUNC	<unknown>	DEFAULT	2
strchrnul.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcmp	.symtab	0x10005ff4	52	FUNC	<unknown>	DEFAULT	2
strcmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcoll	.symtab	0x10005ff4	52	FUNC	<unknown>	DEFAULT	2
strcpy	.symtab	0x10006028	32	FUNC	<unknown>	DEFAULT	2
strcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcspn	.symtab	0x1000c288	96	FUNC	<unknown>	DEFAULT	2
strcspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strdup	.symtab	0x1000f514	80	FUNC	<unknown>	DEFAULT	2
strdup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strerror_r	.symtab	0x100062f4	284	FUNC	<unknown>	DEFAULT	2
strlen	.symtab	0x10006048	160	FUNC	<unknown>	DEFAULT	2
strlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncpy	.symtab	0x1000da8c	188	FUNC	<unknown>	DEFAULT	2
strncpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strnlen	.symtab	0x100060e8	236	FUNC	<unknown>	DEFAULT	2
strnlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strpbrk	.symtab	0x1000c43c	60	FUNC	<unknown>	DEFAULT	2
strpbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strrchr	.symtab	0x1000c2e8	112	FUNC	<unknown>	DEFAULT	2
strrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strspn	.symtab	0x1000c358	72	FUNC	<unknown>	DEFAULT	2
strspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strstr	.symtab	0x100061d4	240	FUNC	<unknown>	DEFAULT	2
strstr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok	.symtab	0x1000647c	12	FUNC	<unknown>	DEFAULT	2
strtok.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok_r	.symtab	0x1000c3a0	156	FUNC	<unknown>	DEFAULT	2
strtok_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtol	.symtab	0x10008070	8	FUNC	<unknown>	DEFAULT	2
strtol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sysconf	.symtab	0x10008400	624	FUNC	<unknown>	DEFAULT	2
sysconf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcgetattr	.symtab	0x10006488	156	FUNC	<unknown>	DEFAULT	2
tcgetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcsetattr	.symtab	0x10006524	376	FUNC	<unknown>	DEFAULT	2
tcsetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
time	.symtab	0x1000496c	16	FUNC	<unknown>	DEFAULT	2
time.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
toupper	.symtab	0x10004994	32	FUNC	<unknown>	DEFAULT	2
toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
trim	.symtab	0x10000880	348	FUNC	<unknown>	DEFAULT	2
type_codes	.symtab	0x100129b8	24	OBJECT	<unknown>	DEFAULT	4
type_sizes	.symtab	0x100129d0	12	OBJECT	<unknown>	DEFAULT	4
uname	.symtab	0x1000f470	52	FUNC	<unknown>	DEFAULT	2
uname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
unknown.1370	.symtab	0x10012a3c	14	OBJECT	<unknown>	DEFAULT	4
unsafe_state	.symtab	0x100241b0	20	OBJECT	<unknown>	DEFAULT	10
useragents	.symtab	0x10024074	236	OBJECT	<unknown>	DEFAULT	10
vsnprintf	.symtab	0x10004a50	224	FUNC	<unknown>	DEFAULT	2
vsnprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
waitpid	.symtab	0x10008fa8	132	FUNC	<unknown>	DEFAULT	2
wcrtomb	.symtab	0x1000a0d8	92	FUNC	<unknown>	DEFAULT	2
wcrtomb.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsnrtombs	.symtab	0x1000a144	188	FUNC	<unknown>	DEFAULT	2
wcsnrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsrtombs	.symtab	0x1000a134	16	FUNC	<unknown>	DEFAULT	2
wcsrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
write	.symtab	0x10008ea0	132	FUNC	<unknown>	DEFAULT	2
xdigits.5264	.symtab	0x10013dd4	17	OBJECT	<unknown>	DEFAULT	4
xstatconv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
xtdcustom	.symtab	0x1000200c	332	FUNC	<unknown>	DEFAULT	2

Network Behavior

Download Network PCAP: filtered – full

Network Port Distribution

Total Packets: 617
• 4258 undefined
• 443 (HTTPS)
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 25, 2025 18:59:02.505817890 CET	33888	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:02.511532068 CET	4258	33888	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:02.511610031 CET	33888	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:02.513247013 CET	33888	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:02.518179893 CET	4258	33888	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:03.895471096 CET	4258	33888	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:03.895961046 CET	33888	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:03.896080017 CET	33888	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:03.896565914 CET	33890	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:03.901101112 CET	4258	33888	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:03.901562929 CET	4258	33890	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:03.901823044 CET	33890	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:03.901823044 CET	33890	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:03.906866074 CET	4258	33890	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:05.303414106 CET	4258	33890	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:05.303611040 CET	33890	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:05.304074049 CET	33892	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:05.308613062 CET	4258	33890	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:05.309042931 CET	4258	33892	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:05.309143066 CET	33892	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:05.309173107 CET	33892	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:05.314126968 CET	4258	33892	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:06.707465887 CET	4258	33892	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:06.707649946 CET	33892	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:06.708085060 CET	33894	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:06.712595940 CET	4258	33892	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:06.713027954 CET	4258	33894	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:06.713093996 CET	33894	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:06.713139057 CET	33894	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:06.718882084 CET	4258	33894	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:08.113799095 CET	4258	33894	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:08.114089966 CET	33894	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:08.114655018 CET	33896	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:08.119077921 CET	4258	33894	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:08.119693995 CET	4258	33896	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:08.119750023 CET	33896	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:08.119800091 CET	33896	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:08.124670982 CET	4258	33896	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:09.521781921 CET	4258	33896	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:09.521961927 CET	33896	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:09.522449970 CET	33898	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:09.526875019 CET	4258	33896	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:09.527404070 CET	4258	33898	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:09.527481079 CET	33898	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:09.527507067 CET	33898	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:09.532428980 CET	4258	33898	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:10.927890062 CET	4258	33898	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:10.928085089 CET	33898	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:10.928510904 CET	33900	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:10.933090925 CET	4258	33898	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:10.933420897 CET	4258	33900	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:10.933531046 CET	33900	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:10.933547974 CET	33900	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:10.938438892 CET	4258	33900	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:12.332674026 CET	4258	33900	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:12.332890987 CET	33900	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:12.333350897 CET	33902	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:12.337815046 CET	4258	33900	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:12.338277102 CET	4258	33902	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:12.338337898 CET	33902	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:12.338453054 CET	33902	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:12.343374014 CET	4258	33902	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:13.745174885 CET	4258	33902	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:13.745565891 CET	33902	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:13.745986938 CET	33904	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:13.754709005 CET	4258	33902	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:13.755038023 CET	4258	33904	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:13.755114079 CET	33904	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:13.755198956 CET	33904	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:13.764131069 CET	4258	33904	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:15.146625042 CET	4258	33904	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:15.146961927 CET	33904	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:15.147559881 CET	33906	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:15.151913881 CET	4258	33904	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:15.154112101 CET	4258	33906	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:15.154179096 CET	33906	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:15.154258966 CET	33906	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:15.159135103 CET	4258	33906	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:16.551951885 CET	4258	33906	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:16.552252054 CET	33906	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:16.552916050 CET	33908	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:16.557162046 CET	4258	33906	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:16.557851076 CET	4258	33908	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:16.557972908 CET	33908	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:16.558034897 CET	33908	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:16.562935114 CET	4258	33908	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:17.957444906 CET	4258	33908	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:17.957793951 CET	33908	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:17.958420038 CET	33910	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:17.962724924 CET	4258	33908	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:17.963395119 CET	4258	33910	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:17.963480949 CET	33910	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:17.963576078 CET	33910	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:17.968455076 CET	4258	33910	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:19.347748041 CET	4258	33910	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:19.348123074 CET	33910	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:19.348627090 CET	33912	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:19.354171991 CET	4258	33910	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:19.354188919 CET	4258	33912	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:19.354249001 CET	33912	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:19.354263067 CET	33912	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:19.359744072 CET	4258	33912	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:20.739667892 CET	4258	33912	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:20.739875078 CET	33912	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:20.740350962 CET	33914	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:20.745189905 CET	4258	33912	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:20.745512009 CET	4258	33914	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:20.745553017 CET	33914	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:20.745583057 CET	33914	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:20.750616074 CET	4258	33914	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:22.129133940 CET	4258	33914	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:22.129301071 CET	33914	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:22.129918098 CET	33916	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:22.134298086 CET	4258	33914	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:22.134855986 CET	4258	33916	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:22.134954929 CET	33916	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:22.134994984 CET	33916	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:22.139880896 CET	4258	33916	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:23.521039963 CET	4258	33916	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:23.521267891 CET	33916	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:23.521734953 CET	33918	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:23.526237011 CET	4258	33916	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:23.526645899 CET	4258	33918	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:23.526729107 CET	33918	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:23.526752949 CET	33918	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:23.531675100 CET	4258	33918	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:24.926292896 CET	4258	33918	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:24.926503897 CET	33918	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:24.926974058 CET	33920	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:24.931426048 CET	4258	33918	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:24.931902885 CET	4258	33920	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:24.931950092 CET	33920	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:24.931976080 CET	33920	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:24.936896086 CET	4258	33920	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:26.479984999 CET	4258	33920	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:26.480217934 CET	33920	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:26.480776072 CET	33922	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:26.485313892 CET	4258	33920	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:26.485727072 CET	4258	33922	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:26.485770941 CET	33922	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:26.485807896 CET	33922	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:26.490880013 CET	4258	33922	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:27.884159088 CET	4258	33922	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:27.884346008 CET	33922	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:27.884756088 CET	33924	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:27.889349937 CET	4258	33922	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:27.889695883 CET	4258	33924	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:27.889802933 CET	33924	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:27.889828920 CET	33924	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:27.894762039 CET	4258	33924	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:29.285743952 CET	4258	33924	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:29.286092997 CET	33924	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:29.286613941 CET	33926	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:29.291054964 CET	4258	33924	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:29.291526079 CET	4258	33926	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:29.291620970 CET	33926	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:29.291657925 CET	33926	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:29.296586990 CET	4258	33926	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:30.788013935 CET	4258	33926	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:30.788235903 CET	33926	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:30.788711071 CET	33928	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:30.793395042 CET	4258	33926	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:30.793848991 CET	4258	33928	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:30.793901920 CET	33928	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:30.793936968 CET	33928	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:30.799097061 CET	4258	33928	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:31.738261938 CET	44522	443	192.168.2.15	34.254.182.186
Feb 25, 2025 18:59:31.743473053 CET	443	44522	34.254.182.186	192.168.2.15
Feb 25, 2025 18:59:31.743521929 CET	44522	443	192.168.2.15	34.254.182.186
Feb 25, 2025 18:59:32.192310095 CET	4258	33928	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:32.192503929 CET	33928	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:32.192965984 CET	33930	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:32.197442055 CET	4258	33928	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:32.197873116 CET	4258	33930	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:32.197916985 CET	33930	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:32.197949886 CET	33930	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:32.202861071 CET	4258	33930	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:33.598673105 CET	4258	33930	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:33.598886967 CET	33930	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:33.599371910 CET	33932	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:33.603878021 CET	4258	33930	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:33.604274988 CET	4258	33932	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:33.604381084 CET	33932	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:33.604393005 CET	33932	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:33.609396935 CET	4258	33932	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:35.364005089 CET	4258	33932	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:35.364248037 CET	33932	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:35.364820004 CET	33934	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:35.369194031 CET	4258	33932	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:35.369788885 CET	4258	33934	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:35.369841099 CET	33934	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:35.369909048 CET	33934	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:35.374793053 CET	4258	33934	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:36.898005009 CET	4258	33934	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:36.898175955 CET	33934	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:36.898694992 CET	33936	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:36.903126955 CET	4258	33934	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:36.903610945 CET	4258	33936	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:36.903659105 CET	33936	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:36.903695107 CET	33936	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:36.908689022 CET	4258	33936	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:38.303499937 CET	4258	33936	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:38.303725958 CET	33936	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:38.304452896 CET	33938	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:38.308657885 CET	4258	33936	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:38.309376955 CET	4258	33938	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:38.309454918 CET	33938	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:38.309537888 CET	33938	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:38.314464092 CET	4258	33938	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:39.756932020 CET	4258	33938	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:39.757143021 CET	33938	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:39.757818937 CET	33940	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:39.762116909 CET	4258	33938	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:39.762859106 CET	4258	33940	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:39.762940884 CET	33940	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:39.762985945 CET	33940	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:39.767910957 CET	4258	33940	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:41.238687992 CET	4258	33940	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:41.238915920 CET	33940	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:41.238990068 CET	33940	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:41.239562988 CET	33942	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:41.243954897 CET	4258	33940	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:41.244640112 CET	4258	33942	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:41.244729996 CET	33942	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:41.244784117 CET	33942	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:41.249654055 CET	4258	33942	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:42.629785061 CET	4258	33942	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:42.630186081 CET	33942	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:42.630745888 CET	33944	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:42.635080099 CET	4258	33942	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:42.635713100 CET	4258	33944	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:42.635790110 CET	33944	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:42.635855913 CET	33944	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:42.640755892 CET	4258	33944	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:44.042618990 CET	4258	33944	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:44.042848110 CET	33944	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:44.042848110 CET	33944	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:44.043546915 CET	33946	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:44.047812939 CET	4258	33944	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:44.048428059 CET	4258	33946	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:44.048492908 CET	33946	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:44.048571110 CET	33946	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:44.053464890 CET	4258	33946	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:45.444677114 CET	4258	33946	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:45.444931030 CET	33946	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:45.445280075 CET	33948	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:45.449953079 CET	4258	33946	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:45.450221062 CET	4258	33948	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:45.450340986 CET	33948	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:45.450359106 CET	33948	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:45.455329895 CET	4258	33948	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:47.020370007 CET	4258	33948	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:47.020586014 CET	33948	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:47.021311045 CET	33950	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:47.025455952 CET	4258	33948	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:47.026233912 CET	4258	33950	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:47.026292086 CET	33950	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:47.026420116 CET	33950	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:47.031266928 CET	4258	33950	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:48.458240032 CET	4258	33950	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:48.458597898 CET	33950	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:48.459239960 CET	33952	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:48.463530064 CET	4258	33950	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:48.464253902 CET	4258	33952	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:48.464361906 CET	33952	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:48.464361906 CET	33952	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:48.469279051 CET	4258	33952	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:49.940208912 CET	4258	33952	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:49.940474987 CET	33952	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:49.942394018 CET	33954	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:49.945431948 CET	4258	33952	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:49.947361946 CET	4258	33954	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:49.947459936 CET	33954	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:49.947504044 CET	33954	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:49.952543974 CET	4258	33954	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:51.333475113 CET	4258	33954	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:51.333674908 CET	33954	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:51.334184885 CET	33956	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:51.338681936 CET	4258	33954	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:51.339116096 CET	4258	33956	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:51.339171886 CET	33956	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:51.339206934 CET	33956	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:51.344125032 CET	4258	33956	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:52.739526987 CET	4258	33956	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:52.739691973 CET	33956	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:52.740145922 CET	33958	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:52.744673014 CET	4258	33956	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:52.745090008 CET	4258	33958	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:52.745167971 CET	33958	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:52.745234966 CET	33958	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:52.750185966 CET	4258	33958	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:54.130040884 CET	4258	33958	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:54.130223036 CET	33958	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:54.130928040 CET	33960	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:54.135140896 CET	4258	33958	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:54.135982037 CET	4258	33960	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:54.136077881 CET	33960	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:54.136138916 CET	33960	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:54.141007900 CET	4258	33960	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:55.536443949 CET	4258	33960	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:55.536724091 CET	33960	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:55.537374973 CET	33962	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:55.541640043 CET	4258	33960	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:55.542287111 CET	4258	33962	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:55.542380095 CET	33962	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:55.542414904 CET	33962	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:55.547331095 CET	4258	33962	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:56.927289963 CET	4258	33962	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:56.927635908 CET	33962	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:56.928317070 CET	33964	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:56.932595015 CET	4258	33962	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:56.933192015 CET	4258	33964	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:56.933271885 CET	33964	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:56.933357954 CET	33964	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:56.938210011 CET	4258	33964	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:58.317846060 CET	4258	33964	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:58.318243980 CET	33964	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:58.319036961 CET	33966	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:58.323184967 CET	4258	33964	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:58.323915005 CET	4258	33966	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:58.323971033 CET	33966	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:58.324038982 CET	33966	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:58.328852892 CET	4258	33966	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:59.725908041 CET	4258	33966	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:59.726216078 CET	33966	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:59.727078915 CET	33968	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:59.731400967 CET	4258	33966	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:59.732068062 CET	4258	33968	44.210.138.111	192.168.2.15
Feb 25, 2025 18:59:59.732187033 CET	33968	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:59.732223034 CET	33968	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 18:59:59.737173080 CET	4258	33968	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:01.114676952 CET	4258	33968	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:01.115184069 CET	33968	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:01.116206884 CET	33970	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:01.120163918 CET	4258	33968	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:01.121222019 CET	4258	33970	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:01.121315002 CET	33970	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:01.121335983 CET	33970	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:01.126260042 CET	4258	33970	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:02.521089077 CET	4258	33970	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:02.521373987 CET	33970	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:02.522404909 CET	33972	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:02.526349068 CET	4258	33970	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:02.527401924 CET	4258	33972	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:02.527478933 CET	33972	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:02.527545929 CET	33972	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:02.532480001 CET	4258	33972	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:03.943094015 CET	4258	33972	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:03.943495989 CET	33972	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:03.944252968 CET	33974	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:03.948443890 CET	4258	33972	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:03.949238062 CET	4258	33974	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:03.949301004 CET	33974	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:03.949368000 CET	33974	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:03.954226017 CET	4258	33974	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:05.332932949 CET	4258	33974	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:05.333331108 CET	33974	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:05.334306955 CET	33976	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:05.338360071 CET	4258	33974	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:05.339286089 CET	4258	33976	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:05.339369059 CET	33976	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:05.339421034 CET	33976	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:05.344352961 CET	4258	33976	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:06.723241091 CET	4258	33976	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:06.723495960 CET	33976	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:06.723962069 CET	33978	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:06.729199886 CET	4258	33976	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:06.731003046 CET	4258	33978	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:06.731086016 CET	33978	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:06.731101990 CET	33978	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:06.736320019 CET	4258	33978	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:08.130423069 CET	4258	33978	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:08.130841970 CET	33978	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:08.131742001 CET	33980	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:08.136372089 CET	4258	33978	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:08.136738062 CET	4258	33980	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:08.136818886 CET	33980	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:08.136883974 CET	33980	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:08.142457962 CET	4258	33980	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:09.537060976 CET	4258	33980	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:09.537446976 CET	33980	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:09.538177967 CET	33982	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:09.542382956 CET	4258	33980	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:09.543119907 CET	4258	33982	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:09.543184996 CET	33982	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:09.543275118 CET	33982	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:09.548301935 CET	4258	33982	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:10.927124977 CET	4258	33982	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:10.927330971 CET	33982	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:10.928045988 CET	33984	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:10.932312012 CET	4258	33982	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:10.933029890 CET	4258	33984	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:10.933146954 CET	33984	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:10.933168888 CET	33984	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:10.938127041 CET	4258	33984	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:12.318181038 CET	4258	33984	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:12.318495035 CET	33984	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:12.319298983 CET	33986	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:12.323517084 CET	4258	33984	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:12.324312925 CET	4258	33986	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:12.324402094 CET	33986	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:12.324417114 CET	33986	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:12.329380035 CET	4258	33986	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:13.726628065 CET	4258	33986	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:13.726960897 CET	33986	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:13.727653980 CET	33988	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:13.731910944 CET	4258	33986	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:13.732789993 CET	4258	33988	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:13.732863903 CET	33988	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:13.732913971 CET	33988	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:13.737833977 CET	4258	33988	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:15.132350922 CET	4258	33988	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:15.132519007 CET	33988	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:15.133208036 CET	33990	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:15.137476921 CET	4258	33988	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:15.138144016 CET	4258	33990	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:15.138200998 CET	33990	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:15.138237000 CET	33990	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:15.144117117 CET	4258	33990	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:16.660093069 CET	4258	33990	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:16.660293102 CET	33990	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:16.661091089 CET	33992	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:16.665272951 CET	4258	33990	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:16.666037083 CET	4258	33992	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:16.666182995 CET	33992	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:16.666194916 CET	33992	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:16.671097994 CET	4258	33992	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:18.070475101 CET	4258	33992	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:18.070700884 CET	33992	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:18.071475029 CET	33994	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:18.075890064 CET	4258	33992	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:18.076442957 CET	4258	33994	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:18.076513052 CET	33994	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:18.076540947 CET	33994	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:18.081537962 CET	4258	33994	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:19.476687908 CET	4258	33994	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:19.476874113 CET	33994	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:19.477572918 CET	33996	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:19.481844902 CET	4258	33994	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:19.482589006 CET	4258	33996	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:19.482664108 CET	33996	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:19.482664108 CET	33996	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:19.487669945 CET	4258	33996	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:20.887774944 CET	4258	33996	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:20.888017893 CET	33996	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:20.888967037 CET	33998	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:20.893554926 CET	4258	33996	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:20.893886089 CET	4258	33998	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:20.893953085 CET	33998	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:20.894015074 CET	33998	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:20.899013996 CET	4258	33998	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:22.317773104 CET	4258	33998	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:22.318051100 CET	33998	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:22.318885088 CET	34000	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:22.323055029 CET	4258	33998	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:22.323875904 CET	4258	34000	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:22.324008942 CET	34000	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:22.324053049 CET	34000	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:22.328988075 CET	4258	34000	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:23.709245920 CET	4258	34000	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:23.709700108 CET	34000	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:23.710671902 CET	34002	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:23.715050936 CET	4258	34000	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:23.715842009 CET	4258	34002	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:23.715941906 CET	34002	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:23.716017008 CET	34002	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:23.722265959 CET	4258	34002	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:25.161901951 CET	4258	34002	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:25.162167072 CET	34002	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:25.163045883 CET	34004	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:25.167139053 CET	4258	34002	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:25.167957067 CET	4258	34004	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:25.168030977 CET	34004	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:25.168118954 CET	34004	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:25.172998905 CET	4258	34004	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:26.552696943 CET	4258	34004	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:26.553142071 CET	34004	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:26.554009914 CET	34006	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:26.558136940 CET	4258	34004	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:26.558970928 CET	4258	34006	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:26.559029102 CET	34006	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:26.559073925 CET	34006	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:26.564054966 CET	4258	34006	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:28.068622112 CET	4258	34006	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:28.068840027 CET	34006	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:28.069502115 CET	34008	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:28.073782921 CET	4258	34006	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:28.074444056 CET	4258	34008	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:28.074568033 CET	34008	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:28.074604034 CET	34008	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:28.079730034 CET	4258	34008	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:29.523173094 CET	4258	34008	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:29.523592949 CET	34008	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:29.524389029 CET	34010	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:29.528631926 CET	4258	34008	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:29.529367924 CET	4258	34010	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:29.529474974 CET	34010	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:29.529529095 CET	34010	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:29.534519911 CET	4258	34010	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:30.973020077 CET	4258	34010	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:30.973303080 CET	34010	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:30.974044085 CET	34012	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:30.978411913 CET	4258	34010	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:30.979043007 CET	4258	34012	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:30.979099035 CET	34012	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:30.979132891 CET	34012	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:30.984112024 CET	4258	34012	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:32.433552027 CET	4258	34012	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:32.433907986 CET	34012	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:32.434767008 CET	34014	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:32.438874960 CET	4258	34012	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:32.439703941 CET	4258	34014	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:32.439771891 CET	34014	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:32.439836979 CET	34014	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:32.444714069 CET	4258	34014	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:33.851366043 CET	4258	34014	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:33.851536989 CET	34014	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:33.852188110 CET	34016	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:33.857386112 CET	4258	34014	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:33.857403040 CET	4258	34016	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:33.857450008 CET	34016	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:33.857489109 CET	34016	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:33.862358093 CET	4258	34016	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:35.271816969 CET	4258	34016	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:35.272016048 CET	34016	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:35.272643089 CET	34018	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:35.277041912 CET	4258	34016	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:35.277556896 CET	4258	34018	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:35.277618885 CET	34018	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:35.277656078 CET	34018	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:35.282609940 CET	4258	34018	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:36.728136063 CET	4258	34018	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:36.728472948 CET	34018	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:36.729051113 CET	34020	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:36.733803034 CET	4258	34018	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:36.734033108 CET	4258	34020	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:36.734112978 CET	34020	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:36.734152079 CET	34020	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:36.739080906 CET	4258	34020	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:38.132565975 CET	4258	34020	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:38.132824898 CET	34020	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:38.133486986 CET	34022	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:38.137763023 CET	4258	34020	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:38.138438940 CET	4258	34022	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:38.138561964 CET	34022	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:38.138561964 CET	34022	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:38.143517971 CET	4258	34022	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:39.539473057 CET	4258	34022	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:39.539828062 CET	34022	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:39.540597916 CET	34024	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:39.547019958 CET	4258	34022	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:39.547044039 CET	4258	34024	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:39.547091961 CET	34024	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:39.547122002 CET	34024	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:39.553023100 CET	4258	34024	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:40.960964918 CET	4258	34024	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:40.961128950 CET	34024	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:40.961816072 CET	34026	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:40.966074944 CET	4258	34024	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:40.966717005 CET	4258	34026	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:40.966866970 CET	34026	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:40.967003107 CET	34026	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:40.971919060 CET	4258	34026	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:42.365326881 CET	4258	34026	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:42.365562916 CET	34026	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:42.366080046 CET	34028	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:42.370496988 CET	4258	34026	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:42.371033907 CET	4258	34028	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:42.371129990 CET	34028	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:42.371150017 CET	34028	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:42.376071930 CET	4258	34028	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:43.756191969 CET	4258	34028	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:43.756519079 CET	34028	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:43.757745981 CET	34030	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:43.761800051 CET	4258	34028	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:43.762845039 CET	4258	34030	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:43.762924910 CET	34030	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:43.762979031 CET	34030	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:43.768119097 CET	4258	34030	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:45.191431046 CET	4258	34030	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:45.191703081 CET	34030	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:45.192678928 CET	34032	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:45.196649075 CET	4258	34030	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:45.197629929 CET	4258	34032	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:45.197705030 CET	34032	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:45.197786093 CET	34032	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:45.202658892 CET	4258	34032	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:46.646759033 CET	4258	34032	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:46.647025108 CET	34032	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:46.647970915 CET	34034	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:46.652059078 CET	4258	34032	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:46.652976990 CET	4258	34034	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:46.653045893 CET	34034	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:46.653148890 CET	34034	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:46.658049107 CET	4258	34034	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:48.054832935 CET	4258	34034	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:48.055082083 CET	34034	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:48.056104898 CET	34036	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:48.061489105 CET	4258	34034	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:48.062601089 CET	4258	34036	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:48.062685013 CET	34036	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:48.062758923 CET	34036	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:48.068964005 CET	4258	34036	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:49.633604050 CET	4258	34036	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:49.634057045 CET	34036	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:49.635016918 CET	34038	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:49.845093012 CET	34036	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:49.847531080 CET	4258	34036	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:49.847652912 CET	34036	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:49.849153042 CET	4258	34036	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:49.849170923 CET	4258	34038	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:49.849222898 CET	34038	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:49.849342108 CET	34038	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:49.850213051 CET	4258	34036	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:49.850275993 CET	34036	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:49.855565071 CET	4258	34038	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:51.242749929 CET	4258	34038	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:51.243117094 CET	34038	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:51.244117975 CET	34040	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:51.248095989 CET	4258	34038	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:51.249187946 CET	4258	34040	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:51.249273062 CET	34040	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:51.249334097 CET	34040	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:51.254288912 CET	4258	34040	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:52.663139105 CET	4258	34040	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:52.663408041 CET	34040	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:52.664107084 CET	34042	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:52.668689966 CET	4258	34040	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:52.669051886 CET	4258	34042	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:52.669123888 CET	34042	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:52.669184923 CET	34042	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:52.674120903 CET	4258	34042	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:54.052578926 CET	4258	34042	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:54.052831888 CET	34042	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:54.053566933 CET	34044	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:54.057883978 CET	4258	34042	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:54.058614969 CET	4258	34044	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:54.058756113 CET	34044	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:54.058757067 CET	34044	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:54.064254045 CET	4258	34044	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:55.444422007 CET	4258	34044	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:55.444669962 CET	34044	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:55.445215940 CET	34046	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:55.450884104 CET	4258	34044	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:55.451042891 CET	4258	34046	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:55.451113939 CET	34046	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:55.451128960 CET	34046	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:55.457231045 CET	4258	34046	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:56.886311054 CET	4258	34046	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:56.886739969 CET	34046	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:56.887548923 CET	34048	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:56.891720057 CET	4258	34046	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:56.892523050 CET	4258	34048	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:56.892591953 CET	34048	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:56.892668009 CET	34048	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:56.898696899 CET	4258	34048	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:58.428177118 CET	4258	34048	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:58.428462982 CET	34048	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:58.429388046 CET	34050	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:58.433413982 CET	4258	34048	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:58.434278965 CET	4258	34050	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:58.434371948 CET	34050	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:58.434453011 CET	34050	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:58.439383984 CET	4258	34050	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:59.818439960 CET	4258	34050	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:59.818727016 CET	34050	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:59.819555998 CET	34052	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:59.823729992 CET	4258	34050	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:59.824486017 CET	4258	34052	44.210.138.111	192.168.2.15
Feb 25, 2025 19:00:59.824561119 CET	34052	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:59.824637890 CET	34052	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:00:59.829559088 CET	4258	34052	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:01.227483034 CET	4258	34052	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:01.227737904 CET	34052	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:01.228813887 CET	34054	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:01.235223055 CET	4258	34052	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:01.236309052 CET	4258	34054	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:01.236387968 CET	34054	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:01.236453056 CET	34054	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:01.241384983 CET	4258	34054	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:02.655241966 CET	4258	34054	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:02.655697107 CET	34054	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:02.656641960 CET	34056	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:02.660772085 CET	4258	34054	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:02.661729097 CET	4258	34056	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:02.661842108 CET	34056	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:02.661935091 CET	34056	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:02.666853905 CET	4258	34056	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:04.053483963 CET	4258	34056	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:04.053858995 CET	34056	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:04.054567099 CET	34058	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:04.058832884 CET	4258	34056	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:04.059603930 CET	4258	34058	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:04.059694052 CET	34058	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:04.059731007 CET	34058	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:04.064670086 CET	4258	34058	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:05.506766081 CET	4258	34058	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:05.507126093 CET	34058	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:05.508080959 CET	34060	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:05.512207031 CET	4258	34058	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:05.513081074 CET	4258	34060	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:05.513164997 CET	34060	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:05.513241053 CET	34060	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:05.518124104 CET	4258	34060	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:06.898448944 CET	4258	34060	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:06.898639917 CET	34060	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:06.899419069 CET	34062	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:06.903637886 CET	4258	34060	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:06.904622078 CET	4258	34062	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:06.904686928 CET	34062	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:06.904726982 CET	34062	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:06.911648989 CET	4258	34062	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:08.303220034 CET	4258	34062	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:08.303457022 CET	34062	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:08.304003954 CET	34064	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:08.308660030 CET	4258	34062	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:08.309106112 CET	4258	34064	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:08.309199095 CET	34064	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:08.309277058 CET	34064	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:08.314400911 CET	4258	34064	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:09.711595058 CET	4258	34064	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:09.712115049 CET	34064	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:09.713119030 CET	34066	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:09.717089891 CET	4258	34064	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:09.718180895 CET	4258	34066	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:09.718278885 CET	34066	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:09.718343973 CET	34066	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:09.723253965 CET	4258	34066	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:11.471086979 CET	4258	34066	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:11.471532106 CET	34066	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:11.471750975 CET	4258	34066	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:11.471853971 CET	34066	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:11.472191095 CET	34068	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:11.476561069 CET	4258	34066	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:11.477289915 CET	4258	34068	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:11.477371931 CET	34068	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:11.477433920 CET	34068	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:11.482332945 CET	4258	34068	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:12.893138885 CET	4258	34068	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:12.893362999 CET	34068	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:12.894002914 CET	34070	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:12.899341106 CET	4258	34068	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:12.899355888 CET	4258	34070	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:12.899432898 CET	34070	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:12.899491072 CET	34070	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:13.112425089 CET	34070	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:13.117381096 CET	4258	34070	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:13.118135929 CET	4258	34070	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:14.508079052 CET	4258	34070	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:14.508317947 CET	34070	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:14.509124041 CET	34072	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:14.513278961 CET	4258	34070	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:14.514000893 CET	4258	34072	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:14.514085054 CET	34072	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:14.514141083 CET	34072	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:14.519016027 CET	4258	34072	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:15.904125929 CET	4258	34072	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:15.904324055 CET	34072	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:15.904381990 CET	34072	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:15.905180931 CET	34074	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:15.909375906 CET	4258	34072	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:15.910084963 CET	4258	34074	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:15.910166025 CET	34074	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:15.910176039 CET	34074	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:15.915117979 CET	4258	34074	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:17.334973097 CET	4258	34074	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:17.335359097 CET	34074	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:17.336431980 CET	34076	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:17.340291023 CET	4258	34074	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:17.341388941 CET	4258	34076	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:17.341463089 CET	34076	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:17.341543913 CET	34076	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:17.346394062 CET	4258	34076	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:18.742834091 CET	4258	34076	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:18.743074894 CET	34076	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:18.743962049 CET	34078	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:18.747998953 CET	4258	34076	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:18.748856068 CET	4258	34078	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:18.748919010 CET	34078	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:18.749000072 CET	34078	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:18.753899097 CET	4258	34078	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:20.149523973 CET	4258	34078	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:20.149888992 CET	34078	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:20.150906086 CET	34080	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:20.154941082 CET	4258	34078	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:20.155952930 CET	4258	34080	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:20.156021118 CET	34080	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:20.156101942 CET	34080	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:20.161071062 CET	4258	34080	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:21.553473949 CET	4258	34080	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:21.553736925 CET	34080	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:21.554708004 CET	34082	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:21.558713913 CET	4258	34080	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:21.559652090 CET	4258	34082	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:21.559724092 CET	34082	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:21.559783936 CET	34082	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:21.564685106 CET	4258	34082	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:22.960004091 CET	4258	34082	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:22.960192919 CET	34082	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:22.961059093 CET	34084	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:22.965116024 CET	4258	34082	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:22.966006994 CET	4258	34084	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:22.966137886 CET	34084	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:22.966204882 CET	34084	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:22.971071005 CET	4258	34084	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:24.350430012 CET	4258	34084	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:24.350724936 CET	34084	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:24.351511002 CET	34086	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:24.355638981 CET	4258	34084	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:24.356393099 CET	4258	34086	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:24.356483936 CET	34086	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:24.356484890 CET	34086	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:24.361383915 CET	4258	34086	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:25.758889914 CET	4258	34086	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:25.759255886 CET	34086	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:25.760071039 CET	34088	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:25.764256001 CET	4258	34086	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:25.764960051 CET	4258	34088	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:25.765012980 CET	34088	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:25.765039921 CET	34088	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:25.769980907 CET	4258	34088	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:27.200790882 CET	4258	34088	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:27.200995922 CET	34088	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:27.201801062 CET	34090	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:27.205898046 CET	4258	34088	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:27.206861019 CET	4258	34090	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:27.206904888 CET	34090	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:27.206932068 CET	34090	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:27.211822033 CET	4258	34090	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:28.609991074 CET	4258	34090	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:28.610224009 CET	34090	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:28.611283064 CET	34092	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:28.615256071 CET	4258	34090	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:28.616240025 CET	4258	34092	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:28.616360903 CET	34092	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:28.616417885 CET	34092	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:28.621290922 CET	4258	34092	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:30.064523935 CET	4258	34092	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:30.064716101 CET	34092	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:30.065397024 CET	34094	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:30.069747925 CET	4258	34092	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:30.070439100 CET	4258	34094	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:30.070504904 CET	34094	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:30.070566893 CET	34094	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:30.075530052 CET	4258	34094	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:31.460122108 CET	4258	34094	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:31.460444927 CET	34094	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:31.461538076 CET	34096	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:31.465392113 CET	4258	34094	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:31.466538906 CET	4258	34096	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:31.466629982 CET	34096	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:31.466703892 CET	34096	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:31.471626997 CET	4258	34096	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:32.895695925 CET	4258	34096	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:32.895920038 CET	34096	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:32.896836042 CET	34098	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:32.902359962 CET	4258	34096	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:32.903223991 CET	4258	34098	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:32.903323889 CET	34098	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:32.903415918 CET	34098	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:32.909357071 CET	4258	34098	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:34.303874016 CET	4258	34098	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:34.304184914 CET	34098	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:34.305160999 CET	34100	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:34.309190035 CET	4258	34098	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:34.310153961 CET	4258	34100	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:34.310241938 CET	34100	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:34.310303926 CET	34100	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:34.315268040 CET	4258	34100	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:35.711828947 CET	4258	34100	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:35.712326050 CET	34100	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:35.712893009 CET	34102	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:35.717386007 CET	4258	34100	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:35.717797995 CET	4258	34102	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:35.717896938 CET	34102	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:35.717930079 CET	34102	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:35.722865105 CET	4258	34102	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:37.100266933 CET	4258	34102	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:37.100601912 CET	34102	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:37.101432085 CET	34104	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:37.105680943 CET	4258	34102	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:37.106453896 CET	4258	34104	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:37.106532097 CET	34104	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:37.106626034 CET	34104	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:37.111547947 CET	4258	34104	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:38.508874893 CET	4258	34104	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:38.509269953 CET	34104	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:38.510159016 CET	34106	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:38.514226913 CET	4258	34104	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:38.515127897 CET	4258	34106	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:38.515197039 CET	34106	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:38.515280962 CET	34106	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:38.520700932 CET	4258	34106	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:39.902657986 CET	4258	34106	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:39.902941942 CET	34106	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:39.903810024 CET	34108	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:39.907994986 CET	4258	34106	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:39.908847094 CET	4258	34108	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:39.908992052 CET	34108	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:39.909070969 CET	34108	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:39.914088964 CET	4258	34108	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:41.304186106 CET	4258	34108	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:41.304543972 CET	34108	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:41.305351019 CET	34110	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:41.312097073 CET	4258	34108	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:41.312130928 CET	4258	34110	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:41.312257051 CET	34110	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:41.312329054 CET	34110	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:41.317226887 CET	4258	34110	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:42.711935997 CET	4258	34110	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:42.712430954 CET	34110	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:42.713181019 CET	34112	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:42.717461109 CET	4258	34110	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:42.718189955 CET	4258	34112	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:42.718347073 CET	34112	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:42.718347073 CET	34112	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:42.723308086 CET	4258	34112	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:44.116833925 CET	4258	34112	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:44.117400885 CET	34112	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:44.118326902 CET	34114	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:44.122689962 CET	4258	34112	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:44.123862982 CET	4258	34114	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:44.123929977 CET	34114	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:44.124010086 CET	34114	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:44.128889084 CET	4258	34114	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:45.522614956 CET	4258	34114	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:45.522944927 CET	34114	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:45.523442030 CET	34116	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:45.527956009 CET	4258	34114	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:45.528512955 CET	4258	34116	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:45.528606892 CET	34116	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:45.528646946 CET	34116	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:45.533607960 CET	4258	34116	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:46.946727037 CET	4258	34116	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:46.947144032 CET	34116	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:46.947911024 CET	34118	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:46.952239990 CET	4258	34116	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:46.952876091 CET	4258	34118	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:46.952938080 CET	34118	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:46.953053951 CET	34118	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:46.957979918 CET	4258	34118	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:48.351600885 CET	4258	34118	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:48.351737976 CET	34118	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:48.352674961 CET	34120	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:48.356878042 CET	4258	34118	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:48.357778072 CET	4258	34120	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:48.357840061 CET	34120	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:48.357912064 CET	34120	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:48.363153934 CET	4258	34120	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:49.742063999 CET	4258	34120	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:49.742181063 CET	34120	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:49.742849112 CET	34122	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:49.748511076 CET	4258	34120	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:49.748560905 CET	4258	34122	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:49.748614073 CET	34122	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:49.748683929 CET	34122	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:49.753725052 CET	4258	34122	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:51.165889978 CET	4258	34122	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:51.166178942 CET	34122	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:51.166774988 CET	34124	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:51.171241999 CET	4258	34122	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:51.171724081 CET	4258	34124	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:51.171821117 CET	34124	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:51.171857119 CET	34124	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:51.176770926 CET	4258	34124	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:52.956320047 CET	4258	34124	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:52.956541061 CET	4258	34124	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:52.956566095 CET	34124	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:52.956737995 CET	34124	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:52.957160950 CET	34126	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:52.965913057 CET	4258	34124	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:52.965928078 CET	4258	34126	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:52.966027021 CET	34126	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:52.966108084 CET	34126	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:52.971050978 CET	4258	34126	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:54.368515015 CET	4258	34126	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:54.368864059 CET	34126	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:54.369390965 CET	34128	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:54.373806953 CET	4258	34126	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:54.374288082 CET	4258	34128	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:54.374350071 CET	34128	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:54.374386072 CET	34128	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:54.379295111 CET	4258	34128	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:55.773514986 CET	4258	34128	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:55.773703098 CET	34128	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:55.774133921 CET	34130	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:55.778673887 CET	4258	34128	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:55.779038906 CET	4258	34130	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:55.779088974 CET	34130	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:55.779138088 CET	34130	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:55.784060001 CET	4258	34130	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:57.194879055 CET	4258	34130	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:57.195090055 CET	34130	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:57.195868969 CET	34132	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:57.200001955 CET	4258	34130	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:57.200799942 CET	4258	34132	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:57.200905085 CET	34132	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:57.200933933 CET	34132	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:57.205838919 CET	4258	34132	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:58.603307962 CET	4258	34132	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:58.603492022 CET	34132	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:58.604105949 CET	34134	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:58.608375072 CET	4258	34132	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:58.609549999 CET	4258	34134	44.210.138.111	192.168.2.15
Feb 25, 2025 19:01:58.609620094 CET	34134	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:58.609688997 CET	34134	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:01:58.615740061 CET	4258	34134	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:00.024580956 CET	4258	34134	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:00.024785995 CET	34134	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:00.025264978 CET	34136	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:00.029747009 CET	4258	34134	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:00.030236006 CET	4258	34136	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:00.030287027 CET	34136	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:00.030328035 CET	34136	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:00.035238981 CET	4258	34136	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:01.461605072 CET	4258	34136	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:01.461987019 CET	34136	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:01.462356091 CET	34138	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:01.467668056 CET	4258	34136	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:01.467984915 CET	4258	34138	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:01.468056917 CET	34138	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:01.468122959 CET	34138	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:01.473661900 CET	4258	34138	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:02.895576000 CET	4258	34138	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:02.895813942 CET	34138	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:02.896766901 CET	34140	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:02.900821924 CET	4258	34138	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:02.901696920 CET	4258	34140	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:02.901818991 CET	34140	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:02.901861906 CET	34140	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:02.906723022 CET	4258	34140	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:04.306663990 CET	4258	34140	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:04.306937933 CET	34140	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:04.308007002 CET	34142	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:04.311913013 CET	4258	34140	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:04.312953949 CET	4258	34142	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:04.313025951 CET	34142	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:04.313102961 CET	34142	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:04.318012953 CET	4258	34142	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:05.711764097 CET	4258	34142	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:05.711977005 CET	34142	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:05.712414026 CET	34144	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:05.718535900 CET	4258	34142	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:05.719743967 CET	4258	34144	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:05.719825029 CET	34144	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:05.719860077 CET	34144	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:05.725573063 CET	4258	34144	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:07.117047071 CET	4258	34144	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:07.117328882 CET	34144	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:07.118386030 CET	34146	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:07.122523069 CET	4258	34144	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:07.123507023 CET	4258	34146	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:07.123573065 CET	34146	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:07.123652935 CET	34146	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:07.130182028 CET	4258	34146	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:08.523672104 CET	4258	34146	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:08.523905039 CET	34146	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:08.524605036 CET	34148	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:08.528877974 CET	4258	34146	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:08.529582024 CET	4258	34148	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:08.529644966 CET	34148	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:08.529690027 CET	34148	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:08.534796000 CET	4258	34148	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:09.913870096 CET	4258	34148	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:09.914073944 CET	34148	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:09.914566040 CET	34150	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:09.919039965 CET	4258	34148	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:09.919704914 CET	4258	34150	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:09.919800043 CET	34150	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:09.919867992 CET	34150	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:09.924818993 CET	4258	34150	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:11.322058916 CET	4258	34150	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:11.322331905 CET	34150	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:11.323262930 CET	34152	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:11.327348948 CET	4258	34150	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:11.328305006 CET	4258	34152	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:11.328408957 CET	34152	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:11.328475952 CET	34152	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:11.333520889 CET	4258	34152	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:12.726414919 CET	4258	34152	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:12.726706982 CET	34152	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:12.727612972 CET	34154	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:12.731638908 CET	4258	34152	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:12.732536077 CET	4258	34154	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:12.732620001 CET	34154	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:12.732680082 CET	34154	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:12.737571001 CET	4258	34154	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:14.128737926 CET	4258	34154	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:14.129075050 CET	34154	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:14.129736900 CET	34156	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:14.133970976 CET	4258	34154	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:14.134707928 CET	4258	34156	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:14.134782076 CET	34156	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:14.134848118 CET	34156	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:14.139714956 CET	4258	34156	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:15.524935961 CET	4258	34156	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:15.525243998 CET	34156	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:15.525751114 CET	34158	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:15.530179977 CET	4258	34156	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:15.530688047 CET	4258	34158	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:15.530751944 CET	34158	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:15.530778885 CET	34158	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:15.535660982 CET	4258	34158	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:16.946919918 CET	4258	34158	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:16.947133064 CET	34158	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:16.947590113 CET	34160	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:16.953912020 CET	4258	34158	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:16.953933954 CET	4258	34160	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:16.954030991 CET	34160	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:16.954065084 CET	34160	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:16.959506989 CET	4258	34160	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:18.353374958 CET	4258	34160	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:18.353588104 CET	34160	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:18.354140043 CET	34162	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:18.358542919 CET	4258	34160	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:18.359042883 CET	4258	34162	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:18.359117031 CET	34162	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:18.359147072 CET	34162	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:18.364025116 CET	4258	34162	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:19.741576910 CET	4258	34162	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:19.741864920 CET	34162	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:19.742708921 CET	34164	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:19.746840000 CET	4258	34162	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:19.747644901 CET	4258	34164	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:19.747720003 CET	34164	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:19.747802019 CET	34164	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:19.752670050 CET	4258	34164	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:21.133006096 CET	4258	34164	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:21.133198023 CET	34164	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:21.133692980 CET	34166	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:21.138158083 CET	4258	34164	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:21.138611078 CET	4258	34166	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:21.138674021 CET	34166	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:21.138715029 CET	34166	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:21.144397020 CET	4258	34166	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:22.524210930 CET	4258	34166	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:22.524580956 CET	34166	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:22.525551081 CET	34168	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:22.529989004 CET	4258	34166	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:22.531388998 CET	4258	34168	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:22.531521082 CET	34168	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:22.531579018 CET	34168	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:22.537134886 CET	4258	34168	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:23.970103979 CET	4258	34168	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:23.970419884 CET	34168	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:23.971093893 CET	34170	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:23.975402117 CET	4258	34168	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:23.976142883 CET	4258	34170	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:23.976203918 CET	34170	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:23.976238012 CET	34170	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:23.981180906 CET	4258	34170	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:25.385445118 CET	4258	34170	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:25.385867119 CET	34170	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:25.386605978 CET	34172	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:25.390961885 CET	4258	34170	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:25.391845942 CET	4258	34172	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:25.391896009 CET	34172	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:25.391928911 CET	34172	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:25.396828890 CET	4258	34172	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:26.788800001 CET	4258	34172	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:26.788999081 CET	34172	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:26.789541006 CET	34174	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:26.794944048 CET	4258	34172	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:26.795901060 CET	4258	34174	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:26.795974970 CET	34174	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:26.795974970 CET	34174	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:26.801645041 CET	4258	34174	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:28.212965965 CET	4258	34174	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:28.213340998 CET	34174	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:28.214205980 CET	34176	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:28.218261957 CET	4258	34174	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:28.219171047 CET	4258	34176	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:28.219340086 CET	34176	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:28.219414949 CET	34176	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:28.224266052 CET	4258	34176	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:29.602287054 CET	4258	34176	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:29.602598906 CET	34176	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:29.603255033 CET	34178	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:29.607626915 CET	4258	34176	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:29.608304977 CET	4258	34178	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:29.608380079 CET	34178	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:29.608418941 CET	34178	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:29.613338947 CET	4258	34178	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:31.023305893 CET	4258	34178	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:31.023467064 CET	34178	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:31.023924112 CET	34180	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:31.028420925 CET	4258	34178	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:31.028960943 CET	4258	34180	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:31.029017925 CET	34180	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:31.029037952 CET	34180	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:31.033890963 CET	4258	34180	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:32.432029009 CET	4258	34180	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:32.432183981 CET	34180	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:32.432661057 CET	34182	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:32.437058926 CET	4258	34180	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:32.437706947 CET	4258	34182	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:32.437779903 CET	34182	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:32.437844038 CET	34182	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:32.442836046 CET	4258	34182	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:33.851979017 CET	4258	34182	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:33.852238894 CET	34182	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:33.852962971 CET	34184	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:33.857307911 CET	4258	34182	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:33.857963085 CET	4258	34184	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:33.858074903 CET	34184	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:33.858166933 CET	34184	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:33.863110065 CET	4258	34184	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:35.291403055 CET	4258	34184	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:35.291708946 CET	34184	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:35.292263985 CET	34186	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:35.296643019 CET	4258	34184	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:35.297188044 CET	4258	34186	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:35.297300100 CET	34186	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:35.297300100 CET	34186	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:35.302264929 CET	4258	34186	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:36.838335991 CET	4258	34186	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:36.838547945 CET	34186	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:36.839063883 CET	34188	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:36.843826056 CET	4258	34186	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:36.844058990 CET	4258	34188	44.210.138.111	192.168.2.15
Feb 25, 2025 19:02:36.844124079 CET	34188	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:36.844160080 CET	34188	4258	192.168.2.15	44.210.138.111
Feb 25, 2025 19:02:36.849014044 CET	4258	34188	44.210.138.111	192.168.2.15

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 25, 2025 19:01:48.199583054 CET	35989	53	192.168.2.15	1.1.1.1
Feb 25, 2025 19:01:48.199642897 CET	55724	53	192.168.2.15	1.1.1.1
Feb 25, 2025 19:01:48.207811117 CET	53	55724	1.1.1.1	192.168.2.15
Feb 25, 2025 19:01:48.208302021 CET	53	35989	1.1.1.1	192.168.2.15

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Feb 25, 2025 19:01:48.199583054 CET	192.168.2.15	1.1.1.1	0xb8ca	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Feb 25, 2025 19:01:48.199642897 CET	192.168.2.15	1.1.1.1	0xb081	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Feb 25, 2025 19:01:48.208302021 CET	1.1.1.1	192.168.2.15	0xb8ca	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false
Feb 25, 2025 19:01:48.208302021 CET	1.1.1.1	192.168.2.15	0xb8ca	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: hidakibest.ppc.elf PID: 5541, Parent PID: 5461

General

Start time (UTC):	17:59:00
Start date (UTC):	25/02/2025
Path:	/tmp/hidakibest.ppc.elf
Arguments:	/tmp/hidakibest.ppc.elf
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

File Activities

File Opened

File Deleted

File Read

File Written

Process Activities

Process Forked

Thread Sleep

System Activities

Query System Information (uname)

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: hidakibest.ppc.elf PID: 5543, Parent PID: 5541

General

Start time (UTC):	17:59:01
Start date (UTC):	25/02/2025
Path:	/tmp/hidakibest.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Process Activities

Process Forked

Thread Sleep

Chronological Activities

Analysis Process: hidakibest.ppc.elf PID: 5545, Parent PID: 5543

General

Start time (UTC):	17:59:01
Start date (UTC):	25/02/2025
Path:	/tmp/hidakibest.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Process Activities

Thread Sleep

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: dash PID: 5575, Parent PID: 3671

General

Start time (UTC):	17:59:30
Start date (UTC):	25/02/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: rm PID: 5575, Parent PID: 3671

General

Start time (UTC):	17:59:30
Start date (UTC):	25/02/2025
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.oT8oZwPOQP /tmp/tmp.dRWZa8bK2T /tmp/tmp.JndOZQ6O2H
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

File Activities

File Opened

File Deleted

File Read

Chronological Activities

Analysis Process: dash PID: 5576, Parent PID: 3671

General

Start time (UTC):	17:59:30
Start date (UTC):	25/02/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: rm PID: 5576, Parent PID: 3671

General

Start time (UTC):	17:59:30
Start date (UTC):	25/02/2025
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.oT8oZwPOQP /tmp/tmp.dRWZa8bK2T /tmp/tmp.JndOZQ6O2H
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping or `net view` using Net .
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report hidakibest.ppc.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Threatname: Gafgyt

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.tp5nA9 (deleted)

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: hidakibest.ppc.elf PID: 5541, Parent PID: 5461

General

File Activities

File Opened

File Deleted

File Read

File Written

Process Activities

Process Forked

Thread Sleep

Linux Analysis Report
hidakibest.ppc.elf