Edit tour

Linux Analysis Report
Execution.i586.elf

Overview

General Information

Sample name:	Execution.i586.elf
Analysis ID:	1652560
MD5:	38cab14fb23363d3fcd047ee0ed380d8
SHA1:	736e46c087cb6a7101570a26f90ce1b7288c935c
SHA256:	4e80806abb1c7074ab371187c90804e6a8caa4f589a4a229c7c1e25fa0a58647
Tags:	elfuser-abuse_ch
Infos:

Detection

Gafgyt, Mirai

Score:	96
Range:	0 - 100

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Gafgyt

Yara detected Mirai

Opens /proc/net/* files useful for finding connected devices and routers

Sample deletes itself

Creates hidden files and/or directories

Detected TCP or UDP traffic on non-standard ports

Executes the "rm" command used to delete files or directories

Sample and/or dropped files contains symbols with suspicious names

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample contains strings that are user agent strings indicative of HTTP manipulation

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1652560
Start date and time:	2025-03-31 09:12:17 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 13s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	Execution.i586.elf
Detection:	MAL
Classification:	mal96.spre.troj.evad.linELF@0/8@3/0

Warnings

VT rate limit hit for: 167.71.202.74:3131

Runtime Messages

Command:	/tmp/Execution.i586.elf
PID:	5426
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

Execution.i586.elf (PID: 5426, Parent: 5349, MD5: 38cab14fb23363d3fcd047ee0ed380d8) Arguments: /tmp/Execution.i586.elf

Execution.i586.elf New Fork (PID: 5427, Parent: 5426)

Execution.i586.elf New Fork (PID: 5428, Parent: 5427)

fwupd New Fork (PID: 5435, Parent: 1)

gpgconf (PID: 5435, Parent: 1, MD5: ddc6865fed36b9020dfd6fe9d360ebbb) Arguments: /usr/bin/gpgconf --list-dirs

fwupd New Fork (PID: 5439, Parent: 1)

gpgconf (PID: 5439, Parent: 1, MD5: ddc6865fed36b9020dfd6fe9d360ebbb) Arguments: /usr/bin/gpgconf --list-components

fwupd New Fork (PID: 5441, Parent: 1)

gpg (PID: 5441, Parent: 1, MD5: 3c2e7402cc788b3a878a1d2bea56afbf) Arguments: /usr/bin/gpg --version

fwupd New Fork (PID: 5443, Parent: 1)

gpgsm (PID: 5443, Parent: 1, MD5: 66be603a7085efc7ee3140d2ff597485) Arguments: /usr/bin/gpgsm --version

fwupd New Fork (PID: 5445, Parent: 1)

gpgconf (PID: 5445, Parent: 1, MD5: ddc6865fed36b9020dfd6fe9d360ebbb) Arguments: /usr/bin/gpgconf --version

fwupd New Fork (PID: 5447, Parent: 1)

gpg (PID: 5447, Parent: 1, MD5: 3c2e7402cc788b3a878a1d2bea56afbf) Arguments: /usr/bin/gpg --version

fwupd New Fork (PID: 5449, Parent: 1)

gpg (PID: 5449, Parent: 1, MD5: 3c2e7402cc788b3a878a1d2bea56afbf) Arguments: gpg --enable-special-filenames --batch --no-sk-comments --homedir /var/lib/fwupd/gnupg --status-fd 24 --no-tty --charset utf8 --enable-progress-filter --exit-on-status-write-error --logger-fd 26 --import -- -&27

fwupd New Fork (PID: 5451, Parent: 1)

gpg (PID: 5451, Parent: 1, MD5: 3c2e7402cc788b3a878a1d2bea56afbf) Arguments: gpg --enable-special-filenames --batch --no-sk-comments --homedir /var/lib/fwupd/gnupg --status-fd 24 --no-tty --charset utf8 --enable-progress-filter --exit-on-status-write-error --logger-fd 26 --import -- -&27

fwupd New Fork (PID: 5453, Parent: 1)

gpg (PID: 5453, Parent: 1, MD5: 3c2e7402cc788b3a878a1d2bea56afbf) Arguments: gpg --enable-special-filenames --batch --no-sk-comments --homedir /var/lib/fwupd/gnupg --status-fd 23 --no-tty --charset utf8 --enable-progress-filter --exit-on-status-write-error --logger-fd 25 --verify -- -&26 -&28

fwupd New Fork (PID: 5455, Parent: 1)

gpg (PID: 5455, Parent: 1, MD5: 3c2e7402cc788b3a878a1d2bea56afbf) Arguments: gpg --enable-special-filenames --batch --no-sk-comments --homedir /var/lib/fwupd/gnupg --status-fd 23 --no-tty --charset utf8 --enable-progress-filter --exit-on-status-write-error --logger-fd 25 --verify -- -&26 -&28

dash New Fork (PID: 5535, Parent: 3587)

rm (PID: 5535, Parent: 3587, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.IcNJHD1HVS /tmp/tmp.S5Q9IFxQ18 /tmp/tmp.EVb7uYukx7

dash New Fork (PID: 5536, Parent: 3587)

rm (PID: 5536, Parent: 3587, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.IcNJHD1HVS /tmp/tmp.S5Q9IFxQ18 /tmp/tmp.EVb7uYukx7

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Execution.i586.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
Execution.i586.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Execution.i586.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xebac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xebc0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xebd4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xebe8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xebfc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec10:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec24:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec38:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec4c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec60:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec74:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec88:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec9c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xecb0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xecc4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xecd8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xecec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Execution.i586.elf	Linux_Trojan_Gafgyt_c573932b	unknown	unknown	0x7a8:$a: 83 7D 18 00 74 22 8B 45 1C 83 E0 02 85 C0 74 18 83 EC 08 6A 2D FF
Execution.i586.elf	Linux_Trojan_Gafgyt_5bf62ce4	unknown	unknown	0x9a0d:$a: 89 E5 56 53 31 F6 8D 45 10 83 EC 10 89 45 F4 8B 55 F4 46 8D
Execution.i586.elf	Linux_Trojan_Gafgyt_750fe002	unknown	unknown	0x1353:$a: 10 8B 45 0C 40 8A 00 3C FC 75 06 C6 45 FF FE EB 50 8B 45 0C 40
Execution.i586.elf	Linux_Trojan_Gafgyt_6122acdf	unknown	unknown	0xb37:$a: E8 B0 00 FC 8B 7D E8 F2 AE 89 C8 F7 D0 48 48 89 45 F8 EB 03 FF
Execution.i586.elf	Linux_Trojan_Gafgyt_7167d08f	unknown	unknown	0x845:$a: 0C 8A 00 3C 2D 75 13 FF 45 0C C7 45 E4 01 00 00 00 EB 07 FF
Execution.i586.elf	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0x95ac:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
Click to see the 4 entries

Memory Dumps

Source	Rule	Description	Author	Strings
5427.1.0000000008048000.0000000008059000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5427.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xebac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xebc0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xebd4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xebe8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xebfc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec10:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec24:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec38:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec4c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec60:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec74:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec88:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec9c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xecb0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xecc4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xecd8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xecec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5427.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Gafgyt_c573932b	unknown	unknown	0x7a8:$a: 83 7D 18 00 74 22 8B 45 1C 83 E0 02 85 C0 74 18 83 EC 08 6A 2D FF
5427.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Gafgyt_5bf62ce4	unknown	unknown	0x9a0d:$a: 89 E5 56 53 31 F6 8D 45 10 83 EC 10 89 45 F4 8B 55 F4 46 8D
5427.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Gafgyt_750fe002	unknown	unknown	0x1353:$a: 10 8B 45 0C 40 8A 00 3C FC 75 06 C6 45 FF FE EB 50 8B 45 0C 40
5427.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Gafgyt_6122acdf	unknown	unknown	0xb37:$a: E8 B0 00 FC 8B 7D E8 F2 AE 89 C8 F7 D0 48 48 89 45 F8 EB 03 FF
5427.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Gafgyt_7167d08f	unknown	unknown	0x845:$a: 0C 8A 00 3C 2D 75 13 FF 45 0C C7 45 E4 01 00 00 00 EB 07 FF
5427.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0x95ac:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
5426.1.0000000008048000.0000000008059000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5426.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xebac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xebc0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xebd4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xebe8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xebfc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec10:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec24:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec38:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec4c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec60:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec74:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec88:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec9c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xecb0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xecc4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xecd8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xecec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5426.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Gafgyt_c573932b	unknown	unknown	0x7a8:$a: 83 7D 18 00 74 22 8B 45 1C 83 E0 02 85 C0 74 18 83 EC 08 6A 2D FF
5426.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Gafgyt_5bf62ce4	unknown	unknown	0x9a0d:$a: 89 E5 56 53 31 F6 8D 45 10 83 EC 10 89 45 F4 8B 55 F4 46 8D
5426.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Gafgyt_750fe002	unknown	unknown	0x1353:$a: 10 8B 45 0C 40 8A 00 3C FC 75 06 C6 45 FF FE EB 50 8B 45 0C 40
5426.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Gafgyt_6122acdf	unknown	unknown	0xb37:$a: E8 B0 00 FC 8B 7D E8 F2 AE 89 C8 F7 D0 48 48 89 45 F8 EB 03 FF
5426.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Gafgyt_7167d08f	unknown	unknown	0x845:$a: 0C 8A 00 3C 2D 75 13 FF 45 0C C7 45 E4 01 00 00 00 EB 07 FF
5426.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0x95ac:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
Process Memory Space: Execution.i586.elf PID: 5426	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: Execution.i586.elf PID: 5426	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x32ad:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x32c1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x32d5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x32e9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x32fd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3311:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3325:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3339:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x334d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3361:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3375:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3389:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x339d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x33b1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x33c5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x33d9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x33ed:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3401:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3415:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3429:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x343d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Execution.i586.elf PID: 5427	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: Execution.i586.elf PID: 5427	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x32ad:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x32c1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x32d5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x32e9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x32fd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3311:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3325:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3339:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x334d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3361:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3375:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3389:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x339d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x33b1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x33c5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x33d9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x33ed:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3401:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3415:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3429:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x343d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 15 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

• AV Detection
• Spreading
• Networking
• System Summary
• Persistence and Installation Behavior
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• Stealing of Sensitive Information
• Remote Access Functionality

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Execution.i586.elf

Avira: detected

Found malware configuration

Source: Execution.i586.elf

Malware Configuration Extractor: Gafgyt {"C2 url": "167.71.202.74:3131"}

Multi AV Scanner detection for submitted file

Source: Execution.i586.elf	Virustotal: Detection: 64%			Perma Link
Source: Execution.i586.elf	ReversingLabs: Detection: 69%

Spreading

Opens /proc/net/* files useful for finding connected devices and routers

Source: /tmp/Execution.i586.elf (PID: 5426)

Opens: /proc/net/route

Jump to behavior

Source: global traffic

TCP traffic: 192.168.2.13:36048 -> 167.71.202.74:3131

Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.38.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.38.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.38.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.38.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.38.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.38.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.38.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.38.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.38.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.38.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.38.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.38.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.38.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.38.49
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.202.74
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.38.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.38.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.38.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.38.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.38.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.38.49
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.202.74
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.38.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.38.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.38.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.38.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.38.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.38.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.38.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.38.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.38.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.38.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.38.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.38.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.38.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.38.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.38.49
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.202.74
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.38.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.38.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.38.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.38.49
Source: unknown	TCP traffic detected without corresponding DNS query: 34.243.160.129
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.38.49
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.202.74
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.38.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.38.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.38.49
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.202.74
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.38.49

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

Source: Execution.i586.elf	String found in binary or memory: http://fast.no/support/crawler.asp)
Source: Execution.i586.elf	String found in binary or memory: http://feedback.redkolibri.com/
Source: Execution.i586.elf	String found in binary or memory: http://www.baidu.com/search/spider.htm)
Source: Execution.i586.elf	String found in binary or memory: http://www.baidu.com/search/spider.html)
Source: Execution.i586.elf	String found in binary or memory: http://www.billybobbot.com/crawler/)

Source: unknown	Network traffic detected: HTTP traffic on port 48294 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 48294
Source: unknown	Network traffic detected: HTTP traffic on port 37796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 37796
Source: unknown	Network traffic detected: HTTP traffic on port 50532 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: Execution.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Execution.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_c573932b Author: unknown
Source: Execution.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 Author: unknown
Source: Execution.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_750fe002 Author: unknown
Source: Execution.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_6122acdf Author: unknown
Source: Execution.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_7167d08f Author: unknown
Source: Execution.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 5427.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5427.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_c573932b Author: unknown
Source: 5427.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 Author: unknown
Source: 5427.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_750fe002 Author: unknown
Source: 5427.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6122acdf Author: unknown
Source: 5427.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_7167d08f Author: unknown
Source: 5427.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 5426.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5426.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_c573932b Author: unknown
Source: 5426.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 Author: unknown
Source: 5426.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_750fe002 Author: unknown
Source: 5426.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6122acdf Author: unknown
Source: 5426.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_7167d08f Author: unknown
Source: 5426.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: Process Memory Space: Execution.i586.elf PID: 5426, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Execution.i586.elf PID: 5427, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: Execution.i586.elf	ELF static info symbol of initial sample: BusyBoxPayload
Source: Execution.i586.elf	ELF static info symbol of initial sample: passwords
Source: Execution.i586.elf	ELF static info symbol of initial sample: usernames

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: pkill -9 busybox
Source: Initial sample	String containing 'busybox' found: rm -rf /tmp/* /var/* /var/run/* /var/tmp/rm -rf /var/log/wtmprm -rf /tmp/rm -rf /bin/netstatiptables -Fpkill -9 busyboxpkill -9 perlpkill -9 pythonservice iptables stop/sbin/iptables -F; /sbin/iptables -Xservice firewalld stoprm -rf ~/.bash_historyhistory -cFailed opening raw socket.Failed setting raw headers mode.all,synrstfinackpshInvalid flag "%s"/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x
Source: Initial sample	String containing 'busybox' found: BusyBoxPayload

Source: Execution.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Execution.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_c573932b reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 18a3025ebb8af46605970ee8d7d18214854b86200001d576553e102cb71df266, id = c573932b-9b3f-4ab7-a6b6-32dcc7473790, last_modified = 2021-09-16
Source: Execution.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ffc398303f7208e77c4fbdfb50ac896e531b7cee3be2fa820bc8d70cfb20af3, id = 5bf62ce4-619b-4d46-b221-c5bf552474bb, last_modified = 2021-09-16
Source: Execution.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_750fe002 reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f51347158a6477b0da4ed4df3374fbad92b6ac137aa4775f83035d1e30cba7dc, id = 750fe002-cac1-4832-94d2-212aa5ec17e3, last_modified = 2021-09-16
Source: Execution.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_6122acdf os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 283275705c729be23d7dc75056388ecae00390bd25ee7b66b0cfc9b85feee212, id = 6122acdf-1eef-45ea-83ea-699d21c2dc20, last_modified = 2021-09-16
Source: Execution.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_7167d08f reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = b9df4ab322a2a329168f684b07b7b05ee3d03165c5b9050a4710eae7aeca6cd9, id = 7167d08f-bfeb-4d78-9783-3a1df2ef0ed3, last_modified = 2021-09-16
Source: Execution.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 5427.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5427.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_c573932b reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 18a3025ebb8af46605970ee8d7d18214854b86200001d576553e102cb71df266, id = c573932b-9b3f-4ab7-a6b6-32dcc7473790, last_modified = 2021-09-16
Source: 5427.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ffc398303f7208e77c4fbdfb50ac896e531b7cee3be2fa820bc8d70cfb20af3, id = 5bf62ce4-619b-4d46-b221-c5bf552474bb, last_modified = 2021-09-16
Source: 5427.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_750fe002 reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f51347158a6477b0da4ed4df3374fbad92b6ac137aa4775f83035d1e30cba7dc, id = 750fe002-cac1-4832-94d2-212aa5ec17e3, last_modified = 2021-09-16
Source: 5427.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6122acdf os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 283275705c729be23d7dc75056388ecae00390bd25ee7b66b0cfc9b85feee212, id = 6122acdf-1eef-45ea-83ea-699d21c2dc20, last_modified = 2021-09-16
Source: 5427.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_7167d08f reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = b9df4ab322a2a329168f684b07b7b05ee3d03165c5b9050a4710eae7aeca6cd9, id = 7167d08f-bfeb-4d78-9783-3a1df2ef0ed3, last_modified = 2021-09-16
Source: 5427.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 5426.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5426.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_c573932b reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 18a3025ebb8af46605970ee8d7d18214854b86200001d576553e102cb71df266, id = c573932b-9b3f-4ab7-a6b6-32dcc7473790, last_modified = 2021-09-16
Source: 5426.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ffc398303f7208e77c4fbdfb50ac896e531b7cee3be2fa820bc8d70cfb20af3, id = 5bf62ce4-619b-4d46-b221-c5bf552474bb, last_modified = 2021-09-16
Source: 5426.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_750fe002 reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f51347158a6477b0da4ed4df3374fbad92b6ac137aa4775f83035d1e30cba7dc, id = 750fe002-cac1-4832-94d2-212aa5ec17e3, last_modified = 2021-09-16
Source: 5426.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6122acdf os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 283275705c729be23d7dc75056388ecae00390bd25ee7b66b0cfc9b85feee212, id = 6122acdf-1eef-45ea-83ea-699d21c2dc20, last_modified = 2021-09-16
Source: 5426.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_7167d08f reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = b9df4ab322a2a329168f684b07b7b05ee3d03165c5b9050a4710eae7aeca6cd9, id = 7167d08f-bfeb-4d78-9783-3a1df2ef0ed3, last_modified = 2021-09-16
Source: 5426.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: Process Memory Space: Execution.i586.elf PID: 5426, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Execution.i586.elf PID: 5427, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal96.spre.troj.evad.linELF@0/8@3/0

Source: Execution.i586.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/i386/crt1.S
Source: Execution.i586.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/i386/crti.S
Source: Execution.i586.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/i386/crtn.S
Source: Execution.i586.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/i386/mmap.S
Source: Execution.i586.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/i386/vfork.S

Source: /usr/bin/gpg (PID: 5449)	File: /var/lib/fwupd/gnupg/.#lk0x0000560d34accb80.galassia.5449	Jump to behavior
Source: /usr/bin/gpg (PID: 5451)	File: /var/lib/fwupd/gnupg/.#lk0x00005643bcbacb80.galassia.5451	Jump to behavior
Source: /usr/bin/gpg (PID: 5453)	File: /var/lib/fwupd/gnupg/.#lk0x0000559902faeb80.galassia.5453	Jump to behavior
Source: /usr/bin/gpg (PID: 5455)	File: /var/lib/fwupd/gnupg/.#lk0x000055ff3f314b80.galassia.5455	Jump to behavior

Source: /usr/bin/dash (PID: 5535)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.IcNJHD1HVS /tmp/tmp.S5Q9IFxQ18 /tmp/tmp.EVb7uYukx7			Jump to behavior
Source: /usr/bin/dash (PID: 5536)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.IcNJHD1HVS /tmp/tmp.S5Q9IFxQ18 /tmp/tmp.EVb7uYukx7			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/Execution.i586.elf (PID: 5426)

File: /tmp/Execution.i586.elf

Jump to behavior

Source: /usr/bin/gpg (PID: 5449)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpg (PID: 5451)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpg (PID: 5453)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpg (PID: 5455)	Queries kernel information via 'uname':	Jump to behavior

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match

File source: Execution.i586.elf, type: SAMPLE

Yara detected Mirai

Source: Yara match	File source: Execution.i586.elf, type: SAMPLE
Source: Yara match	File source: 5427.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5426.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Execution.i586.elf PID: 5426, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Execution.i586.elf PID: 5427, type: MEMORYSTR

Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36
Source: Initial sample	User agent string found: Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; rv:2.2) Gecko/20110201
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.2; U; ru) Presto/2.5.22 Version/10.51
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko
Source: Initial sample	User agent string found: Mozilla/5.0 (Android; Linux armv7l; rv:9.0) Gecko/20111216 Firefox/9.0 Fennec/9.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60
Source: Initial sample	User agent string found: Mozilla/5.0 (iPad; U; CPU OS 5_1 like Mac OS X) AppleWebKit/531.21.10 (KHTML, like Gecko) Version/4.0.4 Mobile/7B367 Safari/531.21.10 UCBrowser/3.4.3.532
Source: Initial sample	User agent string found: Mozilla/5.0 (Nintendo WiiU) AppleWebKit/536.30 (KHTML, like Gecko) NX/3.0.4.2.12 NintendoBrowser/4.3.1.11264.US
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:25.0) Gecko/20100101 Firefox/25.0
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; pl) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; en) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; ja) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; cn) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; fr) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20100101 Firefox/12.0
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; U; Linux x86_64; de; rv:1.9.2.8) Gecko/20100723 Ubuntu/10.04 (lucid) Firefox/3.6.8
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; rv:13.0) Gecko/20100101 Firefox/13.0.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:11.0) Gecko/20100101 Firefox/11.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:13.0) Gecko/20100101 Firefox/13.0.1
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.289 Version/12.01
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.02
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.0) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.112 Safari/535.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36

Remote Access Functionality

Yara detected Gafgyt

Source: Yara match

File source: Execution.i586.elf, type: SAMPLE

Yara detected Mirai

Source: Yara match	File source: Execution.i586.elf, type: SAMPLE
Source: Yara match	File source: 5427.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5426.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Execution.i586.elf PID: 5426, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Execution.i586.elf PID: 5427, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Hidden Files and Directories	LSASS Memory	1 Remote System Discovery	Remote Desktop Protocol	Data from Removable Media	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	2 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact

Malware Configuration

Threatname: Gafgyt

{
  "C2 url": "167.71.202.74:3131"
}

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Execution.i586.elf	64%	Virustotal		Browse
Execution.i586.elf	69%	ReversingLabs	Linux.Network.LightAidra
Execution.i586.elf	100%	Avira	EXP/ELF.Mirai.Z.A

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
167.71.202.74:3131	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.24	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
167.71.202.74:3131	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://www.baidu.com/search/spider.html)	Execution.i586.elf	false	high
http://www.billybobbot.com/crawler/)	Execution.i586.elf	false	high
http://fast.no/support/crawler.asp)	Execution.i586.elf	false	high
http://feedback.redkolibri.com/	Execution.i586.elf	false	high
http://www.baidu.com/search/spider.htm)	Execution.i586.elf	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
167.71.202.74	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
54.217.10.153	unknown	United States	16509	AMAZON-02US	false
34.243.160.129	unknown	United States	16509	AMAZON-02US	false
199.232.38.49	unknown	United States	54113	FASTLYUS	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
54.217.10.153	havoc.spc.elf	Get hash	malicious	Mirai, Okiru	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	boatnet.arm.elf	Get hash	malicious	Mirai	Browse
	ppc.elf	Get hash	malicious	Unknown	Browse
	mips.elf	Get hash	malicious	Mirai	Browse
	mpsl.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	bin.sh.elf	Get hash	malicious	Mirai	Browse
	spc.elf	Get hash	malicious	Mirai	Browse
34.243.160.129	sshd.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	boatnet.arm5.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	SecuriteInfo.com.Linux.Mirai.2522.20371.24695.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	morte.arm6.elf	Get hash	malicious	Unknown	Browse
199.232.38.49	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	.i.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	boatnet.arm.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	boatnet.sh4.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	boatnet.arm7.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	boatnet.x86.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	boatnet.mpsl.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	tftp.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	boatnet.x86.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	boatnet.mpsl.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	boatnet.mips.elf	Get hash	malicious	Mirai	Browse	162.213.35.25

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FASTLYUS	miori.arm7.elf	Get hash	malicious	Unknown	Browse	199.232.90.49
	https://posit.co/download/rstudio-desktop/	Get hash	malicious	Unknown	Browse	23.185.0.4
	na.elf	Get hash	malicious	Prometei	Browse	199.232.38.49
	na.elf	Get hash	malicious	Prometei	Browse	199.232.90.49
	G09sJM6B52.html	Get hash	malicious	Unknown	Browse	199.232.91.1
	miori.arm5.elf	Get hash	malicious	Unknown	Browse	199.232.90.49
	na.elf	Get hash	malicious	Prometei	Browse	151.101.46.49
	na.elf	Get hash	malicious	Prometei	Browse	151.101.46.49
	https://u1.festerattire.shop/lp0cgbw3ph.mp3	Get hash	malicious	HTMLPhisher	Browse	199.232.88.157
	main.exe	Get hash	malicious	Unknown	Browse	185.199.111.133
AMAZON-02US	PO_81004107721_CONFIRMATION.exe	Get hash	malicious	FormBook	Browse	76.223.54.146
	na.elf	Get hash	malicious	Prometei	Browse	52.26.80.133
	na.elf	Get hash	malicious	Prometei	Browse	52.26.80.133
	na.elf	Get hash	malicious	Prometei	Browse	34.249.145.219
	http://www.papadustreaming.mov	Get hash	malicious	Unknown	Browse	3.168.73.86
	miori.x86.elf	Get hash	malicious	Unknown	Browse	34.249.145.219
	miori.arm5.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
	na.elf	Get hash	malicious	Prometei	Browse	34.254.182.186
	na.elf	Get hash	malicious	Prometei	Browse	52.26.80.133
	https://34.75.2o2.lol/XYVdock5IRlVOV05OVTFOQlJFVlVabWxSY0hoeGNIbHVRUzh4Vmt4dmRFSlBSVFZ5Ym1oUlpYVkdVRTR6WjFKbFZrbzFNV2MzV1ZOdWFFVlhaSGQwVG10ckszTkRTSGcyYml0dlNIUmxiV1pHZERWVGQzTXdLMGsxT1VJNFFWaE9jR1UyT0VkeldtVkNaa2x3TjBGNVZGQnpPVE01VjFoaVZYbFdZalEyV1U1aVNETm9NV2RVUzBOM2VtRllkMDlqVjJkamRETjFOMUJCVEd0NFJqaGxibkJGYjJGQlFsWlRLMFZKUFMwdFpGSnRNVzFtT0RsUldFZGhXbHBXTVdOR01uSm9VVDA5LS1lNDhiYWZhY2MwZDdlM2I5MDI1M2NmZDMzNTRiNDk3Njg0ZTRhMDY0?cid=1520306630	Get hash	malicious	KnowBe4	Browse	52.217.231.161
DIGITALOCEAN-ASNUS	A_W-NP_packetstream.exe	Get hash	malicious	Unknown	Browse	164.90.247.199
	data.ps1	Get hash	malicious	AsyncRAT	Browse	165.227.81.186
	https://environment--safety-solutions-inc.proposable.com/59ae770309fb926db5cfc80ff2463794	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	192.241.173.45
	VgoSK1LGEC.exe	Get hash	malicious	Unknown	Browse	142.93.198.235
	VgoSK1LGEC.exe	Get hash	malicious	Unknown	Browse	142.93.198.235
	resgod.sh4.elf	Get hash	malicious	Mirai	Browse	46.101.242.247
	sora.mpsl.elf	Get hash	malicious	Mirai	Browse	159.89.3.48
	sora.sh4.elf	Get hash	malicious	Mirai	Browse	159.89.3.51
	rjfe686.elf	Get hash	malicious	Mirai	Browse	206.189.186.108
	dwde.bat	Get hash	malicious	XWorm	Browse	45.55.35.48
AMAZON-02US	PO_81004107721_CONFIRMATION.exe	Get hash	malicious	FormBook	Browse	76.223.54.146
	na.elf	Get hash	malicious	Prometei	Browse	52.26.80.133
	na.elf	Get hash	malicious	Prometei	Browse	52.26.80.133
	na.elf	Get hash	malicious	Prometei	Browse	34.249.145.219
	http://www.papadustreaming.mov	Get hash	malicious	Unknown	Browse	3.168.73.86
	miori.x86.elf	Get hash	malicious	Unknown	Browse	34.249.145.219
	miori.arm5.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
	na.elf	Get hash	malicious	Prometei	Browse	34.254.182.186
	na.elf	Get hash	malicious	Prometei	Browse	52.26.80.133
	https://34.75.2o2.lol/XYVdock5IRlVOV05OVTFOQlJFVlVabWxSY0hoeGNIbHVRUzh4Vmt4dmRFSlBSVFZ5Ym1oUlpYVkdVRTR6WjFKbFZrbzFNV2MzV1ZOdWFFVlhaSGQwVG10ckszTkRTSGcyYml0dlNIUmxiV1pHZERWVGQzTXdLMGsxT1VJNFFWaE9jR1UyT0VkeldtVkNaa2x3TjBGNVZGQnpPVE01VjFoaVZYbFdZalEyV1U1aVNETm9NV2RVUzBOM2VtRllkMDlqVjJkamRETjFOMUJCVEd0NFJqaGxibkJGYjJGQlFsWlRLMFZKUFMwdFpGSnRNVzFtT0RsUldFZGhXbHBXTVdOR01uSm9VVDA5LS1lNDhiYWZhY2MwZDdlM2I5MDI1M2NmZDMzNTRiNDk3Njg0ZTRhMDY0?cid=1520306630	Get hash	malicious	KnowBe4	Browse	52.217.231.161

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/var/lib/fwupd/gnupg/.#lk0x0000559902faeb80.galassia.5453

Download File

Process:	/usr/bin/gpg
File Type:	ASCII text
Category:	dropped
Size (bytes):	20
Entropy (8bit):	3.0086949695628418
Encrypted:	false
SSDEEP:	3:N/roChvn:xoChvn
MD5:	6D4C1E2B1F752DF6D0665D900DAED2D0
SHA1:	66A19A7D04FB92001FE8C03822FC8E45EA87A62D
SHA-256:	78516AE0AFF0E384A9AA3AAF815F7F0D179139DDB994D99048694EC7EFEAE501
SHA-512:	692C773DE90F4EE87D9CBAEC175B0623D81524F7D9C964C2F4A56E479D2B2ABDF674913FC0CD77C93F2319DB1871007D4F42DC098C8CEA9D5ACEEA9F596F5AC0
Malicious:	false
Reputation:	low
Preview:	5453.galassia.

/var/lib/fwupd/gnupg/.#lk0x000055ff3f314b80.galassia.5455

Download File

Process:	/usr/bin/gpg
File Type:	ASCII text
Category:	dropped
Size (bytes):	20
Entropy (8bit):	2.8709505944546683
Encrypted:	false
SSDEEP:	3:N/r6pE/vn:x6q/vn
MD5:	D7CE30C70AFE9536BF748DF49641A177
SHA1:	283E60564C2957ECAFD6FF2CA47E6B627565265C
SHA-256:	F073FBD0EA3F2B782D9E7842E55FC3D6371AC4C81649C997E74339D3D3B65A8A
SHA-512:	C5CF3665DF8555D4029B1FE6F5A00BE1ACA1370950D673356F49E98FCFCC00A02A73EB0B1B99D0D1E541E0CDB293E713AA764DC0461D53F141C66F22CAE27CBB
Malicious:	false
Reputation:	low
Preview:	5455.galassia.

/var/lib/fwupd/gnupg/.#lk0x0000560d34accb80.galassia.5449

Download File

Process:	/usr/bin/gpg
File Type:	ASCII text
Category:	dropped
Size (bytes):	20
Entropy (8bit):	3.0086949695628418
Encrypted:	false
SSDEEP:	3:N/qcagwvn:Dwvn
MD5:	938CCA2507987D3C90627B6C8192A8CB
SHA1:	8D36B07967846B0214ABAA1275AC1E9D479144AB
SHA-256:	36D19BA22B79A07201D3CC70B3213BAF5966BB241ED0E4EAD255FEB77AEF8AD2
SHA-512:	E5E954BA529C6C88B165E5CA7079CFD4D9AB55A0AC936BC599667F8AA1F4A2BAE109E6C3F3EE28D5643741C4D84D18E9543199C0A56CF404832876333E02BC4A
Malicious:	false
Reputation:	low
Preview:	5449.galassia.

/var/lib/fwupd/gnupg/.#lk0x00005643bcbacb80.galassia.5451

Download File

Process:	/usr/bin/gpg
File Type:	ASCII text
Category:	dropped
Size (bytes):	20
Entropy (8bit):	3.0086949695628418
Encrypted:	false
SSDEEP:	3:N/r2Hevn:x2Hevn
MD5:	FCE8DB0B8BFE6ED8D6AD3E1B3C016295
SHA1:	E28AD90D71D3B41A2BE49421FEC7A6F1D3AAE6CB
SHA-256:	66EC2A31752E4A2D32B108B83E06EE041DFE8EDAEA5C239FE79463F2EC6C805D
SHA-512:	25F91A1AEFA9AAB88D654A1C0B647F1C467425B7BAD19935A6209E0D08A7DE18EAECDB3FC9084E8B982F21F7EA2C2734AF1F9A1EAA7D50AD023AA52006A9479E
Malicious:	false
Reputation:	low
Preview:	5451.galassia.

/var/lib/fwupd/gnupg/pubring.kbx.tmp

Download File

Process:	/usr/bin/gpg
File Type:	GPG keybox database version 1, created-at Tue Aug 17 14:04:41 2021, last-maintained Mon Mar 31 07:13:07 2025
Category:	dropped
Size (bytes):	2534
Entropy (8bit):	7.619996092160955
Encrypted:	false
SSDEEP:	48:s+Z3Buh7g8ZMUfN1i9N+EvbYJYv20hIhoRU3h0LJv9ARRt:7Uc8ZM+Y+AbcoRU3CARRt
MD5:	B32488DC3DF3C70B2D5AE0FF59953A52
SHA1:	992342C57A7E539808FFE3B8A8970AB35BD4A7A9
SHA-256:	E4CCDF733A963969AEA499F07526D8A15B22F9A5C77DEC785AA173FCE1CA2DAA
SHA-512:	652B70AA97AE315204413AD872C18663725FEE4FD69C59A13095E9B8B180D6450837956024C7C361D5EDE5C9AF0D05F863C224E8AF61997AD92B0FE7DEBC8560
Malicious:	false
Reputation:	low
Preview:	... ....KBXf....a...g.@....................^........?..A..../.H...E8..... .............~............................a...........U.........T.x8.sU....K'....F....l...K....cL.`Y......=....^~.5\|.%.......2..../.h..O..T........'.6E....HV..?.6l.......e..1o.O.,Y3....1,..a4..\|..s.w......f2......gaIK..i...x.T...~..W..N."..Z..ia!..V..so.....<.6j..........3C&..t1..Gf...j..z...U.........gpg.........Linux Vendor Firmware Service <sign@fwupd.org>....gpg.........7.....!..U..................................H...E8..c....d.....d.....3....a..y..?...........l...1/...)......T.f....-..UoxT... .v...\|...7.....d..PB..>..W{...-..R....&S.....~..2.ps.8:...{..^{?..@.?..e6....y...c.Rw.SK.F.;U)...A..S> an....W.?.\|.{.dB....x~B...V....O....'./!...\|;...Xw.:.!.p,n.A.H\..\...).....gpg......z.......D<............~...$......B.Y..A...n.m...o=.... ......8>4.G8E..L...+G..Z...<.................Z............................a...........[.......I....DR:....!._.P..`.1..6.9..G....O.y.?.......

Static File Info

General

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, not stripped
Entropy (8bit):	6.481604526055751
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	Execution.i586.elf
File size:	95'110 bytes
MD5:	38cab14fb23363d3fcd047ee0ed380d8
SHA1:	736e46c087cb6a7101570a26f90ce1b7288c935c
SHA256:	4e80806abb1c7074ab371187c90804e6a8caa4f589a4a229c7c1e25fa0a58647
SHA512:	10f5f456670407a33a8b9c5641cd7589ba0a9d0d3a3c30c94451dbc1fcf2d56a40dd09a6c00acbc48459fe73d634970164d6ebc60e13e787ac7b814865a196da
SSDEEP:	1536:0yXDP3ZhUNUPXPKmYQaC/Qdk5cc/z4d7J2cNU5mZ5hBtMdy72PM37K8PN2UrYe:vXj7UNUPX5YQJQdScc7M7JFp5hBCdy7F
TLSH:	6D934C81A640C6B3D09F0BB9119B5B113533F6BA6A5B9D67F31C2CF0CA07881725AFD9
File Content Preview:	.ELF....................d...4...T ......4. ...(.........................................................dk..........Q.td............................U..S.......w....h........[]...$.............U......=.....t..5....$......$.......u........t....h............

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8048164
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	73812
Section Header Size:	40
Number of Section Headers:	16
Header String Table Index:	13

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x8048094	0x94	0x1c	0x0	0x6	AX	0	0	1
.text	PROGBITS	0x80480b0	0xb0	0xd1c8	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x8055278	0xd278	0x17	0x0	0x6	AX	0	0	1
.rodata	PROGBITS	0x80552a0	0xd2a0	0x3762	0x0	0x2	A	0	0	32
.eh_frame	PROGBITS	0x8058a04	0x10a04	0x4	0x0	0x2	A	0	0	4
.ctors	PROGBITS	0x8059000	0x11000	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x8059008	0x11008	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x8059010	0x11010	0x4	0x0	0x3	WA	0	0	4
.got.plt	PROGBITS	0x8059014	0x11014	0xc	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x8059020	0x11020	0x460	0x0	0x3	WA	0	0	32
.bss	NOBITS	0x8059480	0x11480	0x66e4	0x0	0x3	WA	0	0	32
.comment	PROGBITS	0x0	0x11480	0xb64	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x11fe4	0x6f	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x122d4	0x2e00	0x10	0x0		15	260	4
.strtab	STRTAB	0x0	0x150d4	0x22b2	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8048000	0x8048000	0x10a08	0x10a08	6.7288	0x5	R E	0x1000	.init .text .fini .rodata .eh_frame
LOAD	0x11000	0x8059000	0x8059000	0x480	0x6b64	4.2155	0x6	RW	0x1000	.ctors .dtors .jcr .got.plt .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x8048094	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80480b0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x8055278	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x80552a0	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x8058a04	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x8059000	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x8059008	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x8059010	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x8059014	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x8059020	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x8059480	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
BusyBoxPayload	.symtab	0x8059130	4	OBJECT	<unknown>	DEFAULT	10
CleanDevice	.symtab	0x804c762	216	FUNC	<unknown>	DEFAULT	2
Ex9client.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
GIP	.symtab	0x80496a9	6414	FUNC	<unknown>	DEFAULT	2
GRIP	.symtab	0x804afb7	48	FUNC	<unknown>	DEFAULT	2
KadenCommStock	.symtab	0x80594b0	4	OBJECT	<unknown>	DEFAULT	11
Q	.symtab	0x80594c0	16384	OBJECT	<unknown>	DEFAULT	11
SendHTTP	.symtab	0x804c38d	315	FUNC	<unknown>	DEFAULT	2
SendHTTPHex	.symtab	0x804c4c8	351	FUNC	<unknown>	DEFAULT	2
ServerInfo	.symtab	0x805912c	4	OBJECT	<unknown>	DEFAULT	10
UpdateNameSrvs	.symtab	0x804c6d4	142	FUNC	<unknown>	DEFAULT	2
_GLOBAL_OFFSET_TABLE_	.symtab	0x8059014	0	OBJECT	<unknown>	HIDDEN	9
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x8059004	0	OBJECT	<unknown>	DEFAULT	6
__CTOR_LIST__	.symtab	0x8059000	0	OBJECT	<unknown>	DEFAULT	6
__C_ctype_b	.symtab	0x80591f8	4	OBJECT	<unknown>	DEFAULT	10
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x80570c0	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x805945c	4	OBJECT	<unknown>	DEFAULT	10
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x80585a0	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x8059200	4	OBJECT	<unknown>	DEFAULT	10
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x80573c0	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x805900c	0	OBJECT	<unknown>	DEFAULT	7
__DTOR_LIST__	.symtab	0x8059008	0	OBJECT	<unknown>	DEFAULT	7
__EH_FRAME_BEGIN__	.symtab	0x8058a04	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x8058a04	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x80591f8	4	OBJECT	<unknown>	HIDDEN	10
__GI___C_ctype_b_data	.symtab	0x80570c0	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_tolower	.symtab	0x805945c	4	OBJECT	<unknown>	HIDDEN	10
__GI___C_ctype_tolower_data	.symtab	0x80585a0	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_toupper	.symtab	0x8059200	4	OBJECT	<unknown>	HIDDEN	10
__GI___C_ctype_toupper_data	.symtab	0x80573c0	768	OBJECT	<unknown>	HIDDEN	4
__GI___ctype_b	.symtab	0x80591fc	4	OBJECT	<unknown>	HIDDEN	10
__GI___ctype_tolower	.symtab	0x8059460	4	OBJECT	<unknown>	HIDDEN	10
__GI___ctype_toupper	.symtab	0x8059204	4	OBJECT	<unknown>	HIDDEN	10
__GI___errno_location	.symtab	0x804edf8	6	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x8054eb8	220	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x804fe3c	29	FUNC	<unknown>	HIDDEN	2
__GI___h_errno_location	.symtab	0x80522e4	6	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x804e9c8	87	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl64	.symtab	0x804ea20	63	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x804ec08	75	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x8051bf0	63	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x8051c67	64	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x804fe5c	183	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x804ea60	40	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x8051290	273	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x805185c	20	FUNC	<unknown>	HIDDEN	2
__GI_atol	.symtab	0x805185c	20	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x8053968	54	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0x804eabc	46	FUNC	<unknown>	HIDDEN	2
__GI_clock_getres	.symtab	0x8051fec	50	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x804eaec	46	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x8050444	43	FUNC	<unknown>	HIDDEN	2
__GI_errno	.symtab	0x805f700	4	OBJECT	<unknown>	HIDDEN	11
__GI_execl	.symtab	0x8051a0c	105	FUNC	<unknown>	HIDDEN	2
__GI_execve	.symtab	0x8052020	54	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x80519a4	103	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x80539f0	265	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x804e9c8	87	FUNC	<unknown>	HIDDEN	2
__GI_fcntl64	.symtab	0x804ea20	63	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x8054068	321	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x8054eb8	220	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x8053f20	98	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x80541ac	105	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x8053afc	24	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x804eb1c	38	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x804fc20	51	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x8053b14	27	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x8053b30	227	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x804fc54	116	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x8054eb8	220	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x8052058	37	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x8052080	38	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x80520a8	38	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x80520d0	38	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname	.symtab	0x80500e0	48	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x8050110	818	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x80520f8	19	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x804eb44	38	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x805210c	50	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x8050470	43	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x8052140	38	FUNC	<unknown>	HIDDEN	2
__GI_h_errno	.symtab	0x805f704	4	OBJECT	<unknown>	HIDDEN	11
__GI_inet_addr	.symtab	0x80500b8	37	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x8052ee4	148	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa	.symtab	0x80500a3	21	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa_r	.symtab	0x8050054	79	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x8054690	462	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x80543be	458	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x805167a	171	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x804eb94	63	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x804ff9c	29	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x804ebd4	50	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x8054e38	95	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x8052d18	35	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x804fcc8	39	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x8052d3c	39	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x8052d8c	33	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x8052db0	176	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x804fcf0	21	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x8051f60	27	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x8052168	50	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x805219c	50	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x804ec08	75	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x80539b8	54	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x805393c	24	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x80513ac	72	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x8051585	95	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x8054268	99	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x804ecac	54	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x80504d8	51	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x80521d0	78	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x804ece4	63	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x805050c	51	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x8050540	67	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x8050584	59	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x80514ec	153	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x8051e6f	217	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x80505ec	175	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x8052220	85	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x80505c0	43	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x804ee24	31	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x80515e4	150	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x8054f94	54	FUNC	<unknown>	HIDDEN	2
__GI_strcasestr	.symtab	0x804ff2c	83	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x804fd08	30	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x8054218	29	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x8054218	29	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x804fd28	27	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x8054300	54	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x804fd44	19	FUNC	<unknown>	HIDDEN	2
__GI_strncat	.symtab	0x8054238	46	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x8052d64	38	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x804fd58	25	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x8052ebc	39	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x80542cc	50	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x804fd74	198	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x804ff80	25	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x8052e60	89	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x8051870	26	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x8051a78	325	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x804ffbc	112	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x804ed24	46	FUNC	<unknown>	HIDDEN	2
__GI_times	.symtab	0x8052278	46	FUNC	<unknown>	HIDDEN	2
__GI_tolower	.symtab	0x8054e98	29	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x804edd8	29	FUNC	<unknown>	HIDDEN	2
__GI_unlink	.symtab	0x804ed54	46	FUNC	<unknown>	HIDDEN	2
__GI_vfork	.symtab	0x8051f48	21	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x804ee44	178	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x80522a8	59	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x804ed84	26	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x80522ec	68	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x8052350	134	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x8052330	30	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x804eda0	54	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x8059010	0	OBJECT	<unknown>	DEFAULT	8
__JCR_LIST__	.symtab	0x8059010	0	OBJECT	<unknown>	DEFAULT	8
__app_fini	.symtab	0x805f6f4	4	OBJECT	<unknown>	HIDDEN	11
__atexit_lock	.symtab	0x8059440	24	OBJECT	<unknown>	DEFAULT	10
__bsd_signal	.symtab	0x80505ec	175	FUNC	<unknown>	HIDDEN	2
__bss_start	.symtab	0x8059480	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x8051c33	52	FUNC	<unknown>	DEFAULT	2
__ctype_b	.symtab	0x80591fc	4	OBJECT	<unknown>	DEFAULT	10
__ctype_tolower	.symtab	0x8059460	4	OBJECT	<unknown>	DEFAULT	10
__ctype_toupper	.symtab	0x8059204	4	OBJECT	<unknown>	DEFAULT	10
__curbrk	.symtab	0x805f724	4	OBJECT	<unknown>	HIDDEN	11
__data_start	.symtab	0x8059028	0	NOTYPE	<unknown>	DEFAULT	10
__decode_answer	.symtab	0x8054a34	249	FUNC	<unknown>	HIDDEN	2
__decode_dotted	.symtab	0x805505c	215	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x8054914	171	FUNC	<unknown>	HIDDEN	2
__deregister_frame_info_bases	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__dns_lookup	.symtab	0x8052f78	1876	FUNC	<unknown>	HIDDEN	2
__do_global_ctors_aux	.symtab	0x8055250	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x80480c0	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x8059020	0	OBJECT	<unknown>	HIDDEN	10
__encode_dotted	.symtab	0x8054fcc	144	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x8054860	177	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x80549c0	83	FUNC	<unknown>	HIDDEN	2
__environ	.symtab	0x805f6ec	4	OBJECT	<unknown>	DEFAULT	11
__errno_location	.symtab	0x804edf8	6	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x805f6e4	4	OBJECT	<unknown>	HIDDEN	11
__fgetc_unlocked	.symtab	0x8054eb8	220	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x8059000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fini_array_start	.symtab	0x8059000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__get_hosts_byname_r	.symtab	0x8053910	44	FUNC	<unknown>	HIDDEN	2
__get_pc_thunk_bx	.symtab	0x80480b0	0	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x80520f8	19	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x804fe3c	29	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__h_errno_location	.symtab	0x80522e4	6	FUNC	<unknown>	DEFAULT	2
__h_errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__init_array_end	.symtab	0x8059000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__init_array_start	.symtab	0x8059000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__length_dotted	.symtab	0x8055134	65	FUNC	<unknown>	HIDDEN	2
__length_question	.symtab	0x8054a14	30	FUNC	<unknown>	HIDDEN	2
__libc_close	.symtab	0x804eaec	46	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x8050444	43	FUNC	<unknown>	DEFAULT	2
__libc_creat	.symtab	0x804ec53	25	FUNC	<unknown>	DEFAULT	2
__libc_fcntl	.symtab	0x804e9c8	87	FUNC	<unknown>	DEFAULT	2
__libc_fcntl64	.symtab	0x804ea20	63	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x804eb1c	38	FUNC	<unknown>	DEFAULT	2
__libc_getpid	.symtab	0x804eb44	38	FUNC	<unknown>	DEFAULT	2
__libc_lseek64	.symtab	0x8054e38	95	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0x805219c	50	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x804ec08	75	FUNC	<unknown>	DEFAULT	2
__libc_poll	.symtab	0x80539b8	54	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x804ecac	54	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x80504d8	51	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x804ece4	63	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x805050c	51	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x8050540	67	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x8051e6f	217	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x805f6e8	4	OBJECT	<unknown>	DEFAULT	11
__libc_system	.symtab	0x8051728	305	FUNC	<unknown>	DEFAULT	2
__libc_waitpid	.symtab	0x804ed84	26	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x804eda0	54	FUNC	<unknown>	DEFAULT	2
__malloc_consolidate	.symtab	0x8050f29	424	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x8050700	38	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x8059350	24	OBJECT	<unknown>	DEFAULT	10
__malloc_state	.symtab	0x805f7c0	888	OBJECT	<unknown>	DEFAULT	11
__malloc_trim	.symtab	0x8050e9c	141	FUNC	<unknown>	DEFAULT	2
__nameserver	.symtab	0x805fb48	12	OBJECT	<unknown>	HIDDEN	11
__nameservers	.symtab	0x805fb54	4	OBJECT	<unknown>	HIDDEN	11
__open_etc_hosts	.symtab	0x8054b30	49	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x80536cc	579	FUNC	<unknown>	HIDDEN	2
__pagesize	.symtab	0x805f6f0	4	OBJECT	<unknown>	DEFAULT	11
__preinit_array_end	.symtab	0x8059000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__preinit_array_start	.symtab	0x8059000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__pthread_initialize_minimal	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0x8051c2f	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x8051c2f	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x8051c2f	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x8051c2f	3	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x8051c2f	3	FUNC	<unknown>	DEFAULT	2
__pthread_return_void	.symtab	0x8051c32	1	FUNC	<unknown>	DEFAULT	2
__raise	.symtab	0x805393c	24	FUNC	<unknown>	HIDDEN	2
__read_etc_hosts_r	.symtab	0x8054b61	724	FUNC	<unknown>	HIDDEN	2
__register_frame_info_bases	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__resolv_lock	.symtab	0x8059468	24	OBJECT	<unknown>	DEFAULT	10
__restore	.symtab	0x8051e67	0	NOTYPE	<unknown>	DEFAULT	2
__restore_rt	.symtab	0x8051e60	0	NOTYPE	<unknown>	DEFAULT	2
__rtld_fini	.symtab	0x805f6f8	4	OBJECT	<unknown>	HIDDEN	11
__searchdomain	.symtab	0x805fb38	16	OBJECT	<unknown>	HIDDEN	11
__searchdomains	.symtab	0x805fb58	4	OBJECT	<unknown>	HIDDEN	11
__sigaddset	.symtab	0x80506c0	32	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x80506e0	32	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x805069c	36	FUNC	<unknown>	DEFAULT	2
__socketcall	.symtab	0x8051f7c	50	FUNC	<unknown>	HIDDEN	2
__socketcall.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__stdin	.symtab	0x8059214	4	OBJECT	<unknown>	DEFAULT	10
__stdio_READ	.symtab	0x8055178	68	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x80523d8	126	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x8053c14	168	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x8052458	240	FUNC	<unknown>	HIDDEN	2
__stdio_init_mutex	.symtab	0x804ef59	23	FUNC	<unknown>	HIDDEN	2
__stdio_mutex_initializer.3991	.symtab	0x80576c0	24	OBJECT	<unknown>	DEFAULT	4
__stdio_rfill	.symtab	0x80551bc	40	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x8053eec	51	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x80551e4	101	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x8052548	158	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x804eff8	43	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x8059218	4	OBJECT	<unknown>	DEFAULT	10
__syscall_error	.symtab	0x80539a0	21	FUNC	<unknown>	HIDDEN	2
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_rt_sigaction	.symtab	0x8051fb0	59	FUNC	<unknown>	HIDDEN	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uClibc_fini	.symtab	0x8051bf0	63	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x8051c67	64	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x8051ca7	441	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x8059458	4	OBJECT	<unknown>	HIDDEN	10
__vfork	.symtab	0x8051f48	21	FUNC	<unknown>	HIDDEN	2
__xpg_strerror_r	.symtab	0x804fe5c	183	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_charpad	.symtab	0x804f024	54	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_dl_aux_init	.symtab	0x8053954	18	FUNC	<unknown>	DEFAULT	2
_dl_phdr	.symtab	0x805fb5c	4	OBJECT	<unknown>	DEFAULT	11
_dl_phnum	.symtab	0x805fb60	4	OBJECT	<unknown>	DEFAULT	11
_edata	.symtab	0x8059480	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x805fb64	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_errno	.symtab	0x805f700	4	OBJECT	<unknown>	DEFAULT	11
_exit	.symtab	0x804ea60	40	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x8055278	3	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x805d4e0	8192	OBJECT	<unknown>	DEFAULT	11
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x804f05a	106	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x8052754	1476	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_h_errno	.symtab	0x805f704	4	OBJECT	<unknown>	DEFAULT	11
_init	.symtab	0x8048094	3	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x80525e8	86	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_init	.symtab	0x804f66c	111	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x804f859	966	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x804f6dc	66	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x804f720	271	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x804f830	41	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x8051c32	1	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x8051c32	1	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_sigintr	.symtab	0x805f740	128	OBJECT	<unknown>	HIDDEN	11
_start	.symtab	0x8048164	34	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x8053cbc	559	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x804eef8	97	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x805921c	4	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_add_lock	.symtab	0x8059220	24	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_dec_use	.symtab	0x8053f84	228	FUNC	<unknown>	DEFAULT	2
_stdio_openlist_del_count	.symtab	0x805d4d4	4	OBJECT	<unknown>	DEFAULT	11
_stdio_openlist_del_lock	.symtab	0x8059238	24	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_use_count	.symtab	0x805d4d0	4	OBJECT	<unknown>	DEFAULT	11
_stdio_streams	.symtab	0x8059260	240	OBJECT	<unknown>	DEFAULT	10
_stdio_term	.symtab	0x804ef70	136	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x8059250	4	OBJECT	<unknown>	DEFAULT	10
_stdlib_strto_l	.symtab	0x805188c	277	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x8052640	61	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x80577a0	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x8052680	209	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x804f0c4	1448	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x8051290	273	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
access	.symtab	0x804ea88	50	FUNC	<unknown>	DEFAULT	2
access.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
advance_state	.symtab	0x804919c	80	FUNC	<unknown>	DEFAULT	2
advances	.symtab	0x805916c	20	OBJECT	<unknown>	DEFAULT	10
advances2	.symtab	0x80591c0	44	OBJECT	<unknown>	DEFAULT	10
atoi	.symtab	0x805185c	20	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x805185c	20	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bcopy	.symtab	0x804ff14	21	FUNC	<unknown>	DEFAULT	2
bcopy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
been_there_done_that	.symtab	0x805f6e0	1	OBJECT	<unknown>	DEFAULT	11
been_there_done_that.2832	.symtab	0x805f6fc	1	OBJECT	<unknown>	DEFAULT	11
botnetPid	.symtab	0x805f730	4	OBJECT	<unknown>	DEFAULT	11
botnetPrint	.symtab	0x8048a66	185	FUNC	<unknown>	DEFAULT	2
botnetServer	.symtab	0x80591ec	4	OBJECT	<unknown>	DEFAULT	10
botnetTScan	.symtab	0x804b0c8	4347	FUNC	<unknown>	DEFAULT	2
brk	.symtab	0x8053968	54	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x80505ec	175	FUNC	<unknown>	DEFAULT	2
buf.2658	.symtab	0x805f4e4	16	OBJECT	<unknown>	DEFAULT	11
buf.4993	.symtab	0x805f500	460	OBJECT	<unknown>	DEFAULT	11
c	.symtab	0x80591f0	4	OBJECT	<unknown>	DEFAULT	10
chdir	.symtab	0x804eabc	46	FUNC	<unknown>	DEFAULT	2
chdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
clock	.symtab	0x804ee00	36	FUNC	<unknown>	DEFAULT	2
clock.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
clock_getres	.symtab	0x8051fec	50	FUNC	<unknown>	DEFAULT	2
clock_getres.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x804eaec	46	FUNC	<unknown>	DEFAULT	2
close.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
completed.2429	.symtab	0x8059480	1	OBJECT	<unknown>	DEFAULT	11
connect	.symtab	0x8050444	43	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connectTimeout	.symtab	0x8048dac	456	FUNC	<unknown>	DEFAULT	2
contains_fail	.symtab	0x8049226	27	FUNC	<unknown>	DEFAULT	2
contains_response	.symtab	0x8049241	63	FUNC	<unknown>	DEFAULT	2
contains_string	.symtab	0x8049280	116	FUNC	<unknown>	DEFAULT	2
contains_success	.symtab	0x804920b	27	FUNC	<unknown>	DEFAULT	2
creat	.symtab	0x804ec53	25	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
csum	.symtab	0x804c22a	168	FUNC	<unknown>	DEFAULT	2
data_start	.symtab	0x8059028	0	NOTYPE	<unknown>	DEFAULT	10
decodea.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dnslookup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ	.symtab	0x805f6ec	4	OBJECT	<unknown>	DEFAULT	11
errno	.symtab	0x805f700	4	OBJECT	<unknown>	DEFAULT	11
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execl	.symtab	0x8051a0c	105	FUNC	<unknown>	DEFAULT	2
execl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execve	.symtab	0x8052020	54	FUNC	<unknown>	DEFAULT	2
execve.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x80519a4	103	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x80588e0	156	OBJECT	<unknown>	DEFAULT	4
fails	.symtab	0x8059180	32	OBJECT	<unknown>	DEFAULT	10
fclose	.symtab	0x80539f0	265	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x804e9c8	87	FUNC	<unknown>	DEFAULT	2
fcntl64	.symtab	0x804ea20	63	FUNC	<unknown>	DEFAULT	2
fdgets	.symtab	0x8048596	104	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x8054068	321	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x8054eb8	220	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x8053f20	98	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x80541ac	105	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fmt	.symtab	0x80588b0	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x8053afc	24	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0x804eb1c	38	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs_unlocked	.symtab	0x804fc20	51	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x8048110	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x80510d1	412	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x8053b14	27	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x8053b14	27	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x8053b30	227	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fwrite_unlocked	.symtab	0x804fc54	116	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getBuild	.symtab	0x8048188	10	FUNC	<unknown>	DEFAULT	2
getBuildz	.symtab	0x8048192	114	FUNC	<unknown>	DEFAULT	2
getEndianness	.symtab	0x804e178	125	FUNC	<unknown>	DEFAULT	2
getHost	.symtab	0x8048be5	59	FUNC	<unknown>	DEFAULT	2
getOurIP	.symtab	0x804df6f	521	FUNC	<unknown>	DEFAULT	2
get_hosts_byname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
get_telstate_host	.symtab	0x8049080	31	FUNC	<unknown>	DEFAULT	2
getc_unlocked	.symtab	0x8054eb8	220	FUNC	<unknown>	DEFAULT	2
getdtablesize	.symtab	0x8052058	37	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x8052080	38	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x80520a8	38	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x80520d0	38	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname	.symtab	0x80500e0	48	FUNC	<unknown>	DEFAULT	2
gethostbyname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r	.symtab	0x8050110	818	FUNC	<unknown>	DEFAULT	2
gethostbyname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpagesize	.symtab	0x80520f8	19	FUNC	<unknown>	DEFAULT	2
getpagesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x804eb44	38	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getppid	.symtab	0x804eb6c	38	FUNC	<unknown>	DEFAULT	2
getppid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x805210c	50	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockname	.symtab	0x8050470	43	FUNC	<unknown>	DEFAULT	2
getsockname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x805049c	59	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x8052140	38	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
h.4992	.symtab	0x805f6cc	20	OBJECT	<unknown>	DEFAULT	11
h_errno	.symtab	0x805f704	4	OBJECT	<unknown>	DEFAULT	11
htonl	.symtab	0x8050038	7	FUNC	<unknown>	DEFAULT	2
htons	.symtab	0x805002c	12	FUNC	<unknown>	DEFAULT	2
i.4370	.symtab	0x80591f4	4	OBJECT	<unknown>	DEFAULT	10
index	.symtab	0x804fd08	30	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x80500b8	37	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x8052ee4	148	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa	.symtab	0x80500a3	21	FUNC	<unknown>	DEFAULT	2
inet_ntoa.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa_r	.symtab	0x8050054	79	FUNC	<unknown>	DEFAULT	2
inet_ntop	.symtab	0x8054690	462	FUNC	<unknown>	DEFAULT	2
inet_ntop4	.symtab	0x8054588	264	FUNC	<unknown>	DEFAULT	2
inet_pton	.symtab	0x80543be	458	FUNC	<unknown>	DEFAULT	2
inet_pton4	.symtab	0x8054338	134	FUNC	<unknown>	DEFAULT	2
initConnection	.symtab	0x804e1f5	309	FUNC	<unknown>	DEFAULT	2
init_rand	.symtab	0x8048204	111	FUNC	<unknown>	DEFAULT	2
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initstate	.symtab	0x8051451	87	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x805167a	171	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x804eb94	63	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ipState.5283	.symtab	0x80594b4	4	OBJECT	<unknown>	DEFAULT	11
isatty	.symtab	0x804ff9c	29	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0x804ebd4	50	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lengthd.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lengthq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/i386/crt1.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/i386/crti.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/i386/crtn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/i386/mmap.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/i386/vfork.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
listFork	.symtab	0x8048f74	268	FUNC	<unknown>	DEFAULT	2
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x8054e38	95	FUNC	<unknown>	DEFAULT	2
macAddress	.symtab	0x80594a8	6	OBJECT	<unknown>	DEFAULT	11
main	.symtab	0x804e32a	1693	FUNC	<unknown>	DEFAULT	2
makeIPPacket	.symtab	0x804c627	126	FUNC	<unknown>	DEFAULT	2
makeRandomStr	.symtab	0x804c1c3	103	FUNC	<unknown>	DEFAULT	2
malloc	.symtab	0x8050726	1908	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
malloc_trim	.symtab	0x805126d	34	FUNC	<unknown>	DEFAULT	2
matchPrompt	.symtab	0x80493ef	257	FUNC	<unknown>	DEFAULT	2
memchr	.symtab	0x8052d18	35	FUNC	<unknown>	DEFAULT	2
memchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memcpy	.symtab	0x804fcc8	39	FUNC	<unknown>	DEFAULT	2
memcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memmove	.symtab	0x8052d3c	39	FUNC	<unknown>	DEFAULT	2
memmove.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mempcpy	.symtab	0x8052d8c	33	FUNC	<unknown>	DEFAULT	2
mempcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memrchr	.symtab	0x8052db0	176	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x804fcf0	21	FUNC	<unknown>	DEFAULT	2
memset.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mmap	.symtab	0x8051f60	27	FUNC	<unknown>	DEFAULT	2
munmap	.symtab	0x8052168	50	FUNC	<unknown>	DEFAULT	2
munmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mylock	.symtab	0x8059368	24	OBJECT	<unknown>	DEFAULT	10
mylock	.symtab	0x8059380	24	OBJECT	<unknown>	DEFAULT	10
mylock	.symtab	0x805f708	24	OBJECT	<unknown>	DEFAULT	11
nanosleep	.symtab	0x805219c	50	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
negotiate	.symtab	0x80492f4	251	FUNC	<unknown>	DEFAULT	2
next_start.1109	.symtab	0x805f4e0	4	OBJECT	<unknown>	DEFAULT	11
ntohl	.symtab	0x805004b	7	FUNC	<unknown>	DEFAULT	2
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0x805003f	12	FUNC	<unknown>	DEFAULT	2
ntop.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
numpids	.symtab	0x80594a0	8	OBJECT	<unknown>	DEFAULT	11
object.2482	.symtab	0x8059484	24	OBJECT	<unknown>	DEFAULT	11
open	.symtab	0x804ec08	75	FUNC	<unknown>	DEFAULT	2
open.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opennameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ourIP	.symtab	0x805f728	4	OBJECT	<unknown>	DEFAULT	11
ourPublicIP	.symtab	0x805f72c	4	OBJECT	<unknown>	DEFAULT	11
p.2427	.symtab	0x8059024	0	OBJECT	<unknown>	DEFAULT	10
passwords	.symtab	0x8059138	4	OBJECT	<unknown>	DEFAULT	10
pids	.symtab	0x805f734	4	OBJECT	<unknown>	DEFAULT	11
poll	.symtab	0x80539b8	54	FUNC	<unknown>	DEFAULT	2
poll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prctl	.symtab	0x804ec6c	63	FUNC	<unknown>	DEFAULT	2
prctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prefix.4202	.symtab	0x80576e5	12	OBJECT	<unknown>	DEFAULT	4
print	.symtab	0x80487fa	584	FUNC	<unknown>	DEFAULT	2
printchar	.symtab	0x804855c	58	FUNC	<unknown>	DEFAULT	2
printi	.symtab	0x80486d5	293	FUNC	<unknown>	DEFAULT	2
prints	.symtab	0x80485fe	215	FUNC	<unknown>	DEFAULT	2
processCmd	.symtab	0x804d3c7	2984	FUNC	<unknown>	DEFAULT	2
qual_chars.4208	.symtab	0x80576f8	20	OBJECT	<unknown>	DEFAULT	4
raise	.symtab	0x805393c	24	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x80513a4	5	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand_alphastr	.symtab	0x8048448	145	FUNC	<unknown>	DEFAULT	2
rand_cmwc	.symtab	0x8048273	192	FUNC	<unknown>	DEFAULT	2
rand_init	.symtab	0x8048333	77	FUNC	<unknown>	DEFAULT	2
rand_next	.symtab	0x8048380	104	FUNC	<unknown>	DEFAULT	2
rand_str	.symtab	0x80483e8	96	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x80513ac	72	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x8058300	40	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x8051585	95	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randtbl	.symtab	0x80593c0	128	OBJECT	<unknown>	DEFAULT	10
rawmemchr	.symtab	0x8054268	99	FUNC	<unknown>	DEFAULT	2
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read	.symtab	0x804ecac	54	FUNC	<unknown>	DEFAULT	2
read.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
readUntil	.symtab	0x80494f0	441	FUNC	<unknown>	DEFAULT	2
read_etc_hosts_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read_until_response	.symtab	0x804909f	90	FUNC	<unknown>	DEFAULT	2
read_with_timeout	.symtab	0x80490f9	163	FUNC	<unknown>	DEFAULT	2
recv	.symtab	0x80504d8	51	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recvLine	.symtab	0x8048c20	396	FUNC	<unknown>	DEFAULT	2
reset_telstate	.symtab	0x80491ec	31	FUNC	<unknown>	DEFAULT	2
sbrk	.symtab	0x80521d0	78	FUNC	<unknown>	DEFAULT	2
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sclose	.symtab	0x804c6a5	47	FUNC	<unknown>	DEFAULT	2
select	.symtab	0x804ece4	63	FUNC	<unknown>	DEFAULT	2
select.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send	.symtab	0x805050c	51	FUNC	<unknown>	DEFAULT	2
send.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sendSTD	.symtab	0x804d2bd	266	FUNC	<unknown>	DEFAULT	2
sendTCP	.symtab	0x804cd2b	1426	FUNC	<unknown>	DEFAULT	2
sendUDP	.symtab	0x804c83a	1265	FUNC	<unknown>	DEFAULT	2
sendto	.symtab	0x8050540	67	FUNC	<unknown>	DEFAULT	2
sendto.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsockopt	.symtab	0x8050584	59	FUNC	<unknown>	DEFAULT	2
setsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate	.symtab	0x80513f4	93	FUNC	<unknown>	DEFAULT	2
setstate_r	.symtab	0x80514ec	153	FUNC	<unknown>	DEFAULT	2
sigaction	.symtab	0x8051e6f	217	FUNC	<unknown>	DEFAULT	2
sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
signal	.symtab	0x80505ec	175	FUNC	<unknown>	DEFAULT	2
signal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigprocmask	.symtab	0x8052220	85	FUNC	<unknown>	DEFAULT	2
sigprocmask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigsetops.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket	.symtab	0x80505c0	43	FUNC	<unknown>	DEFAULT	2
socket.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket_connect	.symtab	0x804afe7	225	FUNC	<unknown>	DEFAULT	2
spec_and_mask.4207	.symtab	0x805770c	16	OBJECT	<unknown>	DEFAULT	4
spec_base.4201	.symtab	0x80576f1	7	OBJECT	<unknown>	DEFAULT	4
spec_chars.4204	.symtab	0x8057735	21	OBJECT	<unknown>	DEFAULT	4
spec_flags.4203	.symtab	0x805774a	8	OBJECT	<unknown>	DEFAULT	4
spec_or_mask.4206	.symtab	0x805771c	16	OBJECT	<unknown>	DEFAULT	4
spec_ranges.4205	.symtab	0x805772c	9	OBJECT	<unknown>	DEFAULT	4
sprintf	.symtab	0x804ee24	31	FUNC	<unknown>	DEFAULT	2
sprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
srand	.symtab	0x80514a8	67	FUNC	<unknown>	DEFAULT	2
srandom	.symtab	0x80514a8	67	FUNC	<unknown>	DEFAULT	2
srandom_r	.symtab	0x80515e4	150	FUNC	<unknown>	DEFAULT	2
static_id	.symtab	0x8059464	2	OBJECT	<unknown>	DEFAULT	10
static_ns	.symtab	0x805f720	4	OBJECT	<unknown>	DEFAULT	11
stderr	.symtab	0x8059210	4	OBJECT	<unknown>	DEFAULT	10
stdin	.symtab	0x8059208	4	OBJECT	<unknown>	DEFAULT	10
stdout	.symtab	0x805920c	4	OBJECT	<unknown>	DEFAULT	10
strcasecmp	.symtab	0x8054f94	54	FUNC	<unknown>	DEFAULT	2
strcasecmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcasestr	.symtab	0x804ff2c	83	FUNC	<unknown>	DEFAULT	2
strcasestr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchr	.symtab	0x804fd08	30	FUNC	<unknown>	DEFAULT	2
strchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcmp	.symtab	0x8054218	29	FUNC	<unknown>	DEFAULT	2
strcmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcoll	.symtab	0x8054218	29	FUNC	<unknown>	DEFAULT	2
strcpy	.symtab	0x804fd28	27	FUNC	<unknown>	DEFAULT	2
strcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strdup	.symtab	0x8054300	54	FUNC	<unknown>	DEFAULT	2
strdup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strerror_r	.symtab	0x804fe5c	183	FUNC	<unknown>	DEFAULT	2
strlen	.symtab	0x804fd44	19	FUNC	<unknown>	DEFAULT	2
strlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncat	.symtab	0x8054238	46	FUNC	<unknown>	DEFAULT	2
strncat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncpy	.symtab	0x8052d64	38	FUNC	<unknown>	DEFAULT	2
strncpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strnlen	.symtab	0x804fd58	25	FUNC	<unknown>	DEFAULT	2
strnlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strpbrk	.symtab	0x8052ebc	39	FUNC	<unknown>	DEFAULT	2
strpbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strspn	.symtab	0x80542cc	50	FUNC	<unknown>	DEFAULT	2
strspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strstr	.symtab	0x804fd74	198	FUNC	<unknown>	DEFAULT	2
strstr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok	.symtab	0x804ff80	25	FUNC	<unknown>	DEFAULT	2
strtok.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok_r	.symtab	0x8052e60	89	FUNC	<unknown>	DEFAULT	2
strtok_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtol	.symtab	0x8051870	26	FUNC	<unknown>	DEFAULT	2
strtol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
successes	.symtab	0x80591a0	16	OBJECT	<unknown>	DEFAULT	10
sysconf	.symtab	0x8051a78	325	FUNC	<unknown>	DEFAULT	2
sysconf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
system	.symtab	0x8051728	305	FUNC	<unknown>	DEFAULT	2
system.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
szprintf	.symtab	0x8048a42	36	FUNC	<unknown>	DEFAULT	2
tcgetattr	.symtab	0x804ffbc	112	FUNC	<unknown>	DEFAULT	2
tcgetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcpcsum	.symtab	0x804c2d2	187	FUNC	<unknown>	DEFAULT	2
time	.symtab	0x804ed24	46	FUNC	<unknown>	DEFAULT	2
time.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
times	.symtab	0x8052278	46	FUNC	<unknown>	DEFAULT	2
times.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tmpdirs	.symtab	0x8059140	44	OBJECT	<unknown>	DEFAULT	10
tolower	.symtab	0x8054e98	29	FUNC	<unknown>	DEFAULT	2
tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
toupper	.symtab	0x804edd8	29	FUNC	<unknown>	DEFAULT	2
toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
trim	.symtab	0x8048b1f	198	FUNC	<unknown>	DEFAULT	2
type_codes	.symtab	0x8057752	24	OBJECT	<unknown>	DEFAULT	4
type_sizes	.symtab	0x805776a	12	OBJECT	<unknown>	DEFAULT	4
unknown.1161	.symtab	0x8057776	14	OBJECT	<unknown>	DEFAULT	4
unlink	.symtab	0x804ed54	46	FUNC	<unknown>	DEFAULT	2
unlink.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
unsafe_state	.symtab	0x8059398	28	OBJECT	<unknown>	DEFAULT	10
useragents	.symtab	0x8059040	236	OBJECT	<unknown>	DEFAULT	10
usernames	.symtab	0x8059134	4	OBJECT	<unknown>	DEFAULT	10
usleep	.symtab	0x8051bc0	48	FUNC	<unknown>	DEFAULT	2
usleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
util_memcpy	.symtab	0x8048501	47	FUNC	<unknown>	DEFAULT	2
util_strcpy	.symtab	0x8048530	44	FUNC	<unknown>	DEFAULT	2
util_strlen	.symtab	0x80484d9	40	FUNC	<unknown>	DEFAULT	2
vfork	.symtab	0x8051f48	21	FUNC	<unknown>	DEFAULT	2
vsnprintf	.symtab	0x804ee44	178	FUNC	<unknown>	DEFAULT	2
vsnprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
w	.symtab	0x805d4cc	4	OBJECT	<unknown>	DEFAULT	11
wait4	.symtab	0x80522a8	59	FUNC	<unknown>	DEFAULT	2
wait4.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
waitpid	.symtab	0x804ed84	26	FUNC	<unknown>	DEFAULT	2
waitpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcrtomb	.symtab	0x80522ec	68	FUNC	<unknown>	DEFAULT	2
wcrtomb.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsnrtombs	.symtab	0x8052350	134	FUNC	<unknown>	DEFAULT	2
wcsnrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsrtombs	.symtab	0x8052330	30	FUNC	<unknown>	DEFAULT	2
wcsrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
write	.symtab	0x804eda0	54	FUNC	<unknown>	DEFAULT	2
write.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
x	.symtab	0x805d4c0	4	OBJECT	<unknown>	DEFAULT	11
xdigits.3116	.symtab	0x80589d4	17	OBJECT	<unknown>	DEFAULT	4
y	.symtab	0x805d4c4	4	OBJECT	<unknown>	DEFAULT	11
z	.symtab	0x805d4c8	4	OBJECT	<unknown>	DEFAULT	11

Network Behavior

Download Network PCAP: filtered – full

Network Port Distribution

Total Packets: 580
• 3131 undefined
• 443 (HTTPS)
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 31, 2025 09:12:59.949821949 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:12:59.949951887 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:00.053821087 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:00.053921938 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:00.484616995 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:00.484817982 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:00.584368944 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:00.584458113 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:00.620345116 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:00.620443106 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:00.717715025 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:00.717812061 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:00.829900980 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:00.830001116 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:01.284073114 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:01.284137964 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:01.383661032 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:01.383733034 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:01.410217047 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:01.410275936 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:01.490912914 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:01.490973949 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:01.515291929 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:01.515337944 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:01.594690084 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:01.594741106 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:01.617364883 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:01.617407084 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:01.662765026 CEST	36048	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:01.713274956 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:01.713355064 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:01.740720987 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:01.740986109 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:01.814796925 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:01.815083981 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:01.832830906 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:01.833132982 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:01.918277025 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:01.918489933 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:01.945628881 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:01.945709944 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:01.996411085 CEST	3131	36048	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:01.996707916 CEST	36050	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:02.022594929 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:02.022676945 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:02.040486097 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:02.040565968 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:02.067473888 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:02.067660093 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:02.123220921 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:02.150469065 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:02.150564909 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:02.173757076 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:02.223777056 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:02.256553888 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:02.276453972 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:02.276568890 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:02.336091042 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:02.383424044 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:02.383465052 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:02.383747101 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:02.401738882 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:02.455842018 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:02.498419046 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:02.498639107 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:02.498742104 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:02.607237101 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:02.607278109 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:02.607352972 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:02.607353926 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:02.715675116 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:02.715936899 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:02.727900028 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:02.728092909 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:02.818213940 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:02.834896088 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:02.835081100 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:02.936101913 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:02.953866959 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:02.953958035 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:02.988461018 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:03.015789986 CEST	36050	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:03.047785997 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:03.072310925 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:03.162524939 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:03.162883043 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:03.264012098 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:03.264051914 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:03.264163017 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:03.264163017 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:03.303783894 CEST	50532	443	192.168.2.13	34.243.160.129
Mar 31, 2025 09:13:03.303966045 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:03.304050922 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:03.340177059 CEST	3131	36050	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:03.340374947 CEST	36052	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:03.364483118 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:03.475733042 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:03.587347984 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:03.587524891 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:03.596297979 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:03.596360922 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:03.669296980 CEST	3131	36052	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:03.669534922 CEST	36054	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:03.693097115 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:03.693208933 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:03.797935963 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:03.798223972 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:03.904778957 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:03.905214071 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:04.003845930 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:04.004041910 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:04.012892962 CEST	3131	36054	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:04.013133049 CEST	36056	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:04.029449940 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:04.029522896 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:04.111007929 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:04.111219883 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:04.342366934 CEST	3131	36056	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:04.342545033 CEST	36058	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:04.499075890 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:04.499450922 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:04.602042913 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:04.602382898 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:04.665956020 CEST	3131	36058	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:04.666124105 CEST	36060	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:04.718405008 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:04.718699932 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:04.736922979 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:04.737066031 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:04.820065022 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:04.820297003 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:04.847790003 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:04.847872972 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:04.925045013 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:04.925235987 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:04.934962034 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:04.935062885 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:04.967221975 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:04.967423916 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:04.996387959 CEST	3131	36060	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:04.996630907 CEST	36062	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:05.033468008 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:05.033659935 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:05.053081989 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:05.053281069 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:05.082046032 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:05.082221031 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:05.153666019 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:05.153764963 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:05.183626890 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:05.183717966 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:05.276293039 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:05.276406050 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:05.319884062 CEST	3131	36062	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:05.320065022 CEST	36064	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:05.387605906 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:05.387687922 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:05.408277035 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:05.408344030 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:05.490475893 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:05.511631012 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:05.511746883 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:05.619048119 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:05.619158983 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:05.631805897 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:05.631872892 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:05.647465944 CEST	3131	36064	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:05.647721052 CEST	36066	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:05.740485907 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:05.740650892 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:05.845757961 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:05.845885992 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:05.951764107 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:05.951869011 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:05.970196009 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:05.970283031 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:05.973897934 CEST	3131	36066	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:05.974056005 CEST	36068	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:06.064467907 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:06.064574003 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:06.076430082 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:06.076493025 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:06.094166040 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:06.094212055 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:06.163060904 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:06.163274050 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:06.178674936 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:06.178788900 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:06.206911087 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:06.207009077 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:06.267515898 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:06.267597914 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:06.281379938 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:06.281445026 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:06.290721893 CEST	3131	36068	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:06.290968895 CEST	36070	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:06.308862925 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:06.308934927 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:06.383855104 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:06.384018898 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:06.400943041 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:06.401072979 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:06.486315966 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:06.486466885 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:06.505007982 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:06.505162954 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:06.598006010 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:06.598275900 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:06.619262934 CEST	3131	36070	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:06.619421005 CEST	36072	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:06.697422981 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:06.697531939 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:06.943171978 CEST	3131	36072	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:06.943361044 CEST	36074	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:07.120873928 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:07.121020079 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:07.252134085 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:07.252247095 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:07.276492119 CEST	3131	36074	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:07.276614904 CEST	36076	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:07.354804039 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:07.354938030 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:07.457284927 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:07.457401991 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:07.484263897 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:07.484325886 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:07.493637085 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:07.600826979 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:07.601943016 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:07.606584072 CEST	3131	36076	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:07.606750965 CEST	36078	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:07.617350101 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:07.617516041 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:08.617732048 CEST	36078	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:08.941668034 CEST	3131	36078	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:08.945849895 CEST	36080	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:08.959011078 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:08.959011078 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:09.064271927 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:09.064301014 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:09.064317942 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:09.064423084 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:09.064471960 CEST	443	48294	199.232.38.49	192.168.2.13
Mar 31, 2025 09:13:09.064529896 CEST	48294	443	192.168.2.13	199.232.38.49
Mar 31, 2025 09:13:09.959702969 CEST	36080	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:11.975764036 CEST	36080	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:12.300019026 CEST	3131	36080	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:12.300223112 CEST	36082	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:12.624350071 CEST	3131	36082	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:12.624660969 CEST	36084	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:12.949202061 CEST	3131	36084	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:12.949378014 CEST	36086	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:13.959748030 CEST	36086	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:14.293463945 CEST	3131	36086	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:14.293756008 CEST	36088	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:14.624706984 CEST	3131	36088	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:14.624948978 CEST	36090	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:15.655709028 CEST	36090	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:15.986371994 CEST	3131	36090	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:15.986633062 CEST	36092	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:16.315069914 CEST	3131	36092	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:16.315388918 CEST	36094	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:16.640729904 CEST	3131	36094	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:16.640949965 CEST	36096	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:16.966367006 CEST	3131	36096	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:16.966651917 CEST	36098	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:17.294014931 CEST	3131	36098	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:17.294239044 CEST	36100	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:17.621706963 CEST	3131	36100	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:17.621963978 CEST	36102	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:17.948100090 CEST	3131	36102	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:17.948312044 CEST	36104	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:18.276655912 CEST	3131	36104	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:18.277097940 CEST	36106	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:18.608050108 CEST	3131	36106	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:18.608303070 CEST	36108	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:18.938565969 CEST	3131	36108	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:18.938803911 CEST	36110	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:19.268271923 CEST	3131	36110	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:19.268584967 CEST	36112	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:19.594510078 CEST	3131	36112	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:19.594836950 CEST	36114	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:20.615736961 CEST	36114	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:20.942635059 CEST	3131	36114	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:20.942950964 CEST	36116	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:21.270299911 CEST	3131	36116	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:21.270692110 CEST	36118	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:21.589174986 CEST	3131	36118	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:21.589479923 CEST	36120	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:22.599807978 CEST	36120	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:22.932416916 CEST	3131	36120	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:22.932678938 CEST	36122	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:23.269664049 CEST	3131	36122	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:23.269903898 CEST	36124	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:23.605616093 CEST	3131	36124	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:23.605846882 CEST	36126	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:23.935668945 CEST	3131	36126	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:23.935925961 CEST	36128	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:24.268141031 CEST	3131	36128	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:24.268414021 CEST	36130	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:24.596112967 CEST	3131	36130	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:24.596352100 CEST	36132	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:24.921540022 CEST	3131	36132	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:24.921914101 CEST	36134	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:25.245301008 CEST	3131	36134	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:25.245543003 CEST	36136	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:25.568753958 CEST	3131	36136	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:25.568942070 CEST	36138	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:26.599788904 CEST	36138	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:26.924427032 CEST	3131	36138	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:26.924881935 CEST	36140	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:27.249264956 CEST	3131	36140	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:27.249511003 CEST	36142	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:27.579585075 CEST	3131	36142	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:27.579793930 CEST	36144	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:28.583842039 CEST	36144	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:28.914697886 CEST	3131	36144	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:28.916270018 CEST	36146	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:29.250334024 CEST	3131	36146	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:29.250675917 CEST	36148	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:29.575082064 CEST	3131	36148	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:29.575522900 CEST	36150	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:29.893773079 CEST	3131	36150	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:29.893979073 CEST	36152	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:30.217639923 CEST	3131	36152	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:30.217812061 CEST	36154	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:30.536798000 CEST	3131	36154	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:30.537297010 CEST	36156	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:31.559782982 CEST	36156	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:31.817228079 CEST	37796	443	192.168.2.13	54.217.10.153
Mar 31, 2025 09:13:31.817275047 CEST	443	37796	54.217.10.153	192.168.2.13
Mar 31, 2025 09:13:31.817368031 CEST	37796	443	192.168.2.13	54.217.10.153
Mar 31, 2025 09:13:31.819228888 CEST	37796	443	192.168.2.13	54.217.10.153
Mar 31, 2025 09:13:31.819243908 CEST	443	37796	54.217.10.153	192.168.2.13
Mar 31, 2025 09:13:31.887428999 CEST	3131	36156	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:31.887660027 CEST	36160	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:32.205806017 CEST	3131	36160	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:32.206330061 CEST	36162	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:32.536144972 CEST	3131	36162	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:32.536508083 CEST	36164	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:32.857528925 CEST	3131	36164	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:32.857891083 CEST	36166	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:33.185170889 CEST	3131	36166	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:33.185408115 CEST	36168	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:33.518668890 CEST	3131	36168	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:33.518974066 CEST	36170	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:33.840075016 CEST	3131	36170	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:33.840291977 CEST	36172	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:34.166805029 CEST	3131	36172	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:34.167066097 CEST	36174	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:34.495189905 CEST	3131	36174	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:34.495512009 CEST	36176	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:34.832240105 CEST	3131	36176	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:34.832483053 CEST	36178	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:35.167848110 CEST	3131	36178	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:35.168190956 CEST	36180	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:35.499954939 CEST	3131	36180	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:35.500431061 CEST	36182	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:36.519689083 CEST	36182	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:38.535731077 CEST	36182	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:38.858479023 CEST	3131	36182	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:38.858807087 CEST	36184	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:39.178359032 CEST	3131	36184	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:39.178792000 CEST	36186	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:40.199892998 CEST	36186	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:42.215821981 CEST	36186	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:42.556638956 CEST	3131	36186	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:42.556925058 CEST	36188	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:42.877957106 CEST	3131	36188	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:42.878153086 CEST	36190	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:43.205745935 CEST	3131	36190	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:43.206023932 CEST	36192	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:43.531908035 CEST	3131	36192	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:43.532227993 CEST	36194	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:43.856455088 CEST	3131	36194	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:43.856692076 CEST	36196	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:44.179831982 CEST	3131	36196	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:44.180176020 CEST	36198	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:44.506645918 CEST	3131	36198	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:44.506886005 CEST	36200	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:44.828308105 CEST	3131	36200	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:44.828598022 CEST	36202	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:45.831840992 CEST	36202	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:46.159517050 CEST	3131	36202	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:46.160082102 CEST	36204	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:46.488352060 CEST	3131	36204	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:46.489123106 CEST	36206	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:47.495698929 CEST	36206	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:47.819763899 CEST	3131	36206	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:47.820034027 CEST	36208	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:48.147490978 CEST	3131	36208	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:48.147736073 CEST	36210	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:48.472755909 CEST	3131	36210	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:48.472991943 CEST	36212	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:48.790806055 CEST	3131	36212	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:48.791143894 CEST	36214	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:49.799813986 CEST	36214	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:50.138262033 CEST	3131	36214	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:50.138766050 CEST	36216	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:51.143693924 CEST	36216	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:51.471188068 CEST	3131	36216	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:51.471520901 CEST	36218	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:52.487818003 CEST	36218	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:54.503691912 CEST	36218	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:54.826803923 CEST	3131	36218	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:54.827125072 CEST	36220	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:55.847847939 CEST	36220	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:56.182780027 CEST	3131	36220	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:56.183187008 CEST	36222	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:56.515635014 CEST	3131	36222	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:56.516133070 CEST	36224	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:56.841716051 CEST	3131	36224	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:56.842166901 CEST	36226	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:57.174210072 CEST	3131	36226	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:57.174546957 CEST	36228	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:57.498974085 CEST	3131	36228	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:57.499371052 CEST	36230	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:57.820880890 CEST	3131	36230	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:57.821161032 CEST	36232	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:58.148801088 CEST	3131	36232	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:58.149154902 CEST	36234	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:58.476775885 CEST	3131	36234	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:58.477029085 CEST	36236	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:59.495728016 CEST	36236	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:13:59.824918985 CEST	3131	36236	167.71.202.74	192.168.2.13
Mar 31, 2025 09:13:59.825243950 CEST	36238	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:00.157059908 CEST	3131	36238	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:00.157267094 CEST	36240	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:00.478302956 CEST	3131	36240	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:00.478612900 CEST	36242	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:00.804421902 CEST	3131	36242	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:00.804632902 CEST	36244	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:01.136713028 CEST	3131	36244	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:01.137008905 CEST	36246	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:01.463196039 CEST	3131	36246	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:01.463577032 CEST	36248	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:01.792069912 CEST	3131	36248	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:01.792445898 CEST	36250	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:02.823700905 CEST	36250	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:04.839654922 CEST	36250	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:09.095875025 CEST	36250	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:09.421082973 CEST	3131	36250	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:09.421390057 CEST	36252	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:09.745258093 CEST	3131	36252	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:09.745596886 CEST	36254	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:10.088361979 CEST	3131	36254	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:10.088680983 CEST	36256	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:11.111720085 CEST	36256	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:11.428672075 CEST	3131	36256	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:11.429003954 CEST	36258	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:11.751138926 CEST	3131	36258	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:11.751499891 CEST	36260	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:12.073781967 CEST	3131	36260	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:12.074214935 CEST	36262	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:12.407517910 CEST	3131	36262	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:12.407908916 CEST	36264	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:12.742430925 CEST	3131	36264	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:12.742676973 CEST	36266	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:13.070426941 CEST	3131	36266	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:13.070636034 CEST	36268	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:13.400753021 CEST	3131	36268	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:13.401103020 CEST	36270	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:13.725270033 CEST	3131	36270	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:13.725667000 CEST	36272	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:14.049711943 CEST	3131	36272	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:14.050084114 CEST	36274	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:14.381047964 CEST	3131	36274	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:14.381516933 CEST	36276	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:14.709244967 CEST	3131	36276	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:14.709737062 CEST	36278	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:15.030903101 CEST	3131	36278	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:15.031390905 CEST	36280	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:15.358241081 CEST	3131	36280	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:15.358643055 CEST	36282	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:15.692888975 CEST	3131	36282	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:15.693515062 CEST	36284	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:16.024405956 CEST	3131	36284	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:16.024873018 CEST	36286	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:16.348741055 CEST	3131	36286	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:16.349123001 CEST	36288	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:16.681917906 CEST	3131	36288	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:16.682267904 CEST	36290	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:17.007128954 CEST	3131	36290	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:17.007436037 CEST	36292	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:17.343895912 CEST	3131	36292	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:17.344372988 CEST	36294	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:17.672357082 CEST	3131	36294	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:17.672657013 CEST	36296	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:17.996494055 CEST	3131	36296	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:17.996759892 CEST	36298	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:18.323595047 CEST	3131	36298	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:18.323842049 CEST	36300	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:18.654413939 CEST	3131	36300	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:18.654653072 CEST	36302	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:18.982728004 CEST	3131	36302	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:18.983098030 CEST	36304	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:20.007879019 CEST	36304	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:20.335302114 CEST	3131	36304	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:20.335640907 CEST	36306	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:20.664469004 CEST	3131	36306	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:20.664885044 CEST	36308	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:20.992973089 CEST	3131	36308	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:20.993320942 CEST	36310	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:22.023948908 CEST	36310	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:22.353319883 CEST	3131	36310	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:22.353880882 CEST	36312	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:22.684907913 CEST	3131	36312	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:22.685389996 CEST	36314	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:23.687942028 CEST	36314	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:24.011336088 CEST	3131	36314	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:24.011765003 CEST	36316	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:25.031975031 CEST	36316	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:25.362679005 CEST	3131	36316	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:25.363013029 CEST	36318	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:25.689591885 CEST	3131	36318	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:25.689801931 CEST	36320	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:26.015758038 CEST	3131	36320	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:26.015928030 CEST	36322	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:26.347556114 CEST	3131	36322	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:26.347898006 CEST	36324	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:26.674557924 CEST	3131	36324	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:26.674927950 CEST	36326	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:27.688005924 CEST	36326	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:28.011795998 CEST	3131	36326	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:28.012115955 CEST	36328	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:28.347969055 CEST	3131	36328	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:28.348357916 CEST	36330	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:28.672410965 CEST	3131	36330	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:28.672683001 CEST	36332	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:29.002305031 CEST	3131	36332	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:29.002715111 CEST	36334	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:29.337841034 CEST	3131	36334	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:29.338335037 CEST	36336	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:29.674103022 CEST	3131	36336	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:29.674341917 CEST	36338	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:30.000319958 CEST	3131	36338	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:30.000559092 CEST	36340	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:30.330720901 CEST	3131	36340	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:30.330996037 CEST	36342	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:31.335968018 CEST	36342	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:31.669466972 CEST	3131	36342	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:31.669702053 CEST	36344	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:31.818020105 CEST	37796	443	192.168.2.13	54.217.10.153
Mar 31, 2025 09:14:31.860275984 CEST	443	37796	54.217.10.153	192.168.2.13
Mar 31, 2025 09:14:32.680071115 CEST	36344	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:33.008491039 CEST	3131	36344	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:33.008766890 CEST	36346	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:33.337035894 CEST	3131	36346	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:33.337528944 CEST	36348	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:33.653220892 CEST	3131	36348	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:33.653570890 CEST	36350	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:33.982702971 CEST	3131	36350	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:33.982964993 CEST	36352	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:34.304203987 CEST	3131	36352	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:34.304593086 CEST	36354	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:34.627942085 CEST	3131	36354	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:34.628422022 CEST	36356	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:34.946438074 CEST	3131	36356	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:34.946964025 CEST	36358	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:35.271404028 CEST	3131	36358	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:35.271718979 CEST	36360	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:35.601917028 CEST	3131	36360	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:35.602257013 CEST	36362	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:35.929833889 CEST	3131	36362	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:35.930186033 CEST	36364	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:36.936120033 CEST	36364	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:37.263735056 CEST	3131	36364	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:37.264132023 CEST	36366	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:37.588347912 CEST	3131	36366	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:37.588649035 CEST	36368	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:37.914135933 CEST	3131	36368	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:37.914414883 CEST	36370	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:38.920207977 CEST	36370	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:39.240447998 CEST	3131	36370	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:39.240727901 CEST	36372	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:39.574413061 CEST	3131	36372	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:39.574719906 CEST	36374	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:39.904941082 CEST	3131	36374	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:39.905347109 CEST	36376	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:40.224320889 CEST	3131	36376	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:40.224729061 CEST	36378	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:40.548093081 CEST	3131	36378	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:40.548475981 CEST	36380	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:40.874644041 CEST	3131	36380	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:40.874883890 CEST	36382	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:41.210067987 CEST	3131	36382	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:41.210287094 CEST	36384	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:41.534910917 CEST	3131	36384	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:41.535142899 CEST	36386	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:41.859446049 CEST	3131	36386	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:41.859674931 CEST	36388	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:42.183012009 CEST	3131	36388	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:42.183320999 CEST	36390	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:43.208169937 CEST	36390	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:43.543776989 CEST	3131	36390	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:43.544032097 CEST	36392	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:43.868536949 CEST	3131	36392	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:43.868798971 CEST	36394	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:44.197573900 CEST	3131	36394	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:44.197773933 CEST	36396	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:44.526314974 CEST	3131	36396	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:44.526685953 CEST	36398	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:44.858629942 CEST	3131	36398	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:44.859050989 CEST	36400	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:45.193372965 CEST	3131	36400	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:45.193620920 CEST	36402	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:45.525732994 CEST	3131	36402	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:45.526277065 CEST	36404	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:45.853636980 CEST	3131	36404	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:45.853914022 CEST	36406	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:46.192622900 CEST	3131	36406	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:46.192992926 CEST	36408	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:46.516850948 CEST	3131	36408	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:46.517213106 CEST	36410	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:46.840778112 CEST	3131	36410	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:46.841101885 CEST	36412	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:47.168637037 CEST	3131	36412	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:47.168987036 CEST	36414	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:47.498966932 CEST	3131	36414	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:47.499237061 CEST	36416	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:47.832247972 CEST	3131	36416	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:47.832664967 CEST	36418	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:48.840244055 CEST	36418	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:49.160120964 CEST	3131	36418	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:49.160454035 CEST	36420	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:49.480345011 CEST	3131	36420	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:49.480652094 CEST	36422	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:49.806843996 CEST	3131	36422	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:49.807198048 CEST	36424	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:50.137701035 CEST	3131	36424	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:50.138122082 CEST	36426	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:50.470366955 CEST	3131	36426	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:50.470851898 CEST	36428	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:50.796377897 CEST	3131	36428	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:50.796813965 CEST	36430	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:51.128823042 CEST	3131	36430	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:51.129209042 CEST	36432	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:51.457834959 CEST	3131	36432	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:51.458348989 CEST	36434	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:51.790997028 CEST	3131	36434	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:51.791415930 CEST	36436	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:52.114772081 CEST	3131	36436	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:52.115078926 CEST	36438	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:52.438668966 CEST	3131	36438	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:52.439058065 CEST	36440	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:52.765078068 CEST	3131	36440	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:52.765387058 CEST	36442	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:53.090099096 CEST	3131	36442	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:53.090543032 CEST	36444	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:54.120330095 CEST	36444	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:54.437582970 CEST	3131	36444	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:54.437979937 CEST	36446	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:54.757282019 CEST	3131	36446	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:54.757564068 CEST	36448	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:55.081757069 CEST	3131	36448	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:55.082148075 CEST	36450	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:55.409753084 CEST	3131	36450	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:55.409971952 CEST	36452	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:55.726411104 CEST	3131	36452	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:55.726623058 CEST	36454	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:56.057686090 CEST	3131	36454	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:56.057904005 CEST	36456	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:57.064312935 CEST	36456	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:59.080441952 CEST	36456	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:59.409518957 CEST	3131	36456	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:59.409755945 CEST	36458	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:14:59.736166954 CEST	3131	36458	167.71.202.74	192.168.2.13
Mar 31, 2025 09:14:59.736463070 CEST	36460	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:00.066785097 CEST	3131	36460	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:00.067264080 CEST	36462	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:00.398797035 CEST	3131	36462	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:00.399066925 CEST	36464	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:01.416512966 CEST	36464	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:01.746576071 CEST	3131	36464	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:01.746905088 CEST	36466	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:02.077193022 CEST	3131	36466	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:02.077750921 CEST	36468	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:03.080444098 CEST	36468	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:03.414911032 CEST	3131	36468	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:03.415116072 CEST	36470	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:03.742821932 CEST	3131	36470	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:03.743148088 CEST	36472	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:04.073894024 CEST	3131	36472	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:04.074402094 CEST	36474	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:05.096400976 CEST	36474	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:05.427514076 CEST	3131	36474	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:05.427953005 CEST	36476	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:05.754956007 CEST	3131	36476	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:05.755373001 CEST	36478	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:06.760466099 CEST	36478	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:08.776464939 CEST	36478	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:09.104412079 CEST	3131	36478	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:09.104768038 CEST	36480	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:09.431572914 CEST	3131	36480	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:09.431823015 CEST	36482	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:09.762073994 CEST	3131	36482	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:09.762315989 CEST	36484	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:10.096764088 CEST	3131	36484	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:10.097105980 CEST	36486	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:10.428217888 CEST	3131	36486	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:10.428467989 CEST	36488	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:10.746948004 CEST	3131	36488	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:10.747296095 CEST	36490	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:11.082521915 CEST	3131	36490	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:11.082835913 CEST	36492	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:11.419759989 CEST	3131	36492	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:11.420119047 CEST	36494	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:12.424588919 CEST	36494	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:12.753329039 CEST	3131	36494	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:12.753669024 CEST	36496	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:13.081147909 CEST	3131	36496	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:13.081511974 CEST	36498	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:13.417186022 CEST	3131	36498	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:13.417512894 CEST	36500	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:13.735763073 CEST	3131	36500	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:13.736047029 CEST	36502	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:14.069761992 CEST	3131	36502	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:14.070152044 CEST	36504	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:14.398709059 CEST	3131	36504	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:14.399245024 CEST	36506	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:14.722364902 CEST	3131	36506	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:14.722611904 CEST	36508	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:15.051503897 CEST	3131	36508	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:15.051780939 CEST	36510	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:15.381155014 CEST	3131	36510	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:15.381400108 CEST	36512	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:15.707923889 CEST	3131	36512	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:15.708157063 CEST	36514	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:16.028646946 CEST	3131	36514	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:16.029004097 CEST	36516	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:16.361148119 CEST	3131	36516	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:16.361361980 CEST	36518	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:16.693685055 CEST	3131	36518	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:16.693919897 CEST	36520	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:17.020993948 CEST	3131	36520	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:17.021331072 CEST	36522	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:17.349025965 CEST	3131	36522	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:17.349342108 CEST	36524	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:17.687640905 CEST	3131	36524	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:17.688141108 CEST	36526	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:18.018894911 CEST	3131	36526	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:18.019099951 CEST	36528	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:18.337086916 CEST	3131	36528	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:18.337398052 CEST	36530	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:19.368594885 CEST	36530	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:19.697411060 CEST	3131	36530	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:19.697788000 CEST	36532	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:20.017891884 CEST	3131	36532	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:20.018264055 CEST	36534	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:20.344312906 CEST	3131	36534	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:20.344943047 CEST	36536	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:20.671279907 CEST	3131	36536	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:20.671729088 CEST	36538	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:20.997195959 CEST	3131	36538	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:20.997694969 CEST	36540	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:21.326180935 CEST	3131	36540	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:21.326483965 CEST	36542	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:21.652167082 CEST	3131	36542	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:21.652441978 CEST	36544	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:21.965179920 CEST	3131	36544	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:21.965636969 CEST	36546	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:22.294004917 CEST	3131	36546	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:22.294600964 CEST	36548	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:22.621917963 CEST	3131	36548	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:22.622355938 CEST	36550	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:22.955029964 CEST	3131	36550	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:22.955457926 CEST	36552	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:23.283088923 CEST	3131	36552	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:23.283552885 CEST	36554	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:24.296637058 CEST	36554	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:24.618962049 CEST	3131	36554	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:24.619221926 CEST	36556	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:25.640628099 CEST	36556	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:25.965585947 CEST	3131	36556	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:25.965764046 CEST	36558	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:26.291470051 CEST	3131	36558	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:26.291697979 CEST	36560	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:27.304709911 CEST	36560	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:27.631477118 CEST	3131	36560	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:27.631850958 CEST	36562	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:28.648710012 CEST	36562	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:28.977659941 CEST	3131	36562	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:28.978029966 CEST	36564	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:29.306096077 CEST	3131	36564	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:29.306451082 CEST	36566	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:29.627804041 CEST	3131	36566	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:29.628113031 CEST	36568	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:30.632698059 CEST	36568	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:30.938795090 CEST	3131	36568	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:30.938998938 CEST	36570	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:31.259651899 CEST	3131	36570	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:31.259824991 CEST	36572	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:31.577322006 CEST	3131	36572	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:31.577481031 CEST	36574	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:31.906725883 CEST	3131	36574	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:31.906932116 CEST	36576	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:32.227250099 CEST	3131	36576	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:32.227479935 CEST	36578	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:32.560035944 CEST	3131	36578	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:32.560414076 CEST	36580	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:33.576725006 CEST	36580	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:33.906250000 CEST	3131	36580	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:33.906466961 CEST	36582	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:34.230747938 CEST	3131	36582	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:34.231232882 CEST	36584	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:34.551832914 CEST	3131	36584	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:34.552143097 CEST	36586	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:35.560801029 CEST	36586	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:35.887284994 CEST	3131	36586	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:35.887660027 CEST	36588	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:36.216464043 CEST	3131	36588	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:36.216736078 CEST	36590	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:37.224890947 CEST	36590	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:37.554614067 CEST	3131	36590	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:37.555068970 CEST	36592	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:37.883222103 CEST	3131	36592	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:37.883512974 CEST	36594	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:38.207083941 CEST	3131	36594	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:38.207386017 CEST	36596	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:38.535762072 CEST	3131	36596	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:38.536055088 CEST	36598	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:38.866781950 CEST	3131	36598	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:38.867002964 CEST	36600	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:39.191910028 CEST	3131	36600	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:39.192311049 CEST	36602	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:39.528059959 CEST	3131	36602	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:39.528573990 CEST	36604	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:39.857371092 CEST	3131	36604	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:39.857959032 CEST	36606	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:40.872811079 CEST	36606	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:41.194581985 CEST	3131	36606	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:41.194885015 CEST	36608	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:42.216794014 CEST	36608	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:42.546610117 CEST	3131	36608	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:42.546825886 CEST	36610	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:42.876974106 CEST	3131	36610	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:42.877372980 CEST	36612	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:43.206341028 CEST	3131	36612	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:43.206563950 CEST	36614	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:43.528846025 CEST	3131	36614	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:43.529196978 CEST	36616	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:43.859134912 CEST	3131	36616	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:43.859462023 CEST	36618	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:44.185264111 CEST	3131	36618	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:44.185831070 CEST	36620	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:44.509922028 CEST	3131	36620	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:44.510459900 CEST	36622	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:44.837620974 CEST	3131	36622	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:44.838004112 CEST	36624	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:45.165165901 CEST	3131	36624	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:45.165508986 CEST	36626	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:45.493377924 CEST	3131	36626	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:45.493674994 CEST	36628	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:45.826163054 CEST	3131	36628	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:45.826567888 CEST	36630	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:46.860774994 CEST	36630	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:47.189093113 CEST	3131	36630	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:47.189253092 CEST	36632	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:48.200790882 CEST	36632	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:48.542118073 CEST	3131	36632	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:48.542776108 CEST	36634	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:48.869482994 CEST	3131	36634	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:48.869631052 CEST	36636	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:49.197024107 CEST	3131	36636	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:49.197345972 CEST	36638	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:49.520901918 CEST	3131	36638	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:49.521187067 CEST	36640	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:49.844471931 CEST	3131	36640	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:49.844690084 CEST	36642	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:50.177838087 CEST	3131	36642	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:50.178280115 CEST	36644	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:50.497421980 CEST	3131	36644	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:50.497678995 CEST	36646	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:50.822850943 CEST	3131	36646	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:50.823335886 CEST	36648	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:51.151148081 CEST	3131	36648	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:51.151366949 CEST	36650	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:51.470716953 CEST	3131	36650	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:51.471036911 CEST	36652	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:51.801789045 CEST	3131	36652	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:51.802117109 CEST	36654	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:52.128882885 CEST	3131	36654	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:52.129004955 CEST	36656	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:52.464030027 CEST	3131	36656	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:52.464478016 CEST	36658	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:52.788995028 CEST	3131	36658	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:52.789443016 CEST	36660	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:53.119473934 CEST	3131	36660	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:53.119818926 CEST	36662	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:53.444333076 CEST	3131	36662	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:53.444603920 CEST	36664	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:53.777635098 CEST	3131	36664	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:53.777896881 CEST	36666	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:54.105110884 CEST	3131	36666	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:54.105447054 CEST	36668	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:54.428842068 CEST	3131	36668	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:54.429307938 CEST	36670	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:54.751288891 CEST	3131	36670	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:54.751724005 CEST	36672	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:55.085978985 CEST	3131	36672	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:55.086361885 CEST	36674	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:55.411489964 CEST	3131	36674	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:55.411879063 CEST	36676	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:55.733691931 CEST	3131	36676	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:55.734015942 CEST	36678	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:56.066281080 CEST	3131	36678	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:56.066652060 CEST	36680	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:57.097028971 CEST	36680	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:57.416739941 CEST	3131	36680	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:57.417114973 CEST	36682	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:57.743886948 CEST	3131	36682	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:57.744343042 CEST	36684	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:58.069924116 CEST	3131	36684	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:58.070125103 CEST	36686	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:58.398931980 CEST	3131	36686	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:58.399224043 CEST	36688	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:58.731446981 CEST	3131	36688	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:58.731723070 CEST	36690	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:59.051734924 CEST	3131	36690	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:59.052050114 CEST	36692	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:59.380587101 CEST	3131	36692	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:59.381027937 CEST	36694	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:15:59.724606991 CEST	3131	36694	167.71.202.74	192.168.2.13
Mar 31, 2025 09:15:59.724845886 CEST	36696	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:00.046381950 CEST	3131	36696	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:00.046740055 CEST	36698	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:00.369050980 CEST	3131	36698	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:00.369424105 CEST	36700	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:00.735776901 CEST	3131	36700	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:00.736041069 CEST	36702	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:01.051862001 CEST	3131	36702	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:01.052290916 CEST	36704	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:01.380765915 CEST	3131	36704	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:01.381249905 CEST	36706	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:02.413080931 CEST	36706	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:02.736406088 CEST	3131	36706	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:02.736860037 CEST	36708	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:03.058109045 CEST	3131	36708	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:03.058476925 CEST	36710	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:03.398730993 CEST	3131	36710	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:03.399008036 CEST	36712	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:04.425091982 CEST	36712	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:04.747447968 CEST	3131	36712	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:04.747792006 CEST	36714	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:05.769176006 CEST	36714	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:06.097008944 CEST	3131	36714	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:06.097373009 CEST	36716	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:07.113070011 CEST	36716	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:07.448296070 CEST	3131	36716	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:07.448602915 CEST	36718	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:07.770378113 CEST	3131	36718	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:07.770915985 CEST	36720	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:08.777091980 CEST	36720	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:09.110677004 CEST	3131	36720	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:09.111191034 CEST	36722	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:09.440304995 CEST	3131	36722	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:09.440649033 CEST	36724	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:09.757647991 CEST	3131	36724	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:09.757893085 CEST	36726	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:10.761089087 CEST	36726	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:11.087845087 CEST	3131	36726	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:11.088119030 CEST	36728	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:11.401609898 CEST	3131	36728	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:11.402196884 CEST	36730	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:11.720834970 CEST	3131	36730	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:11.721290112 CEST	36732	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:12.046113968 CEST	3131	36732	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:12.046392918 CEST	36734	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:12.388757944 CEST	3131	36734	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:12.389034986 CEST	36736	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:12.719644070 CEST	3131	36736	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:12.719981909 CEST	36738	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:13.054709911 CEST	3131	36738	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:13.054929018 CEST	36740	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:13.374877930 CEST	3131	36740	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:13.375185966 CEST	36742	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:13.702189922 CEST	3131	36742	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:13.702405930 CEST	36744	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:14.729130983 CEST	36744	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:15.052639961 CEST	3131	36744	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:15.052911043 CEST	36746	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:15.379343033 CEST	3131	36746	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:15.379673958 CEST	36748	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:15.708313942 CEST	3131	36748	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:15.708641052 CEST	36750	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:16.033004045 CEST	3131	36750	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:16.033301115 CEST	36752	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:17.065212965 CEST	36752	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:17.396667957 CEST	3131	36752	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:17.397047997 CEST	36754	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:17.723275900 CEST	3131	36754	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:17.723685980 CEST	36756	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:18.049544096 CEST	3131	36756	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:18.050000906 CEST	36758	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:18.368781090 CEST	3131	36758	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:18.369069099 CEST	36760	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:18.695749998 CEST	3131	36760	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:18.696089983 CEST	36762	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:19.021466017 CEST	3131	36762	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:19.021869898 CEST	36764	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:19.358191013 CEST	3131	36764	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:19.358557940 CEST	36766	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:20.361202955 CEST	36766	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:20.695441008 CEST	3131	36766	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:20.695763111 CEST	36768	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:21.036401033 CEST	3131	36768	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:21.036603928 CEST	36770	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:21.360330105 CEST	3131	36770	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:21.360567093 CEST	36772	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:21.689768076 CEST	3131	36772	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:21.690063000 CEST	36774	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:22.015513897 CEST	3131	36774	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:22.016124964 CEST	36776	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:22.348860025 CEST	3131	36776	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:22.349308014 CEST	36778	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:22.687016010 CEST	3131	36778	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:22.687309027 CEST	36780	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:23.020816088 CEST	3131	36780	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:23.021188021 CEST	36782	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:23.356734991 CEST	3131	36782	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:23.356941938 CEST	36784	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:23.697957039 CEST	3131	36784	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:23.698338032 CEST	36786	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:24.032176971 CEST	3131	36786	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:24.032525063 CEST	36788	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:24.354043007 CEST	3131	36788	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:24.354224920 CEST	36790	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:24.672553062 CEST	3131	36790	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:24.672897100 CEST	36792	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:24.996540070 CEST	3131	36792	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:24.996757030 CEST	36794	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:25.316621065 CEST	3131	36794	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:25.316843033 CEST	36796	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:25.633801937 CEST	3131	36796	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:25.634047985 CEST	36798	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:25.962397099 CEST	3131	36798	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:25.962671995 CEST	36800	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:26.282789946 CEST	3131	36800	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:26.283324957 CEST	36802	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:26.604943991 CEST	3131	36802	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:26.605367899 CEST	36804	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:26.920438051 CEST	3131	36804	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:26.920747995 CEST	36806	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:27.945223093 CEST	36806	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:28.269988060 CEST	3131	36806	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:28.270232916 CEST	36808	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:29.289316893 CEST	36808	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:31.305381060 CEST	36808	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:31.624639034 CEST	3131	36808	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:31.624835968 CEST	36810	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:31.951956034 CEST	3131	36810	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:31.952187061 CEST	36812	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:32.284008026 CEST	3131	36812	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:32.284368038 CEST	36814	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:32.612982035 CEST	3131	36814	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:32.613372087 CEST	36816	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:32.953560114 CEST	3131	36816	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:32.953901052 CEST	36818	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:33.283545017 CEST	3131	36818	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:33.283921003 CEST	36820	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:33.621294975 CEST	3131	36820	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:33.621849060 CEST	36822	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:33.958028078 CEST	3131	36822	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:33.958255053 CEST	36824	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:34.291630983 CEST	3131	36824	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:34.292072058 CEST	36826	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:34.619481087 CEST	3131	36826	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:34.619776964 CEST	36828	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:34.958070993 CEST	3131	36828	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:34.958551884 CEST	36830	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:35.977499962 CEST	36830	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:36.294667006 CEST	3131	36830	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:36.295223951 CEST	36832	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:36.616904974 CEST	3131	36832	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:36.617438078 CEST	36834	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:36.937664986 CEST	3131	36834	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:36.937956095 CEST	36836	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:37.268681049 CEST	3131	36836	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:37.268910885 CEST	36838	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:37.591348886 CEST	3131	36838	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:37.591639996 CEST	36840	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:37.919225931 CEST	3131	36840	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:37.919420958 CEST	36842	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:38.255242109 CEST	3131	36842	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:38.255587101 CEST	36844	3131	192.168.2.13	167.71.202.74
Mar 31, 2025 09:16:38.579025030 CEST	3131	36844	167.71.202.74	192.168.2.13
Mar 31, 2025 09:16:38.579214096 CEST	36846	3131	192.168.2.13	167.71.202.74

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 31, 2025 09:15:47.000622034 CEST	52728	53	192.168.2.13	1.1.1.1
Mar 31, 2025 09:15:47.000622034 CEST	46660	53	192.168.2.13	1.1.1.1
Mar 31, 2025 09:15:47.189002991 CEST	53	52728	1.1.1.1	192.168.2.13
Mar 31, 2025 09:15:52.003720999 CEST	48314	53	192.168.2.13	8.8.8.8
Mar 31, 2025 09:15:52.113487959 CEST	53	48314	8.8.8.8	192.168.2.13

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 31, 2025 09:15:47.000622034 CEST	192.168.2.13	1.1.1.1	0x8548	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Mar 31, 2025 09:15:47.000622034 CEST	192.168.2.13	1.1.1.1	0x3518	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Mar 31, 2025 09:15:52.003720999 CEST	192.168.2.13	8.8.8.8	0x3518	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 31, 2025 09:15:47.189002991 CEST	1.1.1.1	192.168.2.13	0x8548	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false
Mar 31, 2025 09:15:47.189002991 CEST	1.1.1.1	192.168.2.13	0x8548	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: Execution.i586.elf PID: 5426, Parent PID: 5349

General

Start time (UTC):	07:13:00
Start date (UTC):	31/03/2025
Path:	/tmp/Execution.i586.elf
Arguments:	/tmp/Execution.i586.elf
File size:	95110 bytes
MD5 hash:	38cab14fb23363d3fcd047ee0ed380d8

File Activities

File Opened

File Deleted

File Read

Process Activities

Process Forked

Prctl Requested

Chronological Activities

Analysis Process: Execution.i586.elf PID: 5427, Parent PID: 5426

General

Start time (UTC):	07:13:00
Start date (UTC):	31/03/2025
Path:	/tmp/Execution.i586.elf
Arguments:	-
File size:	95110 bytes
MD5 hash:	38cab14fb23363d3fcd047ee0ed380d8

Process Activities

Process Forked

Chronological Activities

Analysis Process: Execution.i586.elf PID: 5428, Parent PID: 5427

General

Start time (UTC):	07:13:00
Start date (UTC):	31/03/2025
Path:	/tmp/Execution.i586.elf
Arguments:	-
File size:	95110 bytes
MD5 hash:	38cab14fb23363d3fcd047ee0ed380d8

Analysis Process: fwupd PID: 5435, Parent PID: 1

General

Start time (UTC):	07:13:06
Start date (UTC):	31/03/2025
Path:	/usr/libexec/fwupd/fwupd
Arguments:	-
File size:	260616 bytes
MD5 hash:	9baeed1d7c56e92aea5277bdf8b4373f

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: gpgconf PID: 5435, Parent PID: 1

General

Start time (UTC):	07:13:06
Start date (UTC):	31/03/2025
Path:	/usr/bin/gpgconf
Arguments:	/usr/bin/gpgconf --list-dirs
File size:	178848 bytes
MD5 hash:	ddc6865fed36b9020dfd6fe9d360ebbb

File Activities

File Opened

File Read

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: fwupd PID: 5439, Parent PID: 1

General

Start time (UTC):	07:13:06
Start date (UTC):	31/03/2025
Path:	/usr/libexec/fwupd/fwupd
Arguments:	-
File size:	260616 bytes
MD5 hash:	9baeed1d7c56e92aea5277bdf8b4373f

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: gpgconf PID: 5439, Parent PID: 1

General

Start time (UTC):	07:13:06
Start date (UTC):	31/03/2025
Path:	/usr/bin/gpgconf
Arguments:	/usr/bin/gpgconf --list-components
File size:	178848 bytes
MD5 hash:	ddc6865fed36b9020dfd6fe9d360ebbb

File Activities

File Opened

File Read

Chronological Activities

Analysis Process: fwupd PID: 5441, Parent PID: 1

General

Start time (UTC):	07:13:06
Start date (UTC):	31/03/2025
Path:	/usr/libexec/fwupd/fwupd
Arguments:	-
File size:	260616 bytes
MD5 hash:	9baeed1d7c56e92aea5277bdf8b4373f

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: gpg PID: 5441, Parent PID: 1

General

Start time (UTC):	07:13:06
Start date (UTC):	31/03/2025
Path:	/usr/bin/gpg
Arguments:	/usr/bin/gpg --version
File size:	1066992 bytes
MD5 hash:	3c2e7402cc788b3a878a1d2bea56afbf

File Activities

File Opened

File Read

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: fwupd PID: 5443, Parent PID: 1

General

Start time (UTC):	07:13:07
Start date (UTC):	31/03/2025
Path:	/usr/libexec/fwupd/fwupd
Arguments:	-
File size:	260616 bytes
MD5 hash:	9baeed1d7c56e92aea5277bdf8b4373f

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: gpgsm PID: 5443, Parent PID: 1

General

Start time (UTC):	07:13:07
Start date (UTC):	31/03/2025
Path:	/usr/bin/gpgsm
Arguments:	/usr/bin/gpgsm --version
File size:	519416 bytes
MD5 hash:	66be603a7085efc7ee3140d2ff597485

File Activities

File Opened

File Read

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: fwupd PID: 5445, Parent PID: 1

General

Start time (UTC):	07:13:07
Start date (UTC):	31/03/2025
Path:	/usr/libexec/fwupd/fwupd
Arguments:	-
File size:	260616 bytes
MD5 hash:	9baeed1d7c56e92aea5277bdf8b4373f

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: gpgconf PID: 5445, Parent PID: 1

General

Start time (UTC):	07:13:07
Start date (UTC):	31/03/2025
Path:	/usr/bin/gpgconf
Arguments:	/usr/bin/gpgconf --version
File size:	178848 bytes
MD5 hash:	ddc6865fed36b9020dfd6fe9d360ebbb

File Activities

File Opened

File Read

Chronological Activities

Analysis Process: fwupd PID: 5447, Parent PID: 1

General

Start time (UTC):	07:13:07
Start date (UTC):	31/03/2025
Path:	/usr/libexec/fwupd/fwupd
Arguments:	-
File size:	260616 bytes
MD5 hash:	9baeed1d7c56e92aea5277bdf8b4373f

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: gpg PID: 5447, Parent PID: 1

General

Start time (UTC):	07:13:07
Start date (UTC):	31/03/2025
Path:	/usr/bin/gpg
Arguments:	/usr/bin/gpg --version
File size:	1066992 bytes
MD5 hash:	3c2e7402cc788b3a878a1d2bea56afbf

File Activities

File Opened

File Read

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: fwupd PID: 5449, Parent PID: 1

General

Start time (UTC):	07:13:07
Start date (UTC):	31/03/2025
Path:	/usr/libexec/fwupd/fwupd
Arguments:	-
File size:	260616 bytes
MD5 hash:	9baeed1d7c56e92aea5277bdf8b4373f

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: gpg PID: 5449, Parent PID: 1

General

Start time (UTC):	07:13:07
Start date (UTC):	31/03/2025
Path:	/usr/bin/gpg
Arguments:	gpg --enable-special-filenames --batch --no-sk-comments --homedir /var/lib/fwupd/gnupg --status-fd 24 --no-tty --charset utf8 --enable-progress-filter --exit-on-status-write-error --logger-fd 26 --import -- -&27
File size:	1066992 bytes
MD5 hash:	3c2e7402cc788b3a878a1d2bea56afbf

File Activities

File Opened

File Deleted

File Read

File Written

Link Created

System Activities

Query System Information (uname)

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: fwupd PID: 5451, Parent PID: 1

General

Start time (UTC):	07:13:07
Start date (UTC):	31/03/2025
Path:	/usr/libexec/fwupd/fwupd
Arguments:	-
File size:	260616 bytes
MD5 hash:	9baeed1d7c56e92aea5277bdf8b4373f

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: gpg PID: 5451, Parent PID: 1

General

Start time (UTC):	07:13:07
Start date (UTC):	31/03/2025
Path:	/usr/bin/gpg
Arguments:	gpg --enable-special-filenames --batch --no-sk-comments --homedir /var/lib/fwupd/gnupg --status-fd 24 --no-tty --charset utf8 --enable-progress-filter --exit-on-status-write-error --logger-fd 26 --import -- -&27
File size:	1066992 bytes
MD5 hash:	3c2e7402cc788b3a878a1d2bea56afbf

File Activities

File Opened

File Deleted

File Read

File Written

Link Created

System Activities

Query System Information (uname)

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: fwupd PID: 5453, Parent PID: 1

General

Start time (UTC):	07:13:07
Start date (UTC):	31/03/2025
Path:	/usr/libexec/fwupd/fwupd
Arguments:	-
File size:	260616 bytes
MD5 hash:	9baeed1d7c56e92aea5277bdf8b4373f

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: gpg PID: 5453, Parent PID: 1

General

Start time (UTC):	07:13:07
Start date (UTC):	31/03/2025
Path:	/usr/bin/gpg
Arguments:	gpg --enable-special-filenames --batch --no-sk-comments --homedir /var/lib/fwupd/gnupg --status-fd 23 --no-tty --charset utf8 --enable-progress-filter --exit-on-status-write-error --logger-fd 25 --verify -- -&26 -&28
File size:	1066992 bytes
MD5 hash:	3c2e7402cc788b3a878a1d2bea56afbf

File Activities

File Opened

File Deleted

File Read

File Written

Link Created

System Activities

Query System Information (uname)

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: fwupd PID: 5455, Parent PID: 1

General

Start time (UTC):	07:13:07
Start date (UTC):	31/03/2025
Path:	/usr/libexec/fwupd/fwupd
Arguments:	-
File size:	260616 bytes
MD5 hash:	9baeed1d7c56e92aea5277bdf8b4373f

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: gpg PID: 5455, Parent PID: 1

General

Start time (UTC):	07:13:07
Start date (UTC):	31/03/2025
Path:	/usr/bin/gpg
Arguments:	gpg --enable-special-filenames --batch --no-sk-comments --homedir /var/lib/fwupd/gnupg --status-fd 23 --no-tty --charset utf8 --enable-progress-filter --exit-on-status-write-error --logger-fd 25 --verify -- -&26 -&28
File size:	1066992 bytes
MD5 hash:	3c2e7402cc788b3a878a1d2bea56afbf

File Activities

File Opened

File Deleted

File Read

File Written

Link Created

System Activities

Query System Information (uname)

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: dash PID: 5535, Parent PID: 3587

General

Start time (UTC):	07:14:31
Start date (UTC):	31/03/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: rm PID: 5535, Parent PID: 3587

General

Start time (UTC):	07:14:31
Start date (UTC):	31/03/2025
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.IcNJHD1HVS /tmp/tmp.S5Q9IFxQ18 /tmp/tmp.EVb7uYukx7
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

File Activities

File Opened

File Deleted

File Read

Chronological Activities

Analysis Process: dash PID: 5536, Parent PID: 3587

General

Start time (UTC):	07:14:31
Start date (UTC):	31/03/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: rm PID: 5536, Parent PID: 3587

General

Start time (UTC):	07:14:31
Start date (UTC):	31/03/2025
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.IcNJHD1HVS /tmp/tmp.S5Q9IFxQ18 /tmp/tmp.EVb7uYukx7
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report Execution.i586.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Threatname: Gafgyt

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/var/lib/fwupd/gnupg/.#lk0x0000559902faeb80.galassia.5453

/var/lib/fwupd/gnupg/.#lk0x000055ff3f314b80.galassia.5455

/var/lib/fwupd/gnupg/.#lk0x0000560d34accb80.galassia.5449

/var/lib/fwupd/gnupg/.#lk0x00005643bcbacb80.galassia.5451

/var/lib/fwupd/gnupg/pubring.kbx.tmp

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: Execution.i586.elf PID: 5426, Parent PID: 5349

General

File Activities

File Opened

File Deleted

File Read

Process Activities

Linux Analysis Report
Execution.i586.elf