Edit tour

Linux Analysis Report
na.elf

Overview

General Information

Sample name:	na.elf
Analysis ID:	1527395
MD5:	05b3f931897f9ea9e0611b25a49fd099
SHA1:	9a4cff295cf61654bf641adef549516439bcf6e9
SHA256:	a98e1717de8bceb957e9fb56b92888cacd6be7828f8788b8c50a145fb8311bb8
Tags:	elfGafgytuser-abuse_ch
Infos:

Detection

Gafgyt, Mirai

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Gafgyt

Yara detected Mirai

Contains symbols with names commonly found in malware

Machine Learning detection for sample

Opens /proc/net/* files useful for finding connected devices and routers

Detected TCP or UDP traffic on non-standard ports

Sample contains strings that are user agent strings indicative of HTTP manipulation

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1527395
Start date and time:	2024-10-06 23:27:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	na.elf
Detection:	MAL
Classification:	mal100.spre.troj.linELF@0/0@2/0

Warnings

VT rate limit hit for: na.elf

Runtime Messages

Command:	/tmp/na.elf
PID:	5627
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

na.elf (PID: 5627, Parent: 5544, MD5: 05b3f931897f9ea9e0611b25a49fd099) Arguments: /tmp/na.elf

na.elf New Fork (PID: 5628, Parent: 5627)

na.elf New Fork (PID: 5629, Parent: 5628)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
na.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
na.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
na.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x127e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x127f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12808:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1281c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12830:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12844:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12858:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1286c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12880:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12894:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x128a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x128bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x128d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x128e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x128f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1290c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12920:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12934:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12948:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1295c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12970:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
na.elf	Linux_Trojan_Gafgyt_6122acdf	unknown	unknown	0x664:$a: E8 B0 00 FC 8B 7D E8 F2 AE 89 C8 F7 D0 48 48 89 45 F8 EB 03 FF
na.elf	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x14b00:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x16b48:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
na.elf	Linux_Trojan_Gafgyt_1b2e2a3a	unknown	unknown	0x8f1:$a: 83 7D 18 00 74 25 8B 45 1C 83 E0 02 85 C0 74 1B C7 44 24 04 2D 00
na.elf	Linux_Trojan_Gafgyt_9127f7be	unknown	unknown	0xd4e:$a: E4 F7 E1 89 D0 C1 E8 03 89 45 E8 8B 45 E8 01 C0 03 45 E8 C1
Click to see the 2 entries

Memory Dumps

Source	Rule	Description	Author	Strings
5628.1.0000000008048000.0000000008061000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
5628.1.0000000008048000.0000000008061000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5628.1.0000000008048000.0000000008061000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x127e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x127f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12808:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1281c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12830:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12844:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12858:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1286c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12880:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12894:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x128a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x128bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x128d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x128e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x128f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1290c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12920:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12934:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12948:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1295c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12970:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5628.1.0000000008048000.0000000008061000.r-x.sdmp	Linux_Trojan_Gafgyt_6122acdf	unknown	unknown	0x664:$a: E8 B0 00 FC 8B 7D E8 F2 AE 89 C8 F7 D0 48 48 89 45 F8 EB 03 FF
5628.1.0000000008048000.0000000008061000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x14b00:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x16b48:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
5628.1.0000000008048000.0000000008061000.r-x.sdmp	Linux_Trojan_Gafgyt_1b2e2a3a	unknown	unknown	0x8f1:$a: 83 7D 18 00 74 25 8B 45 1C 83 E0 02 85 C0 74 1B C7 44 24 04 2D 00
5628.1.0000000008048000.0000000008061000.r-x.sdmp	Linux_Trojan_Gafgyt_9127f7be	unknown	unknown	0xd4e:$a: E4 F7 E1 89 D0 C1 E8 03 89 45 E8 8B 45 E8 01 C0 03 45 E8 C1
5627.1.0000000008048000.0000000008061000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
5627.1.0000000008048000.0000000008061000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5627.1.0000000008048000.0000000008061000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x127e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x127f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12808:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1281c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12830:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12844:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12858:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1286c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12880:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12894:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x128a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x128bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x128d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x128e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x128f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1290c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12920:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12934:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12948:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1295c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12970:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5627.1.0000000008048000.0000000008061000.r-x.sdmp	Linux_Trojan_Gafgyt_6122acdf	unknown	unknown	0x664:$a: E8 B0 00 FC 8B 7D E8 F2 AE 89 C8 F7 D0 48 48 89 45 F8 EB 03 FF
5627.1.0000000008048000.0000000008061000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x14b00:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x16b48:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
5627.1.0000000008048000.0000000008061000.r-x.sdmp	Linux_Trojan_Gafgyt_1b2e2a3a	unknown	unknown	0x8f1:$a: 83 7D 18 00 74 25 8B 45 1C 83 E0 02 85 C0 74 1B C7 44 24 04 2D 00
5627.1.0000000008048000.0000000008061000.r-x.sdmp	Linux_Trojan_Gafgyt_9127f7be	unknown	unknown	0xd4e:$a: E4 F7 E1 89 D0 C1 E8 03 89 45 E8 8B 45 E8 01 C0 03 45 E8 C1
Process Memory Space: na.elf PID: 5627	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: na.elf PID: 5627	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x2c0b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2c1f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2c33:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2c47:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2c5b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2c6f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2c83:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2c97:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2cab:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2cbf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2cd3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2ce7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2cfb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2d0f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2d23:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2d37:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2d4b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2d5f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2d73:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2d87:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2d9b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: na.elf PID: 5627	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x60aa:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x6317:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x8f42:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: na.elf PID: 5628	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: na.elf PID: 5628	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x2f8f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2fa3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2fb7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2fcb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2fdf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2ff3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3007:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x301b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x302f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3043:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3057:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x306b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x307f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3093:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x30a7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x30bb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x30cf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x30e3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x30f7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x310b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x311f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: na.elf PID: 5628	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x642e:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x669b:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x92c6:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Click to see the 15 entries

Suricata Signatures

ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-06T23:28:12.166662+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33400	57.129.51.86	4258	TCP
2024-10-06T23:28:13.805689+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33402	57.129.51.86	4258	TCP
2024-10-06T23:28:15.467645+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33404	57.129.51.86	4258	TCP
2024-10-06T23:28:17.171835+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33406	57.129.51.86	4258	TCP
2024-10-06T23:28:18.822905+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33408	57.129.51.86	4258	TCP
2024-10-06T23:28:20.464407+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33410	57.129.51.86	4258	TCP
2024-10-06T23:28:22.122092+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33412	57.129.51.86	4258	TCP
2024-10-06T23:28:23.783637+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33414	57.129.51.86	4258	TCP
2024-10-06T23:28:25.435876+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33416	57.129.51.86	4258	TCP
2024-10-06T23:28:27.108437+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33418	57.129.51.86	4258	TCP
2024-10-06T23:28:28.798001+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33420	57.129.51.86	4258	TCP
2024-10-06T23:28:30.428430+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33422	57.129.51.86	4258	TCP
2024-10-06T23:28:32.086735+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33424	57.129.51.86	4258	TCP
2024-10-06T23:28:33.726537+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33426	57.129.51.86	4258	TCP
2024-10-06T23:28:35.404397+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33428	57.129.51.86	4258	TCP
2024-10-06T23:28:37.043325+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33430	57.129.51.86	4258	TCP
2024-10-06T23:28:38.694829+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33432	57.129.51.86	4258	TCP
2024-10-06T23:28:40.360064+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33434	57.129.51.86	4258	TCP
2024-10-06T23:28:42.013472+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33436	57.129.51.86	4258	TCP
2024-10-06T23:28:43.665855+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33438	57.129.51.86	4258	TCP
2024-10-06T23:28:45.303920+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33440	57.129.51.86	4258	TCP
2024-10-06T23:28:46.944450+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33442	57.129.51.86	4258	TCP
2024-10-06T23:28:48.602274+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33444	57.129.51.86	4258	TCP
2024-10-06T23:28:50.257428+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33446	57.129.51.86	4258	TCP
2024-10-06T23:28:51.925316+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33448	57.129.51.86	4258	TCP
2024-10-06T23:28:53.576023+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33450	57.129.51.86	4258	TCP
2024-10-06T23:28:55.223242+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33452	57.129.51.86	4258	TCP
2024-10-06T23:28:56.945797+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33454	57.129.51.86	4258	TCP
2024-10-06T23:28:58.601900+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33456	57.129.51.86	4258	TCP
2024-10-06T23:29:00.246873+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33458	57.129.51.86	4258	TCP
2024-10-06T23:29:01.926634+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33460	57.129.51.86	4258	TCP
2024-10-06T23:29:03.573464+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33462	57.129.51.86	4258	TCP
2024-10-06T23:29:05.215591+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33464	57.129.51.86	4258	TCP
2024-10-06T23:29:06.886520+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33466	57.129.51.86	4258	TCP
2024-10-06T23:29:08.546932+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33468	57.129.51.86	4258	TCP
2024-10-06T23:29:10.212194+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33470	57.129.51.86	4258	TCP
2024-10-06T23:29:11.875548+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33472	57.129.51.86	4258	TCP
2024-10-06T23:29:13.646544+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33474	57.129.51.86	4258	TCP
2024-10-06T23:29:15.296074+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33476	57.129.51.86	4258	TCP
2024-10-06T23:29:16.929125+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33478	57.129.51.86	4258	TCP
2024-10-06T23:29:18.570544+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33480	57.129.51.86	4258	TCP
2024-10-06T23:29:20.209632+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33482	57.129.51.86	4258	TCP
2024-10-06T23:29:21.858532+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33484	57.129.51.86	4258	TCP
2024-10-06T23:29:23.516108+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33486	57.129.51.86	4258	TCP
2024-10-06T23:29:25.171867+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33488	57.129.51.86	4258	TCP
2024-10-06T23:29:26.821236+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33490	57.129.51.86	4258	TCP
2024-10-06T23:29:28.461510+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33492	57.129.51.86	4258	TCP
2024-10-06T23:29:30.102880+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33494	57.129.51.86	4258	TCP
2024-10-06T23:29:31.756981+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33496	57.129.51.86	4258	TCP
2024-10-06T23:29:33.421090+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33498	57.129.51.86	4258	TCP
2024-10-06T23:29:35.076223+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33500	57.129.51.86	4258	TCP
2024-10-06T23:29:36.717256+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33502	57.129.51.86	4258	TCP
2024-10-06T23:29:38.392134+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33504	57.129.51.86	4258	TCP
2024-10-06T23:29:40.042411+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33506	57.129.51.86	4258	TCP
2024-10-06T23:29:41.680956+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33508	57.129.51.86	4258	TCP
2024-10-06T23:29:43.322207+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33510	57.129.51.86	4258	TCP
2024-10-06T23:29:44.969981+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33512	57.129.51.86	4258	TCP
2024-10-06T23:29:46.607238+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33514	57.129.51.86	4258	TCP
2024-10-06T23:29:48.282637+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33516	57.129.51.86	4258	TCP
2024-10-06T23:29:49.934433+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33518	57.129.51.86	4258	TCP
2024-10-06T23:29:51.573945+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33520	57.129.51.86	4258	TCP
2024-10-06T23:29:53.233173+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33522	57.129.51.86	4258	TCP
2024-10-06T23:29:54.890574+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33524	57.129.51.86	4258	TCP
2024-10-06T23:29:56.543534+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33526	57.129.51.86	4258	TCP
2024-10-06T23:29:58.195985+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33528	57.129.51.86	4258	TCP
2024-10-06T23:29:59.837102+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33530	57.129.51.86	4258	TCP
2024-10-06T23:30:01.517136+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33532	57.129.51.86	4258	TCP
2024-10-06T23:30:03.182488+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33534	57.129.51.86	4258	TCP
2024-10-06T23:30:04.836131+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33536	57.129.51.86	4258	TCP
2024-10-06T23:30:06.501669+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33538	57.129.51.86	4258	TCP
2024-10-06T23:30:08.139206+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33540	57.129.51.86	4258	TCP
2024-10-06T23:30:09.793806+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33542	57.129.51.86	4258	TCP
2024-10-06T23:30:11.431631+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33544	57.129.51.86	4258	TCP
2024-10-06T23:30:13.089900+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33546	57.129.51.86	4258	TCP
2024-10-06T23:30:14.748534+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33548	57.129.51.86	4258	TCP
2024-10-06T23:30:16.397097+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33550	57.129.51.86	4258	TCP
2024-10-06T23:30:18.058410+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33552	57.129.51.86	4258	TCP
2024-10-06T23:30:19.701327+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33554	57.129.51.86	4258	TCP
2024-10-06T23:30:21.337551+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33556	57.129.51.86	4258	TCP
2024-10-06T23:30:22.981371+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33558	57.129.51.86	4258	TCP
2024-10-06T23:30:24.623441+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33560	57.129.51.86	4258	TCP
2024-10-06T23:30:26.279536+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33562	57.129.51.86	4258	TCP
2024-10-06T23:30:27.935354+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33564	57.129.51.86	4258	TCP
2024-10-06T23:30:29.572037+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33566	57.129.51.86	4258	TCP
2024-10-06T23:30:31.216551+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33568	57.129.51.86	4258	TCP
2024-10-06T23:30:32.856140+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33570	57.129.51.86	4258	TCP
2024-10-06T23:30:34.511855+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33572	57.129.51.86	4258	TCP
2024-10-06T23:30:36.150004+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33574	57.129.51.86	4258	TCP
2024-10-06T23:30:37.793393+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33576	57.129.51.86	4258	TCP
2024-10-06T23:30:39.455309+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33578	57.129.51.86	4258	TCP
2024-10-06T23:30:41.107008+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33580	57.129.51.86	4258	TCP
2024-10-06T23:30:42.767902+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33582	57.129.51.86	4258	TCP
2024-10-06T23:30:44.443802+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33584	57.129.51.86	4258	TCP
2024-10-06T23:30:46.098008+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33586	57.129.51.86	4258	TCP
2024-10-06T23:30:47.749144+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33588	57.129.51.86	4258	TCP
2024-10-06T23:30:49.406640+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33590	57.129.51.86	4258	TCP
2024-10-06T23:30:51.043183+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33592	57.129.51.86	4258	TCP
2024-10-06T23:30:52.685393+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33594	57.129.51.86	4258	TCP
2024-10-06T23:30:54.325358+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33596	57.129.51.86	4258	TCP
2024-10-06T23:30:55.963469+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33598	57.129.51.86	4258	TCP
2024-10-06T23:30:57.632531+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33602	57.129.51.86	4258	TCP
2024-10-06T23:30:59.275819+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33604	57.129.51.86	4258	TCP
2024-10-06T23:31:00.933337+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33606	57.129.51.86	4258	TCP
2024-10-06T23:31:02.625566+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33608	57.129.51.86	4258	TCP
2024-10-06T23:31:04.282353+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33610	57.129.51.86	4258	TCP
2024-10-06T23:31:05.936015+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33612	57.129.51.86	4258	TCP
2024-10-06T23:31:07.572524+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33614	57.129.51.86	4258	TCP
2024-10-06T23:31:09.219642+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33616	57.129.51.86	4258	TCP
2024-10-06T23:31:10.855641+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33618	57.129.51.86	4258	TCP
2024-10-06T23:31:12.494933+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33620	57.129.51.86	4258	TCP
2024-10-06T23:31:14.155357+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33622	57.129.51.86	4258	TCP
2024-10-06T23:31:15.812603+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33624	57.129.51.86	4258	TCP
2024-10-06T23:31:17.472032+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33626	57.129.51.86	4258	TCP
2024-10-06T23:31:19.120256+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33628	57.129.51.86	4258	TCP
2024-10-06T23:31:20.778947+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33630	57.129.51.86	4258	TCP
2024-10-06T23:31:22.433404+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33632	57.129.51.86	4258	TCP
2024-10-06T23:31:24.094348+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33634	57.129.51.86	4258	TCP
2024-10-06T23:31:25.792867+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33636	57.129.51.86	4258	TCP
2024-10-06T23:31:27.436126+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33638	57.129.51.86	4258	TCP
2024-10-06T23:31:29.074655+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33640	57.129.51.86	4258	TCP
2024-10-06T23:31:30.730744+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33642	57.129.51.86	4258	TCP
2024-10-06T23:31:32.401506+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33644	57.129.51.86	4258	TCP
2024-10-06T23:31:34.041177+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33646	57.129.51.86	4258	TCP
2024-10-06T23:31:35.684131+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33648	57.129.51.86	4258	TCP
2024-10-06T23:31:37.344695+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33650	57.129.51.86	4258	TCP
2024-10-06T23:31:38.997197+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33652	57.129.51.86	4258	TCP
2024-10-06T23:31:40.750549+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33654	57.129.51.86	4258	TCP
2024-10-06T23:31:42.422727+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33656	57.129.51.86	4258	TCP
2024-10-06T23:31:44.080803+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33658	57.129.51.86	4258	TCP
2024-10-06T23:31:45.714659+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33660	57.129.51.86	4258	TCP
2024-10-06T23:31:47.354585+0200	2846526	1	A Network Trojan was detected	192.168.2.14	33662	57.129.51.86	4258	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: na.elf

Avira: detected

Found malware configuration

Source: na.elf

Malware Configuration Extractor: Gafgyt {"C2 url": "57.129.51.86:4258"}

Multi AV Scanner detection for submitted file

Source: na.elf

ReversingLabs: Detection: 68%

Machine Learning detection for sample

Source: na.elf

Joe Sandbox ML: detected

Spreading

Opens /proc/net/* files useful for finding connected devices and routers

Source: /tmp/na.elf (PID: 5627)

Opens: /proc/net/route

Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33470 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33468 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33432 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33506 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33450 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33498 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33408 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33536 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33482 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33452 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33440 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33570 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33434 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33520 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33410 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33572 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33418 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33556 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33428 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33594 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33642 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33406 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33426 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33542 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33400 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33554 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33484 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33412 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33598 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33424 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33438 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33416 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33454 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33460 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33414 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33492 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33514 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33402 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33496 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33502 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33442 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33436 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33474 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33592 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33510 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33584 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33516 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33472 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33458 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33638 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33524 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33490 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33650 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33530 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33610 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33404 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33608 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33444 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33448 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33640 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33588 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33430 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33590 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33500 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33528 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33476 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33466 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33618 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33596 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33488 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33606 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33626 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33494 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33422 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33456 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33462 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33478 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33582 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33480 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33558 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33544 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33522 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33630 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33420 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33512 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33486 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33624 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33602 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33658 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33532 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33446 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33504 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33586 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33534 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33616 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33550 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33546 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33552 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33660 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33560 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33628 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33508 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33564 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33464 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33578 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33634 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33526 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33580 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33632 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33654 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33614 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33576 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33538 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33646 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33656 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33562 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33620 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33518 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33574 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33612 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33566 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33622 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33604 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33644 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33662 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33540 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33652 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33648 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33548 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33568 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:33636 -> 57.129.51.86:4258

Source: global traffic

TCP traffic: 192.168.2.14:33400 -> 57.129.51.86:4258

Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

Source: na.elf	String found in binary or memory: http://fast.no/support/crawler.asp)
Source: na.elf	String found in binary or memory: http://feedback.redkolibri.com/
Source: na.elf	String found in binary or memory: http://www.baidu.com/search/spider.htm)
Source: na.elf	String found in binary or memory: http://www.baidu.com/search/spider.html)
Source: na.elf	String found in binary or memory: http://www.billybobbot.com/crawler/)

System Summary

Malicious sample detected (through community Yara rule)

Source: na.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: na.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_6122acdf Author: unknown
Source: na.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: na.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_1b2e2a3a Author: unknown
Source: na.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_9127f7be Author: unknown
Source: 5628.1.0000000008048000.0000000008061000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5628.1.0000000008048000.0000000008061000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6122acdf Author: unknown
Source: 5628.1.0000000008048000.0000000008061000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5628.1.0000000008048000.0000000008061000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_1b2e2a3a Author: unknown
Source: 5628.1.0000000008048000.0000000008061000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9127f7be Author: unknown
Source: 5627.1.0000000008048000.0000000008061000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5627.1.0000000008048000.0000000008061000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6122acdf Author: unknown
Source: 5627.1.0000000008048000.0000000008061000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5627.1.0000000008048000.0000000008061000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_1b2e2a3a Author: unknown
Source: 5627.1.0000000008048000.0000000008061000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9127f7be Author: unknown
Source: Process Memory Space: na.elf PID: 5627, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: na.elf PID: 5627, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: na.elf PID: 5628, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: na.elf PID: 5628, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown

Contains symbols with names commonly found in malware

Source: ELF static info symbol of initial sample	Name: httpattack
Source: ELF static info symbol of initial sample	Name: vseattack

Source: na.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: na.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_6122acdf os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 283275705c729be23d7dc75056388ecae00390bd25ee7b66b0cfc9b85feee212, id = 6122acdf-1eef-45ea-83ea-699d21c2dc20, last_modified = 2021-09-16
Source: na.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: na.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_1b2e2a3a reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 6f24b67d0a6a4fc4e1cfea5a5414b82af1332a3e6074eb2178aee6b27702b407, id = 1b2e2a3a-1302-41c7-be99-43edb5563294, last_modified = 2021-09-16
Source: na.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_9127f7be reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 72c742cb8b11ddf030e10f67e13c0392748dcd970394ec77ace3d2baa705a375, id = 9127f7be-6e82-46a1-9f11-0b3570b0cd76, last_modified = 2021-09-16
Source: 5628.1.0000000008048000.0000000008061000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5628.1.0000000008048000.0000000008061000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6122acdf os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 283275705c729be23d7dc75056388ecae00390bd25ee7b66b0cfc9b85feee212, id = 6122acdf-1eef-45ea-83ea-699d21c2dc20, last_modified = 2021-09-16
Source: 5628.1.0000000008048000.0000000008061000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5628.1.0000000008048000.0000000008061000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_1b2e2a3a reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 6f24b67d0a6a4fc4e1cfea5a5414b82af1332a3e6074eb2178aee6b27702b407, id = 1b2e2a3a-1302-41c7-be99-43edb5563294, last_modified = 2021-09-16
Source: 5628.1.0000000008048000.0000000008061000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9127f7be reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 72c742cb8b11ddf030e10f67e13c0392748dcd970394ec77ace3d2baa705a375, id = 9127f7be-6e82-46a1-9f11-0b3570b0cd76, last_modified = 2021-09-16
Source: 5627.1.0000000008048000.0000000008061000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5627.1.0000000008048000.0000000008061000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6122acdf os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 283275705c729be23d7dc75056388ecae00390bd25ee7b66b0cfc9b85feee212, id = 6122acdf-1eef-45ea-83ea-699d21c2dc20, last_modified = 2021-09-16
Source: 5627.1.0000000008048000.0000000008061000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5627.1.0000000008048000.0000000008061000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_1b2e2a3a reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 6f24b67d0a6a4fc4e1cfea5a5414b82af1332a3e6074eb2178aee6b27702b407, id = 1b2e2a3a-1302-41c7-be99-43edb5563294, last_modified = 2021-09-16
Source: 5627.1.0000000008048000.0000000008061000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9127f7be reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 72c742cb8b11ddf030e10f67e13c0392748dcd970394ec77ace3d2baa705a375, id = 9127f7be-6e82-46a1-9f11-0b3570b0cd76, last_modified = 2021-09-16
Source: Process Memory Space: na.elf PID: 5627, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: na.elf PID: 5627, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: na.elf PID: 5628, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: na.elf PID: 5628, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.spre.troj.linELF@0/0@2/0

Source: na.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/i386/crt1.S
Source: na.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/i386/crti.S
Source: na.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/i386/crtn.S
Source: na.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/i386/mmap.S
Source: na.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/i386/vfork.S

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match	File source: na.elf, type: SAMPLE
Source: Yara match	File source: 5628.1.0000000008048000.0000000008061000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5627.1.0000000008048000.0000000008061000.r-x.sdmp, type: MEMORY

Yara detected Mirai

Source: Yara match	File source: na.elf, type: SAMPLE
Source: Yara match	File source: 5628.1.0000000008048000.0000000008061000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5627.1.0000000008048000.0000000008061000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: na.elf PID: 5627, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5628, type: MEMORYSTR

Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36
Source: Initial sample	User agent string found: Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; rv:2.2) Gecko/20110201
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.2; U; ru) Presto/2.5.22 Version/10.51
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko
Source: Initial sample	User agent string found: Mozilla/5.0 (Android; Linux armv7l; rv:9.0) Gecko/20111216 Firefox/9.0 Fennec/9.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60
Source: Initial sample	User agent string found: Mozilla/5.0 (iPad; U; CPU OS 5_1 like Mac OS X) AppleWebKit/531.21.10 (KHTML, like Gecko) Version/4.0.4 Mobile/7B367 Safari/531.21.10 UCBrowser/3.4.3.532
Source: Initial sample	User agent string found: Mozilla/5.0 (Nintendo WiiU) AppleWebKit/536.30 (KHTML, like Gecko) NX/3.0.4.2.12 NintendoBrowser/4.3.1.11264.US
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:25.0) Gecko/20100101 Firefox/25.0
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; pl) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; en) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; ja) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; cn) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; fr) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20100101 Firefox/12.0
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; U; Linux x86_64; de; rv:1.9.2.8) Gecko/20100723 Ubuntu/10.04 (lucid) Firefox/3.6.8
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; rv:13.0) Gecko/20100101 Firefox/13.0.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:11.0) Gecko/20100101 Firefox/11.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:13.0) Gecko/20100101 Firefox/13.0.1
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.289 Version/12.01
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.02
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.0) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.112 Safari/535.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en; rv:1.8.1.11) Gecko/20071128 Camino/1.5.4
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; cs; rv:1.9.2.6) Gecko/20100628 myibrow/4alpha2
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Win 9x 4.90; SG; rv:1.9.2.4) Gecko/20101104 Netscape/9.1.0285
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.2.0 Lightning/4.0.2
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10; rv:33.0) Gecko/20100101 Firefox/33.0

Remote Access Functionality

Yara detected Gafgyt

Source: Yara match	File source: na.elf, type: SAMPLE
Source: Yara match	File source: 5628.1.0000000008048000.0000000008061000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5627.1.0000000008048000.0000000008061000.r-x.sdmp, type: MEMORY

Yara detected Mirai

Source: Yara match	File source: na.elf, type: SAMPLE
Source: Yara match	File source: 5628.1.0000000008048000.0000000008061000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5627.1.0000000008048000.0000000008061000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: na.elf PID: 5627, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5628, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	OS Credential Dumping	1 Remote System Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

Threatname: Gafgyt

{"C2 url": "57.129.51.86:4258"}

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label
na.elf	68%	ReversingLabs	Linux.Trojan.LnxGafgyt
na.elf	100%	Avira	LINUX/Mirai.Gafgyt.
na.elf	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.24	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
57.129.51.86:4258	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://www.baidu.com/search/spider.html)	na.elf	false	unknown
http://www.billybobbot.com/crawler/)	na.elf	false	unknown
http://fast.no/support/crawler.asp)	na.elf	false	unknown
http://feedback.redkolibri.com/	na.elf	false	unknown
http://www.baidu.com/search/spider.htm)	na.elf	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
57.129.51.86	unknown	Belgium		2686	ATGS-MMD-ASUS	true

Joe Sandbox View / Context

IPs

⊘No context

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	na.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.25
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.24
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.25
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.25
	x86.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	arm6.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.25
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.25
	na.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	na.elf	Get hash	malicious	Unknown	Browse	162.213.35.25

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ATGS-MMD-ASUS	x86.elf	Get hash	malicious	Mirai	Browse	33.142.84.92
	na.elf	Get hash	malicious	Mirai	Browse	34.28.143.151
	na.elf	Get hash	malicious	Unknown	Browse	56.177.161.22
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	51.60.149.163
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	48.82.49.24
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	32.22.246.59
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	48.11.106.110
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	32.201.63.95
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	48.8.237.251
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	57.63.222.41

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, not stripped
Entropy (8bit):	6.567015165801767
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	na.elf
File size:	127'460 bytes
MD5:	05b3f931897f9ea9e0611b25a49fd099
SHA1:	9a4cff295cf61654bf641adef549516439bcf6e9
SHA256:	a98e1717de8bceb957e9fb56b92888cacd6be7828f8788b8c50a145fb8311bb8
SHA512:	4bf53e7b6e7fbfbaededea80bb76336101728bb9b0077147f9f547bbb515f6ec3a6b2de3b769990bb9accf04941b69507bbc938b0fc7ddf33decabb477aa0bf6
SSDEEP:	3072:EWpbc37+Qp2nrkGJc/l5h1Y7rCmJC0OzQaGyPZk:E9Lyc/l5h1XmJC0OzQaGyPZk
TLSH:	27C319F9E30BC6F3C40316F2125BEAA70D21B1B7166AA985E7282D70EF734C62555F48
File Content Preview:	.ELF....................h...4...........4. ...(..........................................................j..........Q.td............................U..S.......w....h........[]...$.............U......=.....t..1....$......$.......u........t...$.............

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8048168
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	106384
Section Header Size:	40
Number of Section Headers:	16
Header String Table Index:	13

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x8048094	0x94	0x1c	0x0	0x6	AX	0	0	1
.text	PROGBITS	0x80480b0	0xb0	0x110c4	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x8059174	0x11174	0x17	0x0	0x6	AX	0	0	1
.rodata	PROGBITS	0x80591a0	0x111a0	0x7e00	0x0	0x2	A	0	0	32
.eh_frame	PROGBITS	0x8060fa0	0x18fa0	0x4	0x0	0x2	A	0	0	4
.ctors	PROGBITS	0x8061000	0x19000	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x8061008	0x19008	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x8061010	0x19010	0x4	0x0	0x3	WA	0	0	4
.got.plt	PROGBITS	0x8061014	0x19014	0xc	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x8061020	0x19020	0x3c0	0x0	0x3	WA	0	0	32
.bss	NOBITS	0x80613e0	0x193e0	0x66e4	0x0	0x3	WA	0	0	32
.comment	PROGBITS	0x0	0x193e0	0xb40	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x19f20	0x6f	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x1a210	0x2d90	0x10	0x0		15	262	4
.strtab	STRTAB	0x0	0x1cfa0	0x2244	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8048000	0x8048000	0x18fa4	0x18fa4	6.6742	0x5	R E	0x1000	.init .text .fini .rodata .eh_frame
LOAD	0x19000	0x8061000	0x8061000	0x3e0	0x6ac4	4.1128	0x6	RW	0x1000	.ctors .dtors .jcr .got.plt .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x8048094	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80480b0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x8059174	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x80591a0	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x8060fa0	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x8061000	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x8061008	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x8061010	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x8061014	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x8061020	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x80613e0	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
C.111.5166	.symtab	0x805bb00	48	OBJECT	<unknown>	DEFAULT	4
C.148.5485	.symtab	0x805bf70	24	OBJECT	<unknown>	DEFAULT	4
C.204.6106	.symtab	0x805c560	92	OBJECT	<unknown>	DEFAULT	4
C.207.6220	.symtab	0x805cd40	1144	OBJECT	<unknown>	DEFAULT	4
C.211.6259	.symtab	0x805e904	24	OBJECT	<unknown>	DEFAULT	4
C.215.6292	.symtab	0x805eb24	24	OBJECT	<unknown>	DEFAULT	4
C.229.6439	.symtab	0x805ed80	1128	OBJECT	<unknown>	DEFAULT	4
C.271.6739	.symtab	0x805f300	96	OBJECT	<unknown>	DEFAULT	4
C.276.6789	.symtab	0x805f4a0	36	OBJECT	<unknown>	DEFAULT	4
DNSw	.symtab	0x804e46b	667	FUNC	<unknown>	DEFAULT	2
HIPER_OVH	.symtab	0x804cf25	399	FUNC	<unknown>	DEFAULT	2
Q	.symtab	0x8061420	16384	OBJECT	<unknown>	DEFAULT	11
Randhex	.symtab	0x804d801	399	FUNC	<unknown>	DEFAULT	2
SendCloudflare	.symtab	0x804ba19	387	FUNC	<unknown>	DEFAULT	2
SendDOMINATE	.symtab	0x804dabb	1156	FUNC	<unknown>	DEFAULT	2
SendHOME1	.symtab	0x804d0b4	312	FUNC	<unknown>	DEFAULT	2
SendHOME2	.symtab	0x804d1ec	312	FUNC	<unknown>	DEFAULT	2
SendHTTPCloudflare	.symtab	0x804bb9c	387	FUNC	<unknown>	DEFAULT	2
SendHTTPHex	.symtab	0x804b6bb	431	FUNC	<unknown>	DEFAULT	2
SendOVH_STORM	.symtab	0x804c324	3073	FUNC	<unknown>	DEFAULT	2
SendSTD	.symtab	0x804a4aa	290	FUNC	<unknown>	DEFAULT	2
SendSTDHEX	.symtab	0x8049d06	312	FUNC	<unknown>	DEFAULT	2
SendSTD_HEX	.symtab	0x804a6f7	312	FUNC	<unknown>	DEFAULT	2
SendUDP	.symtab	0x8049435	850	FUNC	<unknown>	DEFAULT	2
UDPRAW	.symtab	0x804d5ab	299	FUNC	<unknown>	DEFAULT	2
_GLOBAL_OFFSET_TABLE_	.symtab	0x8061014	0	OBJECT	<unknown>	HIDDEN	9
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x8061004	0	OBJECT	<unknown>	DEFAULT	6
__CTOR_LIST__	.symtab	0x8061000	0	OBJECT	<unknown>	DEFAULT	6
__C_ctype_b	.symtab	0x8061158	4	OBJECT	<unknown>	DEFAULT	10
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x805f660	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x80613d8	4	OBJECT	<unknown>	DEFAULT	10
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x8060ca0	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x8061160	4	OBJECT	<unknown>	DEFAULT	10
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x805f960	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x806100c	0	OBJECT	<unknown>	DEFAULT	7
__DTOR_LIST__	.symtab	0x8061008	0	OBJECT	<unknown>	DEFAULT	7
__EH_FRAME_BEGIN__	.symtab	0x8060fa0	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x8060fa0	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x8061158	4	OBJECT	<unknown>	HIDDEN	10
__GI___C_ctype_b_data	.symtab	0x805f660	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_tolower	.symtab	0x80613d8	4	OBJECT	<unknown>	HIDDEN	10
__GI___C_ctype_tolower_data	.symtab	0x8060ca0	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_toupper	.symtab	0x8061160	4	OBJECT	<unknown>	HIDDEN	10
__GI___C_ctype_toupper_data	.symtab	0x805f960	768	OBJECT	<unknown>	HIDDEN	4
__GI___ctype_b	.symtab	0x806115c	4	OBJECT	<unknown>	HIDDEN	10
__GI___ctype_tolower	.symtab	0x80613dc	4	OBJECT	<unknown>	HIDDEN	10
__GI___ctype_toupper	.symtab	0x8061164	4	OBJECT	<unknown>	HIDDEN	10
__GI___errno_location	.symtab	0x8052bb0	6	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x8058d90	220	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x8053c1c	29	FUNC	<unknown>	HIDDEN	2
__GI___h_errno_location	.symtab	0x80561b0	6	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x8052780	87	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl64	.symtab	0x80527d8	63	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x80529f4	75	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x8055b40	63	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x8055bb7	64	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x8053c3c	182	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x8052818	40	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x8055048	273	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x8055614	20	FUNC	<unknown>	HIDDEN	2
__GI_atol	.symtab	0x8055614	20	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x8057820	54	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0x8052874	46	FUNC	<unknown>	HIDDEN	2
__GI_clock_getres	.symtab	0x8055f44	50	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x80528a4	46	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x80541d0	43	FUNC	<unknown>	HIDDEN	2
__GI_errno	.symtab	0x8067660	4	OBJECT	<unknown>	HIDDEN	11
__GI_execl	.symtab	0x80557d0	105	FUNC	<unknown>	HIDDEN	2
__GI_execve	.symtab	0x8055f78	54	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x8055768	103	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x80578a8	271	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x8052780	87	FUNC	<unknown>	HIDDEN	2
__GI_fcntl64	.symtab	0x80527d8	63	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x8057f38	333	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x8058d90	220	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x8057df0	98	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x8058088	105	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x80579b8	24	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x80528d4	38	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x80539f4	49	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x80579d0	27	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x80579ec	231	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x8053a28	120	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x8058d90	220	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x80528fc	37	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x8055fb0	38	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x8055fd8	38	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x8056000	38	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname	.symtab	0x8053e6c	48	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x8053e9c	818	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x8056028	17	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x8052924	38	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x805294c	50	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x80541fc	43	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x805603c	38	FUNC	<unknown>	HIDDEN	2
__GI_h_errno	.symtab	0x8067664	4	OBJECT	<unknown>	HIDDEN	11
__GI_inet_addr	.symtab	0x8053e44	37	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x8056d9c	148	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa	.symtab	0x8053e2f	21	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa_r	.symtab	0x8053de0	79	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x8058575	465	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x805829a	458	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x8055435	171	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x8052980	63	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x8053d28	29	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x80529c0	50	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x8058d18	86	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x8056bd0	35	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x8053aa0	39	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x8056bf4	39	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x8056c44	33	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x8056c68	176	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x8053ac8	21	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x8055eb8	27	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x8056064	50	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x8056098	50	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x80529f4	75	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x8057870	54	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x80577f4	24	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x8055164	72	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x805533d	94	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x8058144	99	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x8052a58	54	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x8054264	51	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x80560cc	78	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x8052a90	63	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x8054298	51	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x80542cc	67	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x8052ad0	38	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x8054310	59	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x80552a4	153	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x8055dc3	218	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x8054378	175	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x805611c	85	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x805583c	393	FUNC	<unknown>	HIDDEN	2
__GI_snprintf	.symtab	0x8052bb8	33	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x805434c	43	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x8052bdc	31	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x805539b	154	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x8058e6c	54	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x8053ae0	30	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x80580f4	29	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x80580f4	29	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x8053b00	27	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x80581dc	54	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x8053b1c	19	FUNC	<unknown>	HIDDEN	2
__GI_strncat	.symtab	0x8058114	46	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x8056c1c	38	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x8053b30	25	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x8056d74	39	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x80581a8	50	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x8053b4c	206	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x8053d0c	25	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x8056d18	89	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x8055628	26	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x80559c8	325	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x8053d48	112	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x8052af8	46	FUNC	<unknown>	HIDDEN	2
__GI_tolower	.symtab	0x8058d70	29	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x8052b90	29	FUNC	<unknown>	HIDDEN	2
__GI_vfork	.symtab	0x8055ea0	21	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x8052bfc	176	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x8056174	59	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x8052b28	26	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x80561b8	69	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x8056220	133	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x8056200	30	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x8052b44	54	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x8061010	0	OBJECT	<unknown>	DEFAULT	8
__JCR_LIST__	.symtab	0x8061010	0	OBJECT	<unknown>	DEFAULT	8
__app_fini	.symtab	0x8067654	4	OBJECT	<unknown>	HIDDEN	11
__atexit_lock	.symtab	0x80613a0	24	OBJECT	<unknown>	DEFAULT	10
__bsd_signal	.symtab	0x8054378	175	FUNC	<unknown>	HIDDEN	2
__bss_start	.symtab	0x80613e0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x8055b83	52	FUNC	<unknown>	DEFAULT	2
__ctype_b	.symtab	0x806115c	4	OBJECT	<unknown>	DEFAULT	10
__ctype_tolower	.symtab	0x80613dc	4	OBJECT	<unknown>	DEFAULT	10
__ctype_toupper	.symtab	0x8061164	4	OBJECT	<unknown>	DEFAULT	10
__curbrk	.symtab	0x8067684	4	OBJECT	<unknown>	HIDDEN	11
__data_start	.symtab	0x8061028	0	NOTYPE	<unknown>	DEFAULT	10
__decode_answer	.symtab	0x8058914	249	FUNC	<unknown>	HIDDEN	2
__decode_dotted	.symtab	0x8058f34	217	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x80587f8	171	FUNC	<unknown>	HIDDEN	2
__deregister_frame_info_bases	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__dns_lookup	.symtab	0x8056e30	1876	FUNC	<unknown>	HIDDEN	2
__do_global_ctors_aux	.symtab	0x8059140	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x80480c0	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x8061020	0	OBJECT	<unknown>	HIDDEN	10
__encode_dotted	.symtab	0x8058ea4	144	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x8058748	175	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x80588a4	83	FUNC	<unknown>	HIDDEN	2
__environ	.symtab	0x806764c	4	OBJECT	<unknown>	DEFAULT	11
__errno_location	.symtab	0x8052bb0	6	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x8067644	4	OBJECT	<unknown>	HIDDEN	11
__fgetc_unlocked	.symtab	0x8058d90	220	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x8061000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fini_array_start	.symtab	0x8061000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__get_hosts_byname_r	.symtab	0x80577c8	44	FUNC	<unknown>	HIDDEN	2
__get_pc_thunk_bx	.symtab	0x80480b0	0	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x8056028	17	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x8053c1c	29	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__h_errno_location	.symtab	0x80561b0	6	FUNC	<unknown>	DEFAULT	2
__h_errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__init_array_end	.symtab	0x8061000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__init_array_start	.symtab	0x8061000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__length_dotted	.symtab	0x8059010	65	FUNC	<unknown>	HIDDEN	2
__length_question	.symtab	0x80588f8	28	FUNC	<unknown>	HIDDEN	2
__libc_close	.symtab	0x80528a4	46	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x80541d0	43	FUNC	<unknown>	DEFAULT	2
__libc_creat	.symtab	0x8052a3f	25	FUNC	<unknown>	DEFAULT	2
__libc_fcntl	.symtab	0x8052780	87	FUNC	<unknown>	DEFAULT	2
__libc_fcntl64	.symtab	0x80527d8	63	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x80528d4	38	FUNC	<unknown>	DEFAULT	2
__libc_getpid	.symtab	0x8052924	38	FUNC	<unknown>	DEFAULT	2
__libc_lseek64	.symtab	0x8058d18	86	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0x8056098	50	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x80529f4	75	FUNC	<unknown>	DEFAULT	2
__libc_poll	.symtab	0x8057870	54	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x8052a58	54	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x8054264	51	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x8052a90	63	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x8054298	51	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x80542cc	67	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x8055dc3	218	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x8067648	4	OBJECT	<unknown>	DEFAULT	11
__libc_system	.symtab	0x80554e0	305	FUNC	<unknown>	DEFAULT	2
__libc_waitpid	.symtab	0x8052b28	26	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x8052b44	54	FUNC	<unknown>	DEFAULT	2
__malloc_consolidate	.symtab	0x8054ce1	424	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x805448c	38	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x80612b0	24	OBJECT	<unknown>	DEFAULT	10
__malloc_state	.symtab	0x8067720	888	OBJECT	<unknown>	DEFAULT	11
__malloc_trim	.symtab	0x8054c54	141	FUNC	<unknown>	DEFAULT	2
__nameserver	.symtab	0x8067aa8	12	OBJECT	<unknown>	HIDDEN	11
__nameservers	.symtab	0x8067ab4	4	OBJECT	<unknown>	HIDDEN	11
__open_etc_hosts	.symtab	0x8058a10	49	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x8057584	579	FUNC	<unknown>	HIDDEN	2
__pagesize	.symtab	0x8067650	4	OBJECT	<unknown>	DEFAULT	11
__preinit_array_end	.symtab	0x8061000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__preinit_array_start	.symtab	0x8061000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__pthread_initialize_minimal	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0x8055b7f	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x8055b7f	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x8055b7f	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x8055b7f	3	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x8055b7f	3	FUNC	<unknown>	DEFAULT	2
__pthread_return_void	.symtab	0x8055b82	1	FUNC	<unknown>	DEFAULT	2
__raise	.symtab	0x80577f4	24	FUNC	<unknown>	HIDDEN	2
__read_etc_hosts_r	.symtab	0x8058a41	724	FUNC	<unknown>	HIDDEN	2
__register_frame_info_bases	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__resolv_lock	.symtab	0x80613c0	24	OBJECT	<unknown>	DEFAULT	10
__restore	.symtab	0x8055dbb	0	NOTYPE	<unknown>	DEFAULT	2
__restore_rt	.symtab	0x8055db4	0	NOTYPE	<unknown>	DEFAULT	2
__rtld_fini	.symtab	0x8067658	4	OBJECT	<unknown>	HIDDEN	11
__searchdomain	.symtab	0x8067a98	16	OBJECT	<unknown>	HIDDEN	11
__searchdomains	.symtab	0x8067ab8	4	OBJECT	<unknown>	HIDDEN	11
__sigaddset	.symtab	0x805444c	32	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x805446c	32	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x8054428	36	FUNC	<unknown>	DEFAULT	2
__socketcall	.symtab	0x8055ed4	50	FUNC	<unknown>	HIDDEN	2
__socketcall.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__stdin	.symtab	0x8061174	4	OBJECT	<unknown>	DEFAULT	10
__stdio_READ	.symtab	0x8059054	79	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x80562a8	128	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x8057ad4	164	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x8056328	234	FUNC	<unknown>	HIDDEN	2
__stdio_init_mutex	.symtab	0x8052d0f	23	FUNC	<unknown>	HIDDEN	2
__stdio_mutex_initializer.4160	.symtab	0x805fc60	24	OBJECT	<unknown>	DEFAULT	4
__stdio_rfill	.symtab	0x80590a4	40	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x8057dbc	51	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x80590cc	110	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x8056414	167	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x8052db0	43	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x8061178	4	OBJECT	<unknown>	DEFAULT	10
__syscall_error	.symtab	0x8057858	21	FUNC	<unknown>	HIDDEN	2
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_rt_sigaction	.symtab	0x8055f08	59	FUNC	<unknown>	HIDDEN	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uClibc_fini	.symtab	0x8055b40	63	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x8055bb7	64	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x8055bf7	443	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x80613b8	4	OBJECT	<unknown>	HIDDEN	10
__vfork	.symtab	0x8055ea0	21	FUNC	<unknown>	HIDDEN	2
__xpg_strerror_r	.symtab	0x8053c3c	182	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_charpad	.symtab	0x8052ddc	54	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_dl_aux_init	.symtab	0x805780c	18	FUNC	<unknown>	DEFAULT	2
_dl_phdr	.symtab	0x8067abc	4	OBJECT	<unknown>	DEFAULT	11
_dl_phnum	.symtab	0x8067ac0	4	OBJECT	<unknown>	DEFAULT	11
_edata	.symtab	0x80613e0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x8067ac4	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_errno	.symtab	0x8067660	4	OBJECT	<unknown>	DEFAULT	11
_exit	.symtab	0x8052818	40	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x8059174	3	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x8065440	8192	OBJECT	<unknown>	DEFAULT	11
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x8052e12	106	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x8056624	1449	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_h_errno	.symtab	0x8067664	4	OBJECT	<unknown>	DEFAULT	11
_init	.symtab	0x8048094	3	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x80564bc	86	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_init	.symtab	0x8053434	111	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x8053625	975	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x80534a4	66	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x80534e8	273	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x80535fc	41	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x8055b82	1	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x8055b82	1	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_sigintr	.symtab	0x80676a0	128	OBJECT	<unknown>	HIDDEN	11
_start	.symtab	0x8048168	34	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x8057b78	579	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x8052cac	99	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x806117c	4	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_add_lock	.symtab	0x8061180	24	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_dec_use	.symtab	0x8057e54	228	FUNC	<unknown>	DEFAULT	2
_stdio_openlist_del_count	.symtab	0x8065424	4	OBJECT	<unknown>	DEFAULT	11
_stdio_openlist_del_lock	.symtab	0x8061198	24	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_use_count	.symtab	0x8065420	4	OBJECT	<unknown>	DEFAULT	11
_stdio_streams	.symtab	0x80611c0	240	OBJECT	<unknown>	DEFAULT	10
_stdio_term	.symtab	0x8052d26	136	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x80611b0	4	OBJECT	<unknown>	DEFAULT	10
_stdlib_strto_l	.symtab	0x8055644	289	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x8056514	61	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x805fd40	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x8056554	207	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x8052e7c	1464	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x8055048	273	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
access	.symtab	0x8052840	50	FUNC	<unknown>	DEFAULT	2
access.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
astd	.symtab	0x804b591	298	FUNC	<unknown>	DEFAULT	2
atcp	.symtab	0x804b012	1407	FUNC	<unknown>	DEFAULT	2
atoi	.symtab	0x8055614	20	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x8055614	20	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
audp	.symtab	0x804abb7	1115	FUNC	<unknown>	DEFAULT	2
bcopy	.symtab	0x8053cf4	21	FUNC	<unknown>	DEFAULT	2
bcopy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
been_there_done_that	.symtab	0x8067640	1	OBJECT	<unknown>	DEFAULT	11
been_there_done_that.3001	.symtab	0x806765c	1	OBJECT	<unknown>	DEFAULT	11
bot.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
brk	.symtab	0x8057820	54	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x8054378	175	FUNC	<unknown>	DEFAULT	2
buf.2827	.symtab	0x8067444	16	OBJECT	<unknown>	DEFAULT	11
buf.5162	.symtab	0x8067460	460	OBJECT	<unknown>	DEFAULT	11
c	.symtab	0x8061150	4	OBJECT	<unknown>	DEFAULT	10
chdir	.symtab	0x8052874	46	FUNC	<unknown>	DEFAULT	2
chdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
clock_getres	.symtab	0x8055f44	50	FUNC	<unknown>	DEFAULT	2
clock_getres.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x80528a4	46	FUNC	<unknown>	DEFAULT	2
close.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
commServer	.symtab	0x8061040	4	OBJECT	<unknown>	DEFAULT	10
completed.2429	.symtab	0x80613e0	1	OBJECT	<unknown>	DEFAULT	11
connect	.symtab	0x80541d0	43	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connectTimeout	.symtab	0x8048f4a	523	FUNC	<unknown>	DEFAULT	2
creat	.symtab	0x8052a3f	25	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
csum	.symtab	0x804925a	159	FUNC	<unknown>	DEFAULT	2
currentServer	.symtab	0x806114c	4	OBJECT	<unknown>	DEFAULT	10
data_start	.symtab	0x8061028	0	NOTYPE	<unknown>	DEFAULT	10
decodea.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dnslookup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ	.symtab	0x806764c	4	OBJECT	<unknown>	DEFAULT	11
errno	.symtab	0x8067660	4	OBJECT	<unknown>	DEFAULT	11
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execl	.symtab	0x80557d0	105	FUNC	<unknown>	DEFAULT	2
execl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execve	.symtab	0x8055f78	54	FUNC	<unknown>	DEFAULT	2
execve.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x8055768	103	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x8060b60	156	OBJECT	<unknown>	DEFAULT	4
fclose	.symtab	0x80578a8	271	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x8052780	87	FUNC	<unknown>	DEFAULT	2
fcntl64	.symtab	0x80527d8	63	FUNC	<unknown>	DEFAULT	2
fdgets	.symtab	0x80483ba	111	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x8057f38	333	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x8058d90	220	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x8057df0	98	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x8058088	105	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fmt	.symtab	0x8060b48	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x80579b8	24	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0x80528d4	38	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs_unlocked	.symtab	0x80539f4	49	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x8048110	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x8054e89	412	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x80579d0	27	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x80579d0	27	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x80579ec	231	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ftcp	.symtab	0x8049787	1407	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked	.symtab	0x8053a28	120	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getArch	.symtab	0x804eb00	10	FUNC	<unknown>	DEFAULT	2
getHost	.symtab	0x8048ce8	55	FUNC	<unknown>	DEFAULT	2
getOurIP	.symtab	0x8048429	547	FUNC	<unknown>	DEFAULT	2
getPortz	.symtab	0x804eb0a	154	FUNC	<unknown>	DEFAULT	2
getRandomIP	.symtab	0x804838e	44	FUNC	<unknown>	DEFAULT	2
get_hosts_byname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getc_unlocked	.symtab	0x8058d90	220	FUNC	<unknown>	DEFAULT	2
getdtablesize	.symtab	0x80528fc	37	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x8055fb0	38	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x8055fd8	38	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x8056000	38	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname	.symtab	0x8053e6c	48	FUNC	<unknown>	DEFAULT	2
gethostbyname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r	.symtab	0x8053e9c	818	FUNC	<unknown>	DEFAULT	2
gethostbyname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpagesize	.symtab	0x8056028	17	FUNC	<unknown>	DEFAULT	2
getpagesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x8052924	38	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x805294c	50	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockname	.symtab	0x80541fc	43	FUNC	<unknown>	DEFAULT	2
getsockname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x8054228	59	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x805603c	38	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gotIP	.symtab	0x8061404	4	OBJECT	<unknown>	DEFAULT	11
h.5161	.symtab	0x806762c	20	OBJECT	<unknown>	DEFAULT	11
h_errno	.symtab	0x8067664	4	OBJECT	<unknown>	DEFAULT	11
htonl	.symtab	0x8053dc5	7	FUNC	<unknown>	DEFAULT	2
htons	.symtab	0x8053db8	13	FUNC	<unknown>	DEFAULT	2
httpattack	.symtab	0x804bd1f	1541	FUNC	<unknown>	DEFAULT	2
i.4257	.symtab	0x8061154	4	OBJECT	<unknown>	DEFAULT	10
index	.symtab	0x8053ae0	30	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x8053e44	37	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x8056d9c	148	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa	.symtab	0x8053e2f	21	FUNC	<unknown>	DEFAULT	2
inet_ntoa.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa_r	.symtab	0x8053de0	79	FUNC	<unknown>	DEFAULT	2
inet_ntop	.symtab	0x8058575	465	FUNC	<unknown>	DEFAULT	2
inet_ntop4	.symtab	0x8058464	273	FUNC	<unknown>	DEFAULT	2
inet_pton	.symtab	0x805829a	458	FUNC	<unknown>	DEFAULT	2
inet_pton4	.symtab	0x8058214	134	FUNC	<unknown>	DEFAULT	2
initConnection	.symtab	0x805204f	334	FUNC	<unknown>	DEFAULT	2
init_rand	.symtab	0x804825f	111	FUNC	<unknown>	DEFAULT	2
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initstate	.symtab	0x8055209	87	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x8055435	171	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x8052980	63	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isatty	.symtab	0x8053d28	29	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isspace	.symtab	0x8052b7c	17	FUNC	<unknown>	DEFAULT	2
isspace.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0x80529c0	50	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lengthd.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lengthq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/i386/crt1.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/i386/crti.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/i386/crtn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/i386/mmap.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/i386/vfork.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
listFork	.symtab	0x8049155	261	FUNC	<unknown>	DEFAULT	2
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x8058d18	86	FUNC	<unknown>	DEFAULT	2
macAddress	.symtab	0x8061410	6	OBJECT	<unknown>	DEFAULT	11
main	.symtab	0x805219d	1507	FUNC	<unknown>	DEFAULT	2
mainCommSock	.symtab	0x8061400	4	OBJECT	<unknown>	DEFAULT	11
makeIPPacket	.symtab	0x80493b1	132	FUNC	<unknown>	DEFAULT	2
makeRandomStr	.symtab	0x8048d1f	106	FUNC	<unknown>	DEFAULT	2
makevsepacket	.symtab	0x8049f3c	151	FUNC	<unknown>	DEFAULT	2
malloc	.symtab	0x80544b2	1954	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
malloc_trim	.symtab	0x8055025	34	FUNC	<unknown>	DEFAULT	2
memchr	.symtab	0x8056bd0	35	FUNC	<unknown>	DEFAULT	2
memchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memcpy	.symtab	0x8053aa0	39	FUNC	<unknown>	DEFAULT	2
memcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memmove	.symtab	0x8056bf4	39	FUNC	<unknown>	DEFAULT	2
memmove.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mempcpy	.symtab	0x8056c44	33	FUNC	<unknown>	DEFAULT	2
mempcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memrchr	.symtab	0x8056c68	176	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x8053ac8	21	FUNC	<unknown>	DEFAULT	2
memset.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mmap	.symtab	0x8055eb8	27	FUNC	<unknown>	DEFAULT	2
munmap	.symtab	0x8056064	50	FUNC	<unknown>	DEFAULT	2
munmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mylock	.symtab	0x80612c8	24	OBJECT	<unknown>	DEFAULT	10
mylock	.symtab	0x80612e0	24	OBJECT	<unknown>	DEFAULT	10
mylock	.symtab	0x8067668	24	OBJECT	<unknown>	DEFAULT	11
nanosleep	.symtab	0x8056098	50	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
next_start.1278	.symtab	0x8067440	4	OBJECT	<unknown>	DEFAULT	11
ntohl	.symtab	0x8053dd9	7	FUNC	<unknown>	DEFAULT	2
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0x8053dcc	13	FUNC	<unknown>	DEFAULT	2
ntop.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
numpids	.symtab	0x8061408	8	OBJECT	<unknown>	DEFAULT	11
object.2482	.symtab	0x80613e4	24	OBJECT	<unknown>	DEFAULT	11
open	.symtab	0x80529f4	75	FUNC	<unknown>	DEFAULT	2
open.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opennameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ourIP	.symtab	0x8067688	4	OBJECT	<unknown>	DEFAULT	11
p.2427	.symtab	0x8061024	0	OBJECT	<unknown>	DEFAULT	10
pids	.symtab	0x806768c	4	OBJECT	<unknown>	DEFAULT	11
poll	.symtab	0x8057870	54	FUNC	<unknown>	DEFAULT	2
poll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prefix.4371	.symtab	0x805fc85	12	OBJECT	<unknown>	DEFAULT	4
print	.symtab	0x8048952	722	FUNC	<unknown>	DEFAULT	2
printchar	.symtab	0x80486f7	66	FUNC	<unknown>	DEFAULT	2
printi	.symtab	0x8048813	319	FUNC	<unknown>	DEFAULT	2
prints	.symtab	0x8048739	218	FUNC	<unknown>	DEFAULT	2
processCmd	.symtab	0x804eba4	13404	FUNC	<unknown>	DEFAULT	2
qual_chars.4377	.symtab	0x805fc98	20	OBJECT	<unknown>	DEFAULT	4
raise	.symtab	0x80577f4	24	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x805515c	5	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand_cmwc	.symtab	0x80482ce	192	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x8055164	72	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x80608a0	40	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x805533d	94	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randtbl	.symtab	0x8061320	128	OBJECT	<unknown>	DEFAULT	10
rawmemchr	.symtab	0x8058144	99	FUNC	<unknown>	DEFAULT	2
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read	.symtab	0x8052a58	54	FUNC	<unknown>	DEFAULT	2
read.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read_etc_hosts_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
realrand	.symtab	0x8052000	79	FUNC	<unknown>	DEFAULT	2
recv	.symtab	0x8054264	51	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recvLine	.symtab	0x8048d89	449	FUNC	<unknown>	DEFAULT	2
rtcp	.symtab	0x804a82f	904	FUNC	<unknown>	DEFAULT	2
sbrk	.symtab	0x80560cc	78	FUNC	<unknown>	DEFAULT	2
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
select	.symtab	0x8052a90	63	FUNC	<unknown>	DEFAULT	2
select.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send	.symtab	0x8054298	51	FUNC	<unknown>	DEFAULT	2
send.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sendHLD	.symtab	0x804e706	1018	FUNC	<unknown>	DEFAULT	2
sendHTTPtwo	.symtab	0x804b86a	431	FUNC	<unknown>	DEFAULT	2
sendKILLALL	.symtab	0x804d324	647	FUNC	<unknown>	DEFAULT	2
sendPkt	.symtab	0x804e2c5	422	FUNC	<unknown>	DEFAULT	2
sendTLS	.symtab	0x804df3f	902	FUNC	<unknown>	DEFAULT	2
senditbudAMP	.symtab	0x804818c	211	FUNC	<unknown>	DEFAULT	2
sendnfo	.symtab	0x804d6d6	299	FUNC	<unknown>	DEFAULT	2
sendto	.symtab	0x80542cc	67	FUNC	<unknown>	DEFAULT	2
sendto.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsid	.symtab	0x8052ad0	38	FUNC	<unknown>	DEFAULT	2
setsid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsockopt	.symtab	0x8054310	59	FUNC	<unknown>	DEFAULT	2
setsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate	.symtab	0x80551ac	93	FUNC	<unknown>	DEFAULT	2
setstate_r	.symtab	0x80552a4	153	FUNC	<unknown>	DEFAULT	2
sigaction	.symtab	0x8055dc3	218	FUNC	<unknown>	DEFAULT	2
sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
signal	.symtab	0x8054378	175	FUNC	<unknown>	DEFAULT	2
signal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigprocmask	.symtab	0x805611c	85	FUNC	<unknown>	DEFAULT	2
sigprocmask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigsetops.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sleep	.symtab	0x805583c	393	FUNC	<unknown>	DEFAULT	2
sleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
snprintf	.symtab	0x8052bb8	33	FUNC	<unknown>	DEFAULT	2
snprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket	.symtab	0x805434c	43	FUNC	<unknown>	DEFAULT	2
socket.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket_connect	.symtab	0x8049e3e	254	FUNC	<unknown>	DEFAULT	2
sockprintf	.symtab	0x8048c24	196	FUNC	<unknown>	DEFAULT	2
spec_and_mask.4376	.symtab	0x805fcac	16	OBJECT	<unknown>	DEFAULT	4
spec_base.4370	.symtab	0x805fc91	7	OBJECT	<unknown>	DEFAULT	4
spec_chars.4373	.symtab	0x805fcd5	21	OBJECT	<unknown>	DEFAULT	4
spec_flags.4372	.symtab	0x805fcea	8	OBJECT	<unknown>	DEFAULT	4
spec_or_mask.4375	.symtab	0x805fcbc	16	OBJECT	<unknown>	DEFAULT	4
spec_ranges.4374	.symtab	0x805fccc	9	OBJECT	<unknown>	DEFAULT	4
sprintf	.symtab	0x8052bdc	31	FUNC	<unknown>	DEFAULT	2
sprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
srand	.symtab	0x8055260	67	FUNC	<unknown>	DEFAULT	2
srandom	.symtab	0x8055260	67	FUNC	<unknown>	DEFAULT	2
srandom_r	.symtab	0x805539b	154	FUNC	<unknown>	DEFAULT	2
static_id	.symtab	0x80613bc	2	OBJECT	<unknown>	DEFAULT	10
static_ns	.symtab	0x8067680	4	OBJECT	<unknown>	DEFAULT	11
stderr	.symtab	0x8061170	4	OBJECT	<unknown>	DEFAULT	10
stdhexflood	.symtab	0x804a5cc	299	FUNC	<unknown>	DEFAULT	2
stdin	.symtab	0x8061168	4	OBJECT	<unknown>	DEFAULT	10
stdout	.symtab	0x806116c	4	OBJECT	<unknown>	DEFAULT	10
strcasecmp	.symtab	0x8058e6c	54	FUNC	<unknown>	DEFAULT	2
strcasecmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchr	.symtab	0x8053ae0	30	FUNC	<unknown>	DEFAULT	2
strchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcmp	.symtab	0x80580f4	29	FUNC	<unknown>	DEFAULT	2
strcmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcoll	.symtab	0x80580f4	29	FUNC	<unknown>	DEFAULT	2
strcpy	.symtab	0x8053b00	27	FUNC	<unknown>	DEFAULT	2
strcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strdup	.symtab	0x80581dc	54	FUNC	<unknown>	DEFAULT	2
strdup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strerror_r	.symtab	0x8053c3c	182	FUNC	<unknown>	DEFAULT	2
strlen	.symtab	0x8053b1c	19	FUNC	<unknown>	DEFAULT	2
strlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncat	.symtab	0x8058114	46	FUNC	<unknown>	DEFAULT	2
strncat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncpy	.symtab	0x8056c1c	38	FUNC	<unknown>	DEFAULT	2
strncpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strnlen	.symtab	0x8053b30	25	FUNC	<unknown>	DEFAULT	2
strnlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strpbrk	.symtab	0x8056d74	39	FUNC	<unknown>	DEFAULT	2
strpbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strspn	.symtab	0x80581a8	50	FUNC	<unknown>	DEFAULT	2
strspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strstr	.symtab	0x8053b4c	206	FUNC	<unknown>	DEFAULT	2
strstr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok	.symtab	0x8053d0c	25	FUNC	<unknown>	DEFAULT	2
strtok.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok_r	.symtab	0x8056d18	89	FUNC	<unknown>	DEFAULT	2
strtok_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtol	.symtab	0x8055628	26	FUNC	<unknown>	DEFAULT	2
strtol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sysconf	.symtab	0x80559c8	325	FUNC	<unknown>	DEFAULT	2
sysconf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
system	.symtab	0x80554e0	305	FUNC	<unknown>	DEFAULT	2
system.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcgetattr	.symtab	0x8053d48	112	FUNC	<unknown>	DEFAULT	2
tcgetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcpcsum	.symtab	0x80492f9	184	FUNC	<unknown>	DEFAULT	2
time	.symtab	0x8052af8	46	FUNC	<unknown>	DEFAULT	2
time.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tolower	.symtab	0x8058d70	29	FUNC	<unknown>	DEFAULT	2
tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
toupper	.symtab	0x8052b90	29	FUNC	<unknown>	DEFAULT	2
toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
trim	.symtab	0x804864c	171	FUNC	<unknown>	DEFAULT	2
type_codes	.symtab	0x805fcf2	24	OBJECT	<unknown>	DEFAULT	4
type_sizes	.symtab	0x805fd0a	12	OBJECT	<unknown>	DEFAULT	4
unknown.1330	.symtab	0x805fd16	14	OBJECT	<unknown>	DEFAULT	4
unsafe_state	.symtab	0x80612f8	28	OBJECT	<unknown>	DEFAULT	10
useragents	.symtab	0x8061060	236	OBJECT	<unknown>	DEFAULT	10
usleep	.symtab	0x8055b10	48	FUNC	<unknown>	DEFAULT	2
usleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
vfork	.symtab	0x8055ea0	21	FUNC	<unknown>	DEFAULT	2
vseattack	.symtab	0x8049fd3	1239	FUNC	<unknown>	DEFAULT	2
vsnprintf	.symtab	0x8052bfc	176	FUNC	<unknown>	DEFAULT	2
vsnprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wait4	.symtab	0x8056174	59	FUNC	<unknown>	DEFAULT	2
wait4.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
waitpid	.symtab	0x8052b28	26	FUNC	<unknown>	DEFAULT	2
waitpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcrtomb	.symtab	0x80561b8	69	FUNC	<unknown>	DEFAULT	2
wcrtomb.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsnrtombs	.symtab	0x8056220	133	FUNC	<unknown>	DEFAULT	2
wcsnrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsrtombs	.symtab	0x8056200	30	FUNC	<unknown>	DEFAULT	2
wcsrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
write	.symtab	0x8052b44	54	FUNC	<unknown>	DEFAULT	2
write.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
xdigits.3285	.symtab	0x8060c54	17	OBJECT	<unknown>	DEFAULT	4
xtdcustom	.symtab	0x804d990	299	FUNC	<unknown>	DEFAULT	2

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-06T23:28:12.166662+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33400	57.129.51.86	4258	TCP
2024-10-06T23:28:13.805689+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33402	57.129.51.86	4258	TCP
2024-10-06T23:28:15.467645+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33404	57.129.51.86	4258	TCP
2024-10-06T23:28:17.171835+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33406	57.129.51.86	4258	TCP
2024-10-06T23:28:18.822905+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33408	57.129.51.86	4258	TCP
2024-10-06T23:28:20.464407+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33410	57.129.51.86	4258	TCP
2024-10-06T23:28:22.122092+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33412	57.129.51.86	4258	TCP
2024-10-06T23:28:23.783637+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33414	57.129.51.86	4258	TCP
2024-10-06T23:28:25.435876+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33416	57.129.51.86	4258	TCP
2024-10-06T23:28:27.108437+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33418	57.129.51.86	4258	TCP
2024-10-06T23:28:28.798001+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33420	57.129.51.86	4258	TCP
2024-10-06T23:28:30.428430+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33422	57.129.51.86	4258	TCP
2024-10-06T23:28:32.086735+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33424	57.129.51.86	4258	TCP
2024-10-06T23:28:33.726537+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33426	57.129.51.86	4258	TCP
2024-10-06T23:28:35.404397+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33428	57.129.51.86	4258	TCP
2024-10-06T23:28:37.043325+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33430	57.129.51.86	4258	TCP
2024-10-06T23:28:38.694829+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33432	57.129.51.86	4258	TCP
2024-10-06T23:28:40.360064+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33434	57.129.51.86	4258	TCP
2024-10-06T23:28:42.013472+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33436	57.129.51.86	4258	TCP
2024-10-06T23:28:43.665855+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33438	57.129.51.86	4258	TCP
2024-10-06T23:28:45.303920+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33440	57.129.51.86	4258	TCP
2024-10-06T23:28:46.944450+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33442	57.129.51.86	4258	TCP
2024-10-06T23:28:48.602274+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33444	57.129.51.86	4258	TCP
2024-10-06T23:28:50.257428+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33446	57.129.51.86	4258	TCP
2024-10-06T23:28:51.925316+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33448	57.129.51.86	4258	TCP
2024-10-06T23:28:53.576023+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33450	57.129.51.86	4258	TCP
2024-10-06T23:28:55.223242+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33452	57.129.51.86	4258	TCP
2024-10-06T23:28:56.945797+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33454	57.129.51.86	4258	TCP
2024-10-06T23:28:58.601900+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33456	57.129.51.86	4258	TCP
2024-10-06T23:29:00.246873+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33458	57.129.51.86	4258	TCP
2024-10-06T23:29:01.926634+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33460	57.129.51.86	4258	TCP
2024-10-06T23:29:03.573464+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33462	57.129.51.86	4258	TCP
2024-10-06T23:29:05.215591+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33464	57.129.51.86	4258	TCP
2024-10-06T23:29:06.886520+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33466	57.129.51.86	4258	TCP
2024-10-06T23:29:08.546932+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33468	57.129.51.86	4258	TCP
2024-10-06T23:29:10.212194+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33470	57.129.51.86	4258	TCP
2024-10-06T23:29:11.875548+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33472	57.129.51.86	4258	TCP
2024-10-06T23:29:13.646544+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33474	57.129.51.86	4258	TCP
2024-10-06T23:29:15.296074+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33476	57.129.51.86	4258	TCP
2024-10-06T23:29:16.929125+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33478	57.129.51.86	4258	TCP
2024-10-06T23:29:18.570544+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33480	57.129.51.86	4258	TCP
2024-10-06T23:29:20.209632+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33482	57.129.51.86	4258	TCP
2024-10-06T23:29:21.858532+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33484	57.129.51.86	4258	TCP
2024-10-06T23:29:23.516108+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33486	57.129.51.86	4258	TCP
2024-10-06T23:29:25.171867+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33488	57.129.51.86	4258	TCP
2024-10-06T23:29:26.821236+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33490	57.129.51.86	4258	TCP
2024-10-06T23:29:28.461510+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33492	57.129.51.86	4258	TCP
2024-10-06T23:29:30.102880+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33494	57.129.51.86	4258	TCP
2024-10-06T23:29:31.756981+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33496	57.129.51.86	4258	TCP
2024-10-06T23:29:33.421090+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33498	57.129.51.86	4258	TCP
2024-10-06T23:29:35.076223+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33500	57.129.51.86	4258	TCP
2024-10-06T23:29:36.717256+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33502	57.129.51.86	4258	TCP
2024-10-06T23:29:38.392134+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33504	57.129.51.86	4258	TCP
2024-10-06T23:29:40.042411+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33506	57.129.51.86	4258	TCP
2024-10-06T23:29:41.680956+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33508	57.129.51.86	4258	TCP
2024-10-06T23:29:43.322207+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33510	57.129.51.86	4258	TCP
2024-10-06T23:29:44.969981+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33512	57.129.51.86	4258	TCP
2024-10-06T23:29:46.607238+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33514	57.129.51.86	4258	TCP
2024-10-06T23:29:48.282637+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33516	57.129.51.86	4258	TCP
2024-10-06T23:29:49.934433+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33518	57.129.51.86	4258	TCP
2024-10-06T23:29:51.573945+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33520	57.129.51.86	4258	TCP
2024-10-06T23:29:53.233173+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33522	57.129.51.86	4258	TCP
2024-10-06T23:29:54.890574+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33524	57.129.51.86	4258	TCP
2024-10-06T23:29:56.543534+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33526	57.129.51.86	4258	TCP
2024-10-06T23:29:58.195985+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33528	57.129.51.86	4258	TCP
2024-10-06T23:29:59.837102+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33530	57.129.51.86	4258	TCP
2024-10-06T23:30:01.517136+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33532	57.129.51.86	4258	TCP
2024-10-06T23:30:03.182488+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33534	57.129.51.86	4258	TCP
2024-10-06T23:30:04.836131+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33536	57.129.51.86	4258	TCP
2024-10-06T23:30:06.501669+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33538	57.129.51.86	4258	TCP
2024-10-06T23:30:08.139206+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33540	57.129.51.86	4258	TCP
2024-10-06T23:30:09.793806+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33542	57.129.51.86	4258	TCP
2024-10-06T23:30:11.431631+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33544	57.129.51.86	4258	TCP
2024-10-06T23:30:13.089900+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33546	57.129.51.86	4258	TCP
2024-10-06T23:30:14.748534+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33548	57.129.51.86	4258	TCP
2024-10-06T23:30:16.397097+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33550	57.129.51.86	4258	TCP
2024-10-06T23:30:18.058410+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33552	57.129.51.86	4258	TCP
2024-10-06T23:30:19.701327+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33554	57.129.51.86	4258	TCP
2024-10-06T23:30:21.337551+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33556	57.129.51.86	4258	TCP
2024-10-06T23:30:22.981371+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33558	57.129.51.86	4258	TCP
2024-10-06T23:30:24.623441+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33560	57.129.51.86	4258	TCP
2024-10-06T23:30:26.279536+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33562	57.129.51.86	4258	TCP
2024-10-06T23:30:27.935354+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33564	57.129.51.86	4258	TCP
2024-10-06T23:30:29.572037+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33566	57.129.51.86	4258	TCP
2024-10-06T23:30:31.216551+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33568	57.129.51.86	4258	TCP
2024-10-06T23:30:32.856140+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33570	57.129.51.86	4258	TCP
2024-10-06T23:30:34.511855+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33572	57.129.51.86	4258	TCP
2024-10-06T23:30:36.150004+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33574	57.129.51.86	4258	TCP
2024-10-06T23:30:37.793393+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33576	57.129.51.86	4258	TCP
2024-10-06T23:30:39.455309+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33578	57.129.51.86	4258	TCP
2024-10-06T23:30:41.107008+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33580	57.129.51.86	4258	TCP
2024-10-06T23:30:42.767902+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33582	57.129.51.86	4258	TCP
2024-10-06T23:30:44.443802+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33584	57.129.51.86	4258	TCP
2024-10-06T23:30:46.098008+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33586	57.129.51.86	4258	TCP
2024-10-06T23:30:47.749144+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33588	57.129.51.86	4258	TCP
2024-10-06T23:30:49.406640+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33590	57.129.51.86	4258	TCP
2024-10-06T23:30:51.043183+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33592	57.129.51.86	4258	TCP
2024-10-06T23:30:52.685393+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33594	57.129.51.86	4258	TCP
2024-10-06T23:30:54.325358+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33596	57.129.51.86	4258	TCP
2024-10-06T23:30:55.963469+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33598	57.129.51.86	4258	TCP
2024-10-06T23:30:57.632531+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33602	57.129.51.86	4258	TCP
2024-10-06T23:30:59.275819+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33604	57.129.51.86	4258	TCP
2024-10-06T23:31:00.933337+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33606	57.129.51.86	4258	TCP
2024-10-06T23:31:02.625566+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33608	57.129.51.86	4258	TCP
2024-10-06T23:31:04.282353+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33610	57.129.51.86	4258	TCP
2024-10-06T23:31:05.936015+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33612	57.129.51.86	4258	TCP
2024-10-06T23:31:07.572524+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33614	57.129.51.86	4258	TCP
2024-10-06T23:31:09.219642+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33616	57.129.51.86	4258	TCP
2024-10-06T23:31:10.855641+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33618	57.129.51.86	4258	TCP
2024-10-06T23:31:12.494933+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33620	57.129.51.86	4258	TCP
2024-10-06T23:31:14.155357+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33622	57.129.51.86	4258	TCP
2024-10-06T23:31:15.812603+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33624	57.129.51.86	4258	TCP
2024-10-06T23:31:17.472032+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33626	57.129.51.86	4258	TCP
2024-10-06T23:31:19.120256+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33628	57.129.51.86	4258	TCP
2024-10-06T23:31:20.778947+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33630	57.129.51.86	4258	TCP
2024-10-06T23:31:22.433404+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33632	57.129.51.86	4258	TCP
2024-10-06T23:31:24.094348+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33634	57.129.51.86	4258	TCP
2024-10-06T23:31:25.792867+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33636	57.129.51.86	4258	TCP
2024-10-06T23:31:27.436126+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33638	57.129.51.86	4258	TCP
2024-10-06T23:31:29.074655+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33640	57.129.51.86	4258	TCP
2024-10-06T23:31:30.730744+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33642	57.129.51.86	4258	TCP
2024-10-06T23:31:32.401506+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33644	57.129.51.86	4258	TCP
2024-10-06T23:31:34.041177+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33646	57.129.51.86	4258	TCP
2024-10-06T23:31:35.684131+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33648	57.129.51.86	4258	TCP
2024-10-06T23:31:37.344695+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33650	57.129.51.86	4258	TCP
2024-10-06T23:31:38.997197+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33652	57.129.51.86	4258	TCP
2024-10-06T23:31:40.750549+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33654	57.129.51.86	4258	TCP
2024-10-06T23:31:42.422727+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33656	57.129.51.86	4258	TCP
2024-10-06T23:31:44.080803+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33658	57.129.51.86	4258	TCP
2024-10-06T23:31:45.714659+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33660	57.129.51.86	4258	TCP
2024-10-06T23:31:47.354585+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	33662	57.129.51.86	4258	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 6, 2024 23:28:12.161317110 CEST	33400	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:12.166515112 CEST	4258	33400	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:12.166596889 CEST	33400	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:12.166661978 CEST	33400	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:12.171653032 CEST	4258	33400	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:13.799240112 CEST	4258	33400	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:13.799534082 CEST	33402	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:13.799545050 CEST	33400	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:13.805361986 CEST	4258	33402	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:13.805393934 CEST	4258	33400	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:13.805689096 CEST	33402	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:13.805689096 CEST	33402	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:13.810765028 CEST	4258	33402	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:15.461484909 CEST	4258	33402	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:15.461987019 CEST	33404	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:15.462068081 CEST	33402	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:15.467494011 CEST	4258	33404	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:15.467535973 CEST	4258	33402	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:15.467591047 CEST	33404	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:15.467644930 CEST	33404	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:15.472651005 CEST	4258	33404	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:17.166062117 CEST	4258	33404	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:17.166309118 CEST	33404	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:17.166555882 CEST	33406	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:17.171343088 CEST	4258	33404	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:17.171521902 CEST	4258	33406	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:17.171673059 CEST	33406	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:17.171834946 CEST	33406	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:17.177012920 CEST	4258	33406	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:18.816832066 CEST	4258	33406	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:18.817169905 CEST	33406	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:18.817219019 CEST	33408	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:18.822659969 CEST	4258	33406	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:18.822705984 CEST	4258	33408	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:18.822810888 CEST	33408	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:18.822905064 CEST	33408	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:18.827919006 CEST	4258	33408	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:20.458367109 CEST	4258	33408	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:20.458669901 CEST	33408	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:20.458796024 CEST	33410	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:20.464129925 CEST	4258	33408	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:20.464174986 CEST	4258	33410	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:20.464406013 CEST	33410	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:20.464406967 CEST	33410	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:20.469835997 CEST	4258	33410	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:22.116166115 CEST	4258	33410	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:22.116533041 CEST	33410	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:22.116569996 CEST	33412	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:22.121872902 CEST	4258	33410	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:22.121918917 CEST	4258	33412	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:22.122023106 CEST	33412	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:22.122092009 CEST	33412	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:22.127552032 CEST	4258	33412	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:23.777573109 CEST	4258	33412	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:23.777875900 CEST	33412	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:23.778004885 CEST	33414	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:23.783333063 CEST	4258	33412	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:23.783380032 CEST	4258	33414	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:23.783559084 CEST	33414	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:23.783637047 CEST	33414	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:23.788908958 CEST	4258	33414	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:25.428432941 CEST	4258	33414	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:25.429200888 CEST	33414	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:25.429280043 CEST	33416	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:25.435601950 CEST	4258	33414	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:25.435646057 CEST	4258	33416	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:25.435875893 CEST	33416	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:25.435875893 CEST	33416	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:25.441184998 CEST	4258	33416	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:27.102102041 CEST	4258	33416	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:27.102580070 CEST	33418	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:27.102585077 CEST	33416	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:27.108237028 CEST	4258	33416	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:27.108283997 CEST	4258	33418	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:27.108374119 CEST	33418	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:27.108437061 CEST	33418	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:27.113919973 CEST	4258	33418	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:28.791589022 CEST	4258	33418	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:28.792184114 CEST	33418	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:28.792346001 CEST	33420	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:28.797704935 CEST	4258	33418	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:28.797749043 CEST	4258	33420	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:28.798000097 CEST	33420	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:28.798001051 CEST	33420	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:28.803610086 CEST	4258	33420	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:30.422483921 CEST	4258	33420	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:30.422755003 CEST	33422	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:30.422821999 CEST	33420	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:30.428174019 CEST	4258	33422	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:30.428262949 CEST	4258	33420	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:30.428333998 CEST	33422	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:30.428430080 CEST	33422	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:30.433634996 CEST	4258	33422	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:32.081034899 CEST	4258	33422	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:32.081430912 CEST	33422	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:32.081504107 CEST	33424	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:32.086532116 CEST	4258	33422	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:32.086548090 CEST	4258	33424	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:32.086677074 CEST	33424	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:32.086735010 CEST	33424	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:32.091734886 CEST	4258	33424	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:33.720511913 CEST	4258	33424	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:33.720755100 CEST	33424	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:33.720788002 CEST	33426	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:33.726351976 CEST	4258	33424	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:33.726397038 CEST	4258	33426	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:33.726491928 CEST	33426	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:33.726536989 CEST	33426	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:33.732011080 CEST	4258	33426	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:35.398530960 CEST	4258	33426	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:35.398729086 CEST	33426	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:35.398884058 CEST	33428	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:35.404130936 CEST	4258	33426	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:35.404175997 CEST	4258	33428	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:35.404311895 CEST	33428	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:35.404397011 CEST	33428	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:35.409351110 CEST	4258	33428	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:37.036808968 CEST	4258	33428	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:37.037200928 CEST	33428	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:37.037247896 CEST	33430	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:37.043037891 CEST	4258	33428	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:37.043082952 CEST	4258	33430	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:37.043260098 CEST	33430	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:37.043324947 CEST	33430	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:37.048789024 CEST	4258	33430	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:38.688723087 CEST	4258	33430	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:38.688961029 CEST	33430	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:38.689013004 CEST	33432	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:38.694544077 CEST	4258	33430	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:38.694588900 CEST	4258	33432	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:38.694763899 CEST	33432	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:38.694828987 CEST	33432	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:38.700174093 CEST	4258	33432	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:40.354624987 CEST	4258	33432	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:40.354820967 CEST	33432	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:40.354917049 CEST	33434	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:40.359921932 CEST	4258	33432	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:40.359940052 CEST	4258	33434	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:40.360024929 CEST	33434	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:40.360064030 CEST	33434	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:40.364890099 CEST	4258	33434	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:42.006824017 CEST	4258	33434	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:42.007276058 CEST	33436	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:42.007365942 CEST	33434	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:42.013062954 CEST	4258	33436	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:42.013098001 CEST	4258	33434	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:42.013330936 CEST	33436	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:42.013472080 CEST	33436	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:42.019332886 CEST	4258	33436	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:43.659729958 CEST	4258	33436	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:43.660147905 CEST	33436	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:43.660339117 CEST	33438	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:43.665524006 CEST	4258	33436	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:43.665568113 CEST	4258	33438	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:43.665771961 CEST	33438	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:43.665854931 CEST	33438	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:43.671140909 CEST	4258	33438	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:45.297977924 CEST	4258	33438	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:45.298289061 CEST	33440	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:45.298422098 CEST	33438	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:45.303667068 CEST	4258	33440	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:45.303711891 CEST	4258	33438	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:45.303854942 CEST	33440	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:45.303920031 CEST	33440	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:45.309220076 CEST	4258	33440	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:46.939079046 CEST	4258	33440	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:46.939265966 CEST	33440	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:46.939285040 CEST	33442	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:46.944274902 CEST	4258	33440	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:46.944289923 CEST	4258	33442	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:46.944410086 CEST	33442	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:46.944449902 CEST	33442	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:46.949357033 CEST	4258	33442	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:48.596425056 CEST	4258	33442	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:48.596893072 CEST	33442	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:48.596957922 CEST	33444	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:48.601912975 CEST	4258	33442	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:48.601933956 CEST	4258	33444	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:48.602166891 CEST	33444	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:48.602273941 CEST	33444	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:48.607084990 CEST	4258	33444	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:50.251277924 CEST	4258	33444	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:50.251589060 CEST	33444	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:50.251782894 CEST	33446	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:50.256762028 CEST	4258	33444	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:50.256984949 CEST	4258	33446	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:50.257329941 CEST	33446	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:50.257427931 CEST	33446	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:50.262695074 CEST	4258	33446	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:51.918848991 CEST	4258	33446	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:51.919502974 CEST	33446	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:51.919511080 CEST	33448	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:51.924998045 CEST	4258	33446	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:51.925019026 CEST	4258	33448	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:51.925195932 CEST	33448	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:51.925316095 CEST	33448	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:51.930515051 CEST	4258	33448	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:53.569814920 CEST	4258	33448	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:53.570255041 CEST	33448	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:53.570457935 CEST	33450	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:53.575711966 CEST	4258	33448	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:53.575756073 CEST	4258	33450	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:53.575938940 CEST	33450	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:53.576023102 CEST	33450	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:53.581579924 CEST	4258	33450	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:55.216631889 CEST	4258	33450	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:55.217128038 CEST	33450	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:55.217325926 CEST	33452	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:55.222913027 CEST	4258	33450	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:55.222963095 CEST	4258	33452	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:55.223155022 CEST	33452	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:55.223242044 CEST	33452	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:55.228553057 CEST	4258	33452	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:56.939455032 CEST	4258	33452	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:56.939764023 CEST	33452	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:56.939831972 CEST	33454	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:56.945374012 CEST	4258	33452	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:56.945422888 CEST	4258	33454	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:56.945557117 CEST	33454	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:56.945796967 CEST	33454	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:56.951169014 CEST	4258	33454	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:58.594926119 CEST	4258	33454	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:58.595309973 CEST	33454	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:58.595525980 CEST	33456	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:58.601500988 CEST	4258	33454	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:58.601563931 CEST	4258	33456	57.129.51.86	192.168.2.14
Oct 6, 2024 23:28:58.601900101 CEST	33456	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:58.601900101 CEST	33456	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:28:58.607824087 CEST	4258	33456	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:00.241456032 CEST	4258	33456	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:00.241842031 CEST	33458	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:00.241883039 CEST	33456	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:00.246762991 CEST	4258	33458	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:00.246778011 CEST	4258	33456	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:00.246835947 CEST	33458	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:00.246872902 CEST	33458	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:00.252084970 CEST	4258	33458	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:01.916727066 CEST	4258	33458	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:01.917228937 CEST	33458	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:01.917304993 CEST	33460	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:01.926242113 CEST	4258	33458	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:01.926282883 CEST	4258	33460	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:01.926537037 CEST	33460	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:01.926634073 CEST	33460	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:01.935234070 CEST	4258	33460	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:03.567655087 CEST	4258	33460	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:03.568007946 CEST	33460	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:03.568106890 CEST	33462	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:03.573051929 CEST	4258	33460	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:03.573076010 CEST	4258	33462	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:03.573354959 CEST	33462	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:03.573463917 CEST	33462	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:03.582163095 CEST	4258	33462	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:05.207993031 CEST	4258	33462	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:05.208276033 CEST	33462	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:05.208332062 CEST	33464	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:05.215286970 CEST	4258	33462	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:05.215310097 CEST	4258	33464	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:05.215538979 CEST	33464	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:05.215590954 CEST	33464	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:05.222039938 CEST	4258	33464	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:06.880613089 CEST	4258	33464	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:06.880973101 CEST	33464	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:06.881125927 CEST	33466	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:06.886069059 CEST	4258	33464	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:06.886090994 CEST	4258	33466	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:06.886518955 CEST	33466	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:06.886519909 CEST	33466	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:06.891521931 CEST	4258	33466	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:08.540277004 CEST	4258	33466	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:08.540507078 CEST	33466	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:08.540577888 CEST	33468	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:08.546747923 CEST	4258	33466	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:08.546766996 CEST	4258	33468	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:08.546864986 CEST	33468	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:08.546931982 CEST	33468	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:08.551727057 CEST	4258	33468	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:10.206331968 CEST	4258	33468	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:10.206896067 CEST	33468	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:10.206932068 CEST	33470	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:10.211941004 CEST	4258	33468	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:10.211963892 CEST	4258	33470	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:10.212157011 CEST	33470	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:10.212193966 CEST	33470	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:10.217041969 CEST	4258	33470	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:11.869618893 CEST	4258	33470	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:11.870106936 CEST	33470	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:11.870131016 CEST	33472	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:11.875150919 CEST	4258	33470	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:11.875173092 CEST	4258	33472	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:11.875451088 CEST	33472	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:11.875547886 CEST	33472	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:11.880506992 CEST	4258	33472	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:13.639641047 CEST	4258	33472	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:13.639786959 CEST	33472	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:13.639838934 CEST	33474	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:13.646403074 CEST	4258	33472	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:13.646445990 CEST	4258	33474	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:13.646527052 CEST	33474	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:13.646543980 CEST	33474	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:13.651354074 CEST	4258	33474	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:15.290445089 CEST	4258	33474	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:15.290889978 CEST	33474	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:15.291007042 CEST	33476	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:15.295759916 CEST	4258	33474	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:15.295855999 CEST	4258	33476	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:15.295958996 CEST	33476	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:15.296073914 CEST	33476	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:15.300802946 CEST	4258	33476	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:16.923552990 CEST	4258	33476	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:16.923768044 CEST	33476	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:16.923830032 CEST	33478	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:16.928868055 CEST	4258	33476	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:16.928886890 CEST	4258	33478	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:16.929076910 CEST	33478	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:16.929125071 CEST	33478	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:16.935738087 CEST	4258	33478	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:18.564753056 CEST	4258	33478	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:18.565192938 CEST	33478	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:18.565385103 CEST	33480	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:18.570312977 CEST	4258	33478	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:18.570334911 CEST	4258	33480	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:18.570427895 CEST	33480	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:18.570544004 CEST	33480	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:18.575426102 CEST	4258	33480	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:20.204168081 CEST	4258	33480	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:20.204515934 CEST	33482	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:20.204601049 CEST	33480	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:20.209458113 CEST	4258	33482	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:20.209482908 CEST	4258	33480	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:20.209589005 CEST	33482	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:20.209631920 CEST	33482	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:20.214394093 CEST	4258	33482	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:21.852760077 CEST	4258	33482	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:21.853365898 CEST	33482	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:21.853445053 CEST	33484	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:21.858336926 CEST	4258	33482	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:21.858356953 CEST	4258	33484	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:21.858445883 CEST	33484	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:21.858531952 CEST	33484	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:21.863416910 CEST	4258	33484	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:23.509670973 CEST	4258	33484	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:23.510138035 CEST	33486	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:23.510250092 CEST	33484	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:23.515702963 CEST	4258	33486	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:23.515747070 CEST	4258	33484	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:23.515944004 CEST	33486	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:23.516108036 CEST	33486	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:23.521222115 CEST	4258	33486	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:25.165878057 CEST	4258	33486	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:25.166388988 CEST	33486	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:25.166481018 CEST	33488	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:25.171456099 CEST	4258	33486	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:25.171490908 CEST	4258	33488	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:25.171644926 CEST	33488	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:25.171866894 CEST	33488	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:25.176721096 CEST	4258	33488	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:26.815675020 CEST	4258	33488	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:26.815995932 CEST	33488	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:26.816167116 CEST	33490	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:26.821005106 CEST	4258	33488	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:26.821121931 CEST	4258	33490	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:26.821198940 CEST	33490	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:26.821235895 CEST	33490	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:26.826349974 CEST	4258	33490	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:28.455229044 CEST	4258	33490	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:28.455606937 CEST	33490	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:28.455657959 CEST	33492	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:28.461029053 CEST	4258	33490	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:28.461076975 CEST	4258	33492	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:28.461509943 CEST	33492	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:28.461509943 CEST	33492	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:28.466573000 CEST	4258	33492	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:30.096765995 CEST	4258	33492	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:30.097353935 CEST	33492	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:30.097373009 CEST	33494	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:30.102603912 CEST	4258	33492	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:30.102648973 CEST	4258	33494	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:30.102775097 CEST	33494	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:30.102880001 CEST	33494	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:30.107928038 CEST	4258	33494	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:31.751343012 CEST	4258	33494	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:31.751590967 CEST	33494	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:31.751672029 CEST	33496	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:31.756509066 CEST	4258	33494	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:31.756644011 CEST	4258	33496	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:31.756918907 CEST	33496	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:31.756980896 CEST	33496	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:31.761787891 CEST	4258	33496	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:33.414740086 CEST	4258	33496	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:33.415308952 CEST	33496	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:33.415443897 CEST	33498	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:33.420675993 CEST	4258	33496	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:33.420722961 CEST	4258	33498	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:33.421046972 CEST	33498	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:33.421089888 CEST	33498	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:33.426321983 CEST	4258	33498	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:35.069997072 CEST	4258	33498	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:35.070486069 CEST	33498	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:35.070528984 CEST	33500	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:35.075679064 CEST	4258	33498	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:35.075695038 CEST	4258	33500	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:35.075993061 CEST	33500	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:35.076222897 CEST	33500	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:35.081206083 CEST	4258	33500	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:36.710688114 CEST	4258	33500	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:36.711255074 CEST	33500	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:36.711374998 CEST	33502	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:36.716806889 CEST	4258	33500	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:36.716852903 CEST	4258	33502	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:36.717256069 CEST	33502	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:36.717256069 CEST	33502	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:36.725064993 CEST	4258	33502	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:38.385863066 CEST	4258	33502	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:38.386326075 CEST	33504	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:38.386365891 CEST	33502	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:38.391748905 CEST	4258	33504	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:38.391769886 CEST	4258	33502	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:38.392024994 CEST	33504	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:38.392133951 CEST	33504	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:38.397258997 CEST	4258	33504	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:40.036015987 CEST	4258	33504	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:40.036533117 CEST	33504	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:40.036540031 CEST	33506	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:40.041868925 CEST	4258	33504	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:40.041889906 CEST	4258	33506	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:40.042411089 CEST	33506	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:40.042411089 CEST	33506	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:40.047750950 CEST	4258	33506	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:41.674731970 CEST	4258	33506	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:41.675416946 CEST	33506	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:41.675499916 CEST	33508	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:41.680346966 CEST	4258	33506	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:41.680511951 CEST	4258	33508	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:41.680954933 CEST	33508	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:41.680955887 CEST	33508	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:41.686152935 CEST	4258	33508	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:43.316081047 CEST	4258	33508	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:43.316576004 CEST	33508	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:43.316641092 CEST	33510	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:43.321599007 CEST	4258	33508	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:43.321635962 CEST	4258	33510	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:43.321970940 CEST	33510	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:43.322206974 CEST	33510	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:43.327006102 CEST	4258	33510	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:44.963133097 CEST	4258	33510	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:44.963754892 CEST	33510	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:44.963804960 CEST	33512	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:44.969299078 CEST	4258	33510	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:44.969352007 CEST	4258	33512	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:44.969918013 CEST	33512	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:44.969980955 CEST	33512	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:44.975609064 CEST	4258	33512	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:46.599844933 CEST	4258	33512	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:46.600308895 CEST	33512	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:46.600346088 CEST	33514	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:46.606672049 CEST	4258	33512	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:46.606720924 CEST	4258	33514	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:46.606977940 CEST	33514	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:46.607238054 CEST	33514	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:46.616307020 CEST	4258	33514	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:48.276129007 CEST	4258	33514	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:48.276810884 CEST	33514	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:48.276813030 CEST	33516	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:48.282094955 CEST	4258	33514	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:48.282141924 CEST	4258	33516	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:48.282636881 CEST	33516	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:48.282636881 CEST	33516	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:48.288310051 CEST	4258	33516	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:49.928395033 CEST	4258	33516	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:49.928860903 CEST	33516	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:49.928885937 CEST	33518	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:49.933854103 CEST	4258	33516	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:49.933892012 CEST	4258	33518	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:49.934159994 CEST	33518	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:49.934432983 CEST	33518	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:49.939321995 CEST	4258	33518	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:51.566865921 CEST	4258	33518	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:51.567596912 CEST	33520	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:51.567688942 CEST	33518	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:51.573218107 CEST	4258	33520	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:51.573262930 CEST	4258	33518	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:51.573832035 CEST	33520	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:51.573945045 CEST	33520	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:51.579020977 CEST	4258	33520	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:53.226782084 CEST	4258	33520	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:53.227400064 CEST	33522	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:53.227428913 CEST	33520	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:53.232795000 CEST	4258	33522	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:53.232816935 CEST	4258	33520	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:53.233055115 CEST	33522	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:53.233172894 CEST	33522	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:53.238253117 CEST	4258	33522	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:54.884929895 CEST	4258	33522	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:54.885282993 CEST	33522	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:54.885291100 CEST	33524	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:54.890353918 CEST	4258	33522	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:54.890388012 CEST	4258	33524	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:54.890523911 CEST	33524	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:54.890573978 CEST	33524	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:54.895380020 CEST	4258	33524	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:56.537928104 CEST	4258	33524	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:56.538358927 CEST	33524	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:56.538438082 CEST	33526	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:56.543256998 CEST	4258	33524	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:56.543335915 CEST	4258	33526	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:56.543431044 CEST	33526	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:56.543534040 CEST	33526	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:56.548408985 CEST	4258	33526	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:58.189743042 CEST	4258	33526	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:58.190212965 CEST	33526	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:58.190215111 CEST	33528	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:58.195621014 CEST	4258	33526	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:58.195667028 CEST	4258	33528	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:58.195770025 CEST	33528	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:58.195985079 CEST	33528	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:58.202266932 CEST	4258	33528	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:59.830665112 CEST	4258	33528	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:59.831231117 CEST	33530	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:59.831315994 CEST	33528	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:59.836487055 CEST	4258	33530	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:59.836591005 CEST	4258	33528	57.129.51.86	192.168.2.14
Oct 6, 2024 23:29:59.837100983 CEST	33530	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:59.837101936 CEST	33530	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:29:59.842233896 CEST	4258	33530	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:01.510004044 CEST	4258	33530	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:01.510430098 CEST	33532	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:01.510556936 CEST	33530	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:01.516731977 CEST	4258	33532	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:01.516776085 CEST	4258	33530	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:01.516978025 CEST	33532	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:01.517136097 CEST	33532	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:01.522304058 CEST	4258	33532	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:03.176064968 CEST	4258	33532	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:03.176659107 CEST	33532	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:03.176861048 CEST	33534	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:03.182044029 CEST	4258	33532	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:03.182068110 CEST	4258	33534	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:03.182487965 CEST	33534	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:03.182487965 CEST	33534	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:03.187839031 CEST	4258	33534	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:04.830612898 CEST	4258	33534	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:04.830842972 CEST	33534	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:04.830925941 CEST	33536	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:04.835902929 CEST	4258	33534	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:04.835935116 CEST	4258	33536	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:04.836045027 CEST	33536	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:04.836131096 CEST	33536	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:04.840910912 CEST	4258	33536	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:06.496231079 CEST	4258	33536	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:06.496479988 CEST	33536	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:06.496582031 CEST	33538	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:06.501385927 CEST	4258	33536	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:06.501482964 CEST	4258	33538	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:06.501622915 CEST	33538	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:06.501668930 CEST	33538	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:06.506584883 CEST	4258	33538	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:08.133233070 CEST	4258	33538	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:08.133704901 CEST	33540	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:08.133816957 CEST	33538	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:08.138870955 CEST	4258	33540	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:08.138881922 CEST	4258	33538	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:08.139205933 CEST	33540	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:08.139205933 CEST	33540	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:08.144280910 CEST	4258	33540	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:09.787656069 CEST	4258	33540	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:09.787986994 CEST	33540	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:09.788027048 CEST	33542	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:09.793605089 CEST	4258	33540	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:09.793621063 CEST	4258	33542	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:09.793761969 CEST	33542	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:09.793806076 CEST	33542	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:09.798727036 CEST	4258	33542	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:11.426085949 CEST	4258	33542	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:11.426419973 CEST	33542	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:11.426508904 CEST	33544	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:11.431155920 CEST	4258	33542	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:11.431294918 CEST	4258	33544	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:11.431396008 CEST	33544	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:11.431631088 CEST	33544	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:11.436419010 CEST	4258	33544	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:13.084233046 CEST	4258	33544	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:13.084779978 CEST	33546	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:13.084909916 CEST	33544	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:13.089649916 CEST	4258	33546	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:13.089795113 CEST	4258	33544	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:13.089819908 CEST	33546	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:13.089900017 CEST	33546	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:13.094669104 CEST	4258	33546	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:14.742772102 CEST	4258	33546	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:14.743227959 CEST	33546	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:14.743284941 CEST	33548	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:14.748306990 CEST	4258	33546	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:14.748342991 CEST	4258	33548	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:14.748437881 CEST	33548	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:14.748533964 CEST	33548	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:14.753640890 CEST	4258	33548	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:16.391314030 CEST	4258	33548	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:16.391803026 CEST	33548	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:16.391812086 CEST	33550	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:16.396887064 CEST	4258	33548	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:16.396915913 CEST	4258	33550	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:16.397047043 CEST	33550	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:16.397097111 CEST	33550	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:16.402029037 CEST	4258	33550	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:18.052329063 CEST	4258	33550	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:18.053080082 CEST	33552	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:18.053219080 CEST	33550	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:18.058068037 CEST	4258	33552	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:18.058334112 CEST	33552	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:18.058403969 CEST	4258	33550	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:18.058409929 CEST	33552	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:18.063333035 CEST	4258	33552	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:19.694981098 CEST	4258	33552	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:19.695466042 CEST	33552	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:19.695528030 CEST	33554	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:19.700886011 CEST	4258	33552	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:19.700985909 CEST	4258	33554	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:19.701246977 CEST	33554	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:19.701327085 CEST	33554	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:19.706835032 CEST	4258	33554	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:21.330718994 CEST	4258	33554	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:21.331454039 CEST	33556	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:21.331511021 CEST	33554	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:21.336843014 CEST	4258	33556	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:21.336889982 CEST	4258	33554	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:21.337194920 CEST	33556	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:21.337551117 CEST	33556	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:21.342802048 CEST	4258	33556	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:22.974359989 CEST	4258	33556	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:22.975112915 CEST	33556	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:22.975358963 CEST	33558	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:22.980920076 CEST	4258	33556	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:22.980967045 CEST	4258	33558	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:22.981370926 CEST	33558	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:22.981370926 CEST	33558	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:22.986742973 CEST	4258	33558	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:24.616652966 CEST	4258	33558	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:24.617225885 CEST	33558	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:24.617264032 CEST	33560	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:24.622982979 CEST	4258	33558	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:24.623040915 CEST	4258	33560	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:24.623440981 CEST	33560	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:24.623440981 CEST	33560	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:24.628804922 CEST	4258	33560	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:26.272316933 CEST	4258	33560	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:26.273082018 CEST	33560	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:26.273096085 CEST	33562	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:26.278969049 CEST	4258	33560	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:26.279016018 CEST	4258	33562	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:26.279536009 CEST	33562	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:26.279536009 CEST	33562	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:26.285253048 CEST	4258	33562	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:27.929311991 CEST	4258	33562	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:27.929651976 CEST	33562	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:27.929841995 CEST	33564	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:27.934758902 CEST	4258	33562	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:27.934870005 CEST	4258	33564	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:27.935122967 CEST	33564	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:27.935353994 CEST	33564	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:27.940557957 CEST	4258	33564	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:29.565619946 CEST	4258	33564	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:29.566251040 CEST	33566	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:29.566402912 CEST	33564	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:29.571671009 CEST	4258	33566	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:29.572036982 CEST	33566	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:29.572036982 CEST	33566	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:29.572160006 CEST	4258	33564	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:29.577435970 CEST	4258	33566	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:31.210092068 CEST	4258	33566	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:31.210428953 CEST	33566	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:31.210577965 CEST	33568	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:31.216191053 CEST	4258	33566	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:31.216247082 CEST	4258	33568	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:31.216551065 CEST	33568	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:31.216551065 CEST	33568	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:31.222146034 CEST	4258	33568	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:32.848675966 CEST	4258	33568	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:32.849225044 CEST	33568	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:32.849265099 CEST	33570	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:32.855232000 CEST	4258	33568	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:32.855288029 CEST	4258	33570	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:32.855686903 CEST	33570	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:32.856139898 CEST	33570	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:32.861632109 CEST	4258	33570	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:34.505073071 CEST	4258	33570	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:34.505743980 CEST	33570	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:34.505892038 CEST	33572	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:34.511328936 CEST	4258	33570	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:34.511409998 CEST	4258	33572	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:34.511854887 CEST	33572	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:34.511854887 CEST	33572	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:34.517445087 CEST	4258	33572	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:36.143626928 CEST	4258	33572	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:36.144107103 CEST	33574	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:36.144248962 CEST	33572	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:36.149452925 CEST	4258	33574	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:36.149734020 CEST	4258	33572	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:36.149888992 CEST	33574	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:36.150003910 CEST	33574	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:36.155227900 CEST	4258	33574	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:37.787136078 CEST	4258	33574	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:37.787592888 CEST	33574	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:37.787609100 CEST	33576	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:37.793255091 CEST	4258	33574	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:37.793303013 CEST	4258	33576	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:37.793392897 CEST	33576	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:37.793392897 CEST	33576	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:37.799021959 CEST	4258	33576	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:39.448388100 CEST	4258	33576	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:39.448920012 CEST	33578	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:39.448951006 CEST	33576	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:39.454730034 CEST	4258	33578	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:39.454777002 CEST	4258	33576	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:39.455216885 CEST	33578	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:39.455308914 CEST	33578	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:39.461364031 CEST	4258	33578	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:41.100337029 CEST	4258	33578	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:41.101064920 CEST	33578	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:41.101109982 CEST	33580	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:41.106551886 CEST	4258	33578	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:41.106604099 CEST	4258	33580	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:41.107007980 CEST	33580	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:41.107007980 CEST	33580	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:41.112569094 CEST	4258	33580	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:42.761042118 CEST	4258	33580	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:42.761558056 CEST	33582	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:42.761663914 CEST	33580	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:42.767196894 CEST	4258	33582	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:42.767251015 CEST	4258	33580	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:42.767637968 CEST	33582	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:42.767901897 CEST	33582	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:42.773495913 CEST	4258	33582	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:44.436583996 CEST	4258	33582	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:44.437293053 CEST	33582	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:44.437390089 CEST	33584	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:44.443080902 CEST	4258	33582	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:44.443198919 CEST	4258	33584	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:44.443449974 CEST	33584	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:44.443802118 CEST	33584	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:44.449426889 CEST	4258	33584	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:46.090419054 CEST	4258	33584	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:46.091367006 CEST	33584	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:46.091464996 CEST	33586	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:46.097435951 CEST	4258	33584	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:46.097490072 CEST	4258	33586	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:46.097867966 CEST	33586	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:46.098007917 CEST	33586	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:46.103184938 CEST	4258	33586	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:47.742649078 CEST	4258	33586	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:47.743110895 CEST	33586	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:47.743180037 CEST	33588	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:47.748809099 CEST	4258	33586	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:47.748857021 CEST	4258	33588	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:47.749020100 CEST	33588	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:47.749144077 CEST	33588	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:47.754676104 CEST	4258	33588	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:49.399784088 CEST	4258	33588	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:49.400197029 CEST	33588	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:49.400360107 CEST	33590	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:49.405632973 CEST	4258	33588	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:49.406229019 CEST	4258	33590	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:49.406640053 CEST	33590	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:49.406640053 CEST	33590	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:49.412278891 CEST	4258	33590	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:51.036583900 CEST	4258	33590	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:51.037208080 CEST	33590	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:51.037211895 CEST	33592	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:51.042821884 CEST	4258	33590	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:51.042870998 CEST	4258	33592	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:51.043000937 CEST	33592	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:51.043183088 CEST	33592	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:51.048477888 CEST	4258	33592	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:52.678922892 CEST	4258	33592	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:52.679522991 CEST	33592	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:52.679608107 CEST	33594	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:52.684978962 CEST	4258	33592	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:52.685028076 CEST	4258	33594	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:52.685277939 CEST	33594	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:52.685393095 CEST	33594	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:52.690609932 CEST	4258	33594	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:54.318288088 CEST	4258	33594	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:54.319024086 CEST	33596	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:54.319036961 CEST	33594	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:54.324685097 CEST	4258	33594	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:54.324733019 CEST	4258	33596	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:54.325227976 CEST	33596	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:54.325357914 CEST	33596	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:54.330579996 CEST	4258	33596	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:55.957487106 CEST	4258	33596	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:55.957668066 CEST	33596	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:55.957746029 CEST	33598	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:55.963222980 CEST	4258	33596	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:55.963283062 CEST	4258	33598	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:55.963413000 CEST	33598	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:55.963469028 CEST	33598	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:55.968530893 CEST	4258	33598	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:56.514698029 CEST	45364	53	192.168.2.14	8.8.8.8
Oct 6, 2024 23:30:56.520205021 CEST	53	45364	8.8.8.8	192.168.2.14
Oct 6, 2024 23:30:56.520318985 CEST	45364	53	192.168.2.14	8.8.8.8
Oct 6, 2024 23:30:56.520339012 CEST	45364	53	192.168.2.14	8.8.8.8
Oct 6, 2024 23:30:56.520368099 CEST	45364	53	192.168.2.14	8.8.8.8
Oct 6, 2024 23:30:56.526473999 CEST	53	45364	8.8.8.8	192.168.2.14
Oct 6, 2024 23:30:56.526519060 CEST	53	45364	8.8.8.8	192.168.2.14
Oct 6, 2024 23:30:56.971659899 CEST	53	45364	8.8.8.8	192.168.2.14
Oct 6, 2024 23:30:56.971750021 CEST	45364	53	192.168.2.14	8.8.8.8
Oct 6, 2024 23:30:57.622416973 CEST	4258	33598	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:57.622564077 CEST	33602	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:57.622617960 CEST	33598	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:57.628956079 CEST	4258	33602	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:57.629002094 CEST	4258	33598	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:57.632487059 CEST	33602	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:57.632530928 CEST	33602	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:57.638803959 CEST	4258	33602	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:58.971626997 CEST	53	45364	8.8.8.8	192.168.2.14
Oct 6, 2024 23:30:58.972227097 CEST	45364	53	192.168.2.14	8.8.8.8
Oct 6, 2024 23:30:58.977633953 CEST	53	45364	8.8.8.8	192.168.2.14
Oct 6, 2024 23:30:59.269222975 CEST	4258	33602	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:59.269980907 CEST	33602	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:59.270003080 CEST	33604	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:59.275365114 CEST	4258	33602	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:59.275399923 CEST	4258	33604	57.129.51.86	192.168.2.14
Oct 6, 2024 23:30:59.275819063 CEST	33604	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:59.275819063 CEST	33604	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:30:59.281296015 CEST	4258	33604	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:00.927438974 CEST	4258	33604	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:00.927855968 CEST	33606	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:00.927980900 CEST	33604	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:00.932838917 CEST	4258	33606	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:00.933056116 CEST	4258	33604	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:00.933146000 CEST	33606	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:00.933336973 CEST	33606	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:00.938298941 CEST	4258	33606	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:02.617943048 CEST	4258	33606	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:02.618444920 CEST	33606	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:02.618505955 CEST	33608	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:02.625277996 CEST	4258	33606	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:02.625324965 CEST	4258	33608	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:02.625520945 CEST	33608	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:02.625566006 CEST	33608	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:02.631949902 CEST	4258	33608	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:04.275903940 CEST	4258	33608	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:04.276326895 CEST	33608	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:04.276462078 CEST	33610	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:04.281796932 CEST	4258	33608	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:04.281842947 CEST	4258	33610	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:04.282263994 CEST	33610	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:04.282352924 CEST	33610	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:04.287575006 CEST	4258	33610	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:05.929405928 CEST	4258	33610	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:05.930054903 CEST	33610	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:05.930111885 CEST	33612	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:05.935723066 CEST	4258	33610	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:05.935769081 CEST	4258	33612	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:05.936014891 CEST	33612	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:05.936014891 CEST	33612	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:05.941715002 CEST	4258	33612	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:07.566414118 CEST	4258	33612	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:07.566961050 CEST	33612	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:07.567084074 CEST	33614	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:07.572041035 CEST	4258	33612	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:07.572155952 CEST	4258	33614	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:07.572523117 CEST	33614	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:07.572524071 CEST	33614	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:07.577594995 CEST	4258	33614	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:09.212775946 CEST	4258	33614	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:09.213711023 CEST	33616	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:09.213749886 CEST	33614	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:09.219182968 CEST	4258	33616	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:09.219229937 CEST	4258	33614	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:09.219484091 CEST	33616	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:09.219641924 CEST	33616	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:09.224648952 CEST	4258	33616	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:10.849412918 CEST	4258	33616	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:10.849908113 CEST	33616	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:10.850028038 CEST	33618	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:10.855334044 CEST	4258	33616	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:10.855355978 CEST	4258	33618	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:10.855515003 CEST	33618	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:10.855640888 CEST	33618	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:10.860874891 CEST	4258	33618	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:12.488650084 CEST	4258	33618	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:12.489196062 CEST	33618	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:12.489219904 CEST	33620	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:12.494412899 CEST	4258	33618	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:12.494435072 CEST	4258	33620	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:12.494724989 CEST	33620	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:12.494932890 CEST	33620	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:12.500283003 CEST	4258	33620	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:14.149017096 CEST	4258	33620	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:14.149758101 CEST	33620	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:14.149880886 CEST	33622	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:14.155107975 CEST	4258	33620	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:14.155129910 CEST	4258	33622	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:14.155356884 CEST	33622	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:14.155356884 CEST	33622	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:14.160860062 CEST	4258	33622	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:15.806615114 CEST	4258	33622	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:15.807212114 CEST	33624	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:15.807352066 CEST	33622	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:15.812203884 CEST	4258	33624	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:15.812254906 CEST	4258	33622	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:15.812455893 CEST	33624	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:15.812602997 CEST	33624	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:15.817420959 CEST	4258	33624	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:17.465192080 CEST	4258	33624	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:17.465823889 CEST	33624	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:17.466037989 CEST	33626	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:17.471875906 CEST	4258	33624	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:17.471899033 CEST	4258	33626	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:17.471981049 CEST	33626	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:17.472032070 CEST	33626	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:17.477396965 CEST	4258	33626	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:19.113476038 CEST	4258	33626	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:19.114183903 CEST	33628	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:19.114187956 CEST	33626	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:19.119841099 CEST	4258	33626	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:19.119889021 CEST	4258	33628	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:19.120255947 CEST	33628	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:19.120255947 CEST	33628	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:19.125782967 CEST	4258	33628	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:20.771603107 CEST	4258	33628	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:20.772492886 CEST	33630	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:20.772610903 CEST	33628	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:20.778369904 CEST	4258	33630	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:20.778422117 CEST	4258	33628	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:20.778945923 CEST	33630	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:20.778947115 CEST	33630	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:20.784498930 CEST	4258	33630	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:22.426440954 CEST	4258	33630	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:22.427267075 CEST	33632	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:22.427292109 CEST	33630	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:22.432830095 CEST	4258	33632	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:22.432943106 CEST	4258	33630	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:22.433237076 CEST	33632	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:22.433403969 CEST	33632	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:22.438429117 CEST	4258	33632	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:24.088084936 CEST	4258	33632	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:24.088644028 CEST	33634	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:24.088788033 CEST	33632	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:24.093844891 CEST	4258	33634	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:24.093998909 CEST	4258	33632	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:24.094110012 CEST	33634	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:24.094347954 CEST	33634	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:24.099349976 CEST	4258	33634	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:25.786963940 CEST	4258	33634	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:25.787441015 CEST	33634	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:25.787463903 CEST	33636	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:25.792634010 CEST	4258	33634	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:25.792665958 CEST	4258	33636	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:25.792866945 CEST	33636	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:25.792866945 CEST	33636	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:25.797939062 CEST	4258	33636	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:27.429562092 CEST	4258	33636	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:27.430084944 CEST	33636	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:27.430171013 CEST	33638	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:27.435281992 CEST	4258	33636	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:27.435312986 CEST	4258	33638	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:27.435753107 CEST	33638	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:27.436125994 CEST	33638	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:27.441168070 CEST	4258	33638	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:29.067631960 CEST	4258	33638	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:29.068408966 CEST	33640	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:29.068417072 CEST	33638	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:29.073945999 CEST	4258	33638	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:29.074043036 CEST	4258	33640	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:29.074655056 CEST	33640	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:29.074655056 CEST	33640	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:29.080038071 CEST	4258	33640	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:30.724478960 CEST	4258	33640	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:30.724994898 CEST	33642	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:30.725127935 CEST	33640	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:30.729969025 CEST	4258	33642	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:30.730267048 CEST	4258	33640	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:30.730423927 CEST	33642	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:30.730743885 CEST	33642	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:30.735603094 CEST	4258	33642	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:32.395108938 CEST	4258	33642	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:32.395556927 CEST	33642	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:32.395663977 CEST	33644	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:32.400913000 CEST	4258	33642	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:32.400933981 CEST	4258	33644	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:32.401415110 CEST	33644	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:32.401505947 CEST	33644	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:32.406626940 CEST	4258	33644	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:34.035190105 CEST	4258	33644	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:34.035571098 CEST	33644	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:34.035762072 CEST	33646	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:34.040777922 CEST	4258	33644	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:34.040824890 CEST	4258	33646	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:34.041177034 CEST	33646	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:34.041177034 CEST	33646	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:34.046431065 CEST	4258	33646	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:35.678020954 CEST	4258	33646	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:35.678533077 CEST	33648	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:35.678602934 CEST	33646	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:35.683907986 CEST	4258	33648	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:35.683971882 CEST	4258	33646	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:35.684046984 CEST	33648	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:35.684130907 CEST	33648	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:35.689383984 CEST	4258	33648	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:37.338589907 CEST	4258	33648	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:37.339121103 CEST	33648	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:37.339297056 CEST	33650	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:37.344326019 CEST	4258	33648	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:37.344346046 CEST	4258	33650	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:37.344693899 CEST	33650	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:37.344695091 CEST	33650	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:37.349749088 CEST	4258	33650	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:38.991301060 CEST	4258	33650	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:38.991835117 CEST	33650	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:38.991856098 CEST	33652	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:38.996860981 CEST	4258	33650	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:38.996928930 CEST	4258	33652	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:38.997196913 CEST	33652	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:38.997196913 CEST	33652	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:39.002887011 CEST	4258	33652	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:40.744770050 CEST	4258	33652	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:40.745449066 CEST	33654	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:40.745579958 CEST	33652	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:40.750305891 CEST	4258	33654	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:40.750370026 CEST	4258	33652	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:40.750549078 CEST	33654	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:40.750549078 CEST	33654	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:40.755491018 CEST	4258	33654	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:42.416887045 CEST	4258	33654	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:42.417458057 CEST	33656	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:42.417486906 CEST	33654	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:42.422497988 CEST	4258	33656	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:42.422512054 CEST	4258	33654	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:42.422727108 CEST	33656	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:42.422727108 CEST	33656	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:42.427762985 CEST	4258	33656	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:44.074444056 CEST	4258	33656	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:44.074985027 CEST	33656	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:44.074975014 CEST	33658	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:44.080329895 CEST	4258	33656	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:44.080351114 CEST	4258	33658	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:44.080802917 CEST	33658	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:44.080802917 CEST	33658	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:44.086251974 CEST	4258	33658	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:45.707746029 CEST	4258	33658	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:45.708358049 CEST	33658	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:45.708416939 CEST	33660	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:45.713668108 CEST	4258	33658	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:45.714005947 CEST	4258	33660	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:45.714370012 CEST	33660	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:45.714658976 CEST	33660	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:45.719990969 CEST	4258	33660	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:47.347906113 CEST	4258	33660	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:47.348606110 CEST	33660	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:47.348720074 CEST	33662	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:47.353844881 CEST	4258	33660	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:47.353867054 CEST	4258	33662	57.129.51.86	192.168.2.14
Oct 6, 2024 23:31:47.354453087 CEST	33662	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:47.354584932 CEST	33662	4258	192.168.2.14	57.129.51.86
Oct 6, 2024 23:31:47.359653950 CEST	4258	33662	57.129.51.86	192.168.2.14

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 6, 2024 23:30:56.520339012 CEST	192.168.2.14	8.8.8.8	0x1981	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:30:56.520368099 CEST	192.168.2.14	8.8.8.8	0x70ed	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 6, 2024 23:30:56.971659899 CEST	8.8.8.8	192.168.2.14	0x1981	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:30:56.971659899 CEST	8.8.8.8	192.168.2.14	0x1981	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: na.elf PID: 5627, Parent PID: 5544

General

Start time (UTC):	21:28:11
Start date (UTC):	06/10/2024
Path:	/tmp/na.elf
Arguments:	/tmp/na.elf
File size:	127460 bytes
MD5 hash:	05b3f931897f9ea9e0611b25a49fd099

Chronological Activities

Analysis Process: na.elf PID: 5628, Parent PID: 5627

General

Start time (UTC):	21:28:11
Start date (UTC):	06/10/2024
Path:	/tmp/na.elf
Arguments:	-
File size:	127460 bytes
MD5 hash:	05b3f931897f9ea9e0611b25a49fd099

Chronological Activities

Analysis Process: na.elf PID: 5629, Parent PID: 5628

General

Start time (UTC):	21:28:11
Start date (UTC):	06/10/2024
Path:	/tmp/na.elf
Arguments:	-
File size:	127460 bytes
MD5 hash:	05b3f931897f9ea9e0611b25a49fd099

Description:	Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping or `net view` using Net .
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report na.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Threatname: Gafgyt

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: na.elf PID: 5627, Parent PID: 5544

General

Chronological Activities

Analysis Process: na.elf PID: 5628, Parent PID: 5627

General

Chronological Activities

Analysis Process: na.elf PID: 5629, Parent PID: 5628

General

Linux Analysis Report
na.elf