Edit tour

Linux Analysis Report
na.elf

Overview

General Information

Sample name:	na.elf
Analysis ID:	1527396
MD5:	f8ba06420003562376e39b51ff51b459
SHA1:	80483e7936e1dc02a96eb46fc95ac59a5c0bd95f
SHA256:	09a11d7f2b873fafca44d235c28319872ef9011241043610ca0e67588751c3dd
Tags:	elfGafgytuser-abuse_ch
Infos:

Detection

Gafgyt, Mirai

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Gafgyt

Yara detected Mirai

Contains symbols with names commonly found in malware

Machine Learning detection for sample

Opens /proc/net/* files useful for finding connected devices and routers

Detected TCP or UDP traffic on non-standard ports

Sample contains strings that are user agent strings indicative of HTTP manipulation

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1527396
Start date and time:	2024-10-06 23:28:33 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	na.elf
Detection:	MAL
Classification:	mal100.spre.troj.linELF@0/0@2/0

Warnings

VT rate limit hit for: na.elf

Runtime Messages

Command:	/tmp/na.elf
PID:	5445
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

na.elf (PID: 5445, Parent: 5370, MD5: f8ba06420003562376e39b51ff51b459) Arguments: /tmp/na.elf

na.elf New Fork (PID: 5446, Parent: 5445)

na.elf New Fork (PID: 5447, Parent: 5446)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
na.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
na.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
na.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x11800:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11814:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11828:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1183c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11850:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11864:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11878:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1188c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11904:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11918:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1192c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11940:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11954:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11968:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1197c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11990:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
na.elf	Linux_Trojan_Gafgyt_c573932b	unknown	unknown	0x8a1:$a: 83 7D 18 00 74 22 8B 45 1C 83 E0 02 85 C0 74 18 83 EC 08 6A 2D FF
na.elf	Linux_Trojan_Gafgyt_5bf62ce4	unknown	unknown	0xc82d:$a: 89 E5 56 53 31 F6 8D 45 10 83 EC 10 89 45 F4 8B 55 F4 46 8D
na.elf	Linux_Trojan_Gafgyt_6122acdf	unknown	unknown	0x626:$a: E8 B0 00 FC 8B 7D E8 F2 AE 89 C8 F7 D0 48 48 89 45 F8 EB 03 FF
na.elf	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x13b20:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x15b68:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
na.elf	Linux_Trojan_Gafgyt_7167d08f	unknown	unknown	0x93e:$a: 0C 8A 00 3C 2D 75 13 FF 45 0C C7 45 E4 01 00 00 00 EB 07 FF
na.elf	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xc3cc:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
Click to see the 4 entries

Memory Dumps

Source	Rule	Description	Author	Strings
5446.1.0000000008048000.0000000008060000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
5446.1.0000000008048000.0000000008060000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5446.1.0000000008048000.0000000008060000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x11800:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11814:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11828:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1183c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11850:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11864:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11878:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1188c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11904:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11918:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1192c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11940:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11954:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11968:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1197c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11990:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5446.1.0000000008048000.0000000008060000.r-x.sdmp	Linux_Trojan_Gafgyt_c573932b	unknown	unknown	0x8a1:$a: 83 7D 18 00 74 22 8B 45 1C 83 E0 02 85 C0 74 18 83 EC 08 6A 2D FF
5446.1.0000000008048000.0000000008060000.r-x.sdmp	Linux_Trojan_Gafgyt_5bf62ce4	unknown	unknown	0xc82d:$a: 89 E5 56 53 31 F6 8D 45 10 83 EC 10 89 45 F4 8B 55 F4 46 8D
5446.1.0000000008048000.0000000008060000.r-x.sdmp	Linux_Trojan_Gafgyt_6122acdf	unknown	unknown	0x626:$a: E8 B0 00 FC 8B 7D E8 F2 AE 89 C8 F7 D0 48 48 89 45 F8 EB 03 FF
5446.1.0000000008048000.0000000008060000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x13b20:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x15b68:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
5446.1.0000000008048000.0000000008060000.r-x.sdmp	Linux_Trojan_Gafgyt_7167d08f	unknown	unknown	0x93e:$a: 0C 8A 00 3C 2D 75 13 FF 45 0C C7 45 E4 01 00 00 00 EB 07 FF
5446.1.0000000008048000.0000000008060000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xc3cc:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
5445.1.0000000008048000.0000000008060000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
5445.1.0000000008048000.0000000008060000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5445.1.0000000008048000.0000000008060000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x11800:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11814:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11828:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1183c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11850:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11864:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11878:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1188c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11904:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11918:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1192c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11940:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11954:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11968:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1197c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11990:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5445.1.0000000008048000.0000000008060000.r-x.sdmp	Linux_Trojan_Gafgyt_c573932b	unknown	unknown	0x8a1:$a: 83 7D 18 00 74 22 8B 45 1C 83 E0 02 85 C0 74 18 83 EC 08 6A 2D FF
5445.1.0000000008048000.0000000008060000.r-x.sdmp	Linux_Trojan_Gafgyt_5bf62ce4	unknown	unknown	0xc82d:$a: 89 E5 56 53 31 F6 8D 45 10 83 EC 10 89 45 F4 8B 55 F4 46 8D
5445.1.0000000008048000.0000000008060000.r-x.sdmp	Linux_Trojan_Gafgyt_6122acdf	unknown	unknown	0x626:$a: E8 B0 00 FC 8B 7D E8 F2 AE 89 C8 F7 D0 48 48 89 45 F8 EB 03 FF
5445.1.0000000008048000.0000000008060000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x13b20:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x15b68:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
5445.1.0000000008048000.0000000008060000.r-x.sdmp	Linux_Trojan_Gafgyt_7167d08f	unknown	unknown	0x93e:$a: 0C 8A 00 3C 2D 75 13 FF 45 0C C7 45 E4 01 00 00 00 EB 07 FF
5445.1.0000000008048000.0000000008060000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xc3cc:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
Process Memory Space: na.elf PID: 5445	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: na.elf PID: 5445	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x2caa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2cbe:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2cd2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2ce6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2cfa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2d0e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2d22:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2d36:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2d4a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2d5e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2d72:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2d86:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2d9a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2dae:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2dc2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2dd6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2dea:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2dfe:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e12:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e26:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e3a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: na.elf PID: 5445	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x6150:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x63bd:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x8fe9:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: na.elf PID: 5446	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: na.elf PID: 5446	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x2d58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2d6c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2d80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2d94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2da8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2dbc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2dd0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2de4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2df8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2eac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2ec0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2ed4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2ee8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: na.elf PID: 5446	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x61fe:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x646b:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x9097:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Click to see the 19 entries

Suricata Signatures

ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-06T23:29:24.507861+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39262	57.129.51.86	4258	TCP
2024-10-06T23:29:26.148330+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39264	57.129.51.86	4258	TCP
2024-10-06T23:29:27.788776+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39266	57.129.51.86	4258	TCP
2024-10-06T23:29:29.430673+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39268	57.129.51.86	4258	TCP
2024-10-06T23:29:31.071933+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39270	57.129.51.86	4258	TCP
2024-10-06T23:29:32.717989+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39272	57.129.51.86	4258	TCP
2024-10-06T23:29:34.373303+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39274	57.129.51.86	4258	TCP
2024-10-06T23:29:36.043185+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39276	57.129.51.86	4258	TCP
2024-10-06T23:29:37.681407+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39278	57.129.51.86	4258	TCP
2024-10-06T23:29:39.344042+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39280	57.129.51.86	4258	TCP
2024-10-06T23:29:41.033744+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39282	57.129.51.86	4258	TCP
2024-10-06T23:29:42.722853+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39284	57.129.51.86	4258	TCP
2024-10-06T23:29:44.367656+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39286	57.129.51.86	4258	TCP
2024-10-06T23:29:46.059817+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39288	57.129.51.86	4258	TCP
2024-10-06T23:29:47.696946+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39290	57.129.51.86	4258	TCP
2024-10-06T23:29:49.338628+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39292	57.129.51.86	4258	TCP
2024-10-06T23:29:50.998419+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39294	57.129.51.86	4258	TCP
2024-10-06T23:29:52.633249+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39296	57.129.51.86	4258	TCP
2024-10-06T23:29:54.295807+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39298	57.129.51.86	4258	TCP
2024-10-06T23:29:55.946813+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39300	57.129.51.86	4258	TCP
2024-10-06T23:29:57.613077+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39302	57.129.51.86	4258	TCP
2024-10-06T23:29:59.274294+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39304	57.129.51.86	4258	TCP
2024-10-06T23:30:00.917095+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39306	57.129.51.86	4258	TCP
2024-10-06T23:30:02.778652+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39308	57.129.51.86	4258	TCP
2024-10-06T23:30:04.469008+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39310	57.129.51.86	4258	TCP
2024-10-06T23:30:06.137410+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39312	57.129.51.86	4258	TCP
2024-10-06T23:30:07.779115+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39314	57.129.51.86	4258	TCP
2024-10-06T23:30:09.623940+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39316	57.129.51.86	4258	TCP
2024-10-06T23:30:11.430180+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39318	57.129.51.86	4258	TCP
2024-10-06T23:30:13.093488+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39320	57.129.51.86	4258	TCP
2024-10-06T23:30:14.729781+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39322	57.129.51.86	4258	TCP
2024-10-06T23:30:16.397042+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39324	57.129.51.86	4258	TCP
2024-10-06T23:30:18.061993+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39326	57.129.51.86	4258	TCP
2024-10-06T23:30:19.735176+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39328	57.129.51.86	4258	TCP
2024-10-06T23:30:21.369855+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39330	57.129.51.86	4258	TCP
2024-10-06T23:30:23.026841+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39332	57.129.51.86	4258	TCP
2024-10-06T23:30:24.670358+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39334	57.129.51.86	4258	TCP
2024-10-06T23:30:26.327462+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39336	57.129.51.86	4258	TCP
2024-10-06T23:30:27.964313+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39338	57.129.51.86	4258	TCP
2024-10-06T23:30:29.602576+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39340	57.129.51.86	4258	TCP
2024-10-06T23:30:31.248946+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39342	57.129.51.86	4258	TCP
2024-10-06T23:30:32.908266+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39344	57.129.51.86	4258	TCP
2024-10-06T23:30:34.565055+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39346	57.129.51.86	4258	TCP
2024-10-06T23:30:36.218905+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39348	57.129.51.86	4258	TCP
2024-10-06T23:30:37.870571+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39350	57.129.51.86	4258	TCP
2024-10-06T23:30:39.527804+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39352	57.129.51.86	4258	TCP
2024-10-06T23:30:41.166474+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39354	57.129.51.86	4258	TCP
2024-10-06T23:30:42.813670+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39356	57.129.51.86	4258	TCP
2024-10-06T23:30:44.490325+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39358	57.129.51.86	4258	TCP
2024-10-06T23:30:46.156800+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39360	57.129.51.86	4258	TCP
2024-10-06T23:30:47.827828+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39362	57.129.51.86	4258	TCP
2024-10-06T23:30:49.478802+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39364	57.129.51.86	4258	TCP
2024-10-06T23:30:51.120947+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39366	57.129.51.86	4258	TCP
2024-10-06T23:30:52.795372+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39368	57.129.51.86	4258	TCP
2024-10-06T23:30:54.454357+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39370	57.129.51.86	4258	TCP
2024-10-06T23:30:56.125099+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39372	57.129.51.86	4258	TCP
2024-10-06T23:30:57.765592+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39374	57.129.51.86	4258	TCP
2024-10-06T23:30:59.399969+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39376	57.129.51.86	4258	TCP
2024-10-06T23:31:01.051016+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39378	57.129.51.86	4258	TCP
2024-10-06T23:31:02.683667+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39380	57.129.51.86	4258	TCP
2024-10-06T23:31:04.322986+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39382	57.129.51.86	4258	TCP
2024-10-06T23:31:05.983162+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39384	57.129.51.86	4258	TCP
2024-10-06T23:31:07.618901+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39386	57.129.51.86	4258	TCP
2024-10-06T23:31:09.263763+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39388	57.129.51.86	4258	TCP
2024-10-06T23:31:10.902842+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39390	57.129.51.86	4258	TCP
2024-10-06T23:31:12.543095+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39392	57.129.51.86	4258	TCP
2024-10-06T23:31:14.186315+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39394	57.129.51.86	4258	TCP
2024-10-06T23:31:15.839899+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39396	57.129.51.86	4258	TCP
2024-10-06T23:31:17.488958+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39398	57.129.51.86	4258	TCP
2024-10-06T23:31:19.140134+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39400	57.129.51.86	4258	TCP
2024-10-06T23:31:20.797528+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39402	57.129.51.86	4258	TCP
2024-10-06T23:31:22.434124+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39404	57.129.51.86	4258	TCP
2024-10-06T23:31:24.091012+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39406	57.129.51.86	4258	TCP
2024-10-06T23:31:25.783215+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39408	57.129.51.86	4258	TCP
2024-10-06T23:31:27.434445+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39410	57.129.51.86	4258	TCP
2024-10-06T23:31:29.075083+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39412	57.129.51.86	4258	TCP
2024-10-06T23:31:30.717874+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39414	57.129.51.86	4258	TCP
2024-10-06T23:31:32.391206+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39416	57.129.51.86	4258	TCP
2024-10-06T23:31:34.027807+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39418	57.129.51.86	4258	TCP
2024-10-06T23:31:35.688452+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39420	57.129.51.86	4258	TCP
2024-10-06T23:31:37.342675+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39422	57.129.51.86	4258	TCP
2024-10-06T23:31:38.997305+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39424	57.129.51.86	4258	TCP
2024-10-06T23:31:40.750339+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39426	57.129.51.86	4258	TCP
2024-10-06T23:31:42.389418+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39428	57.129.51.86	4258	TCP
2024-10-06T23:31:44.026152+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39430	57.129.51.86	4258	TCP
2024-10-06T23:31:45.673556+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39432	57.129.51.86	4258	TCP
2024-10-06T23:31:47.346504+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39434	57.129.51.86	4258	TCP
2024-10-06T23:31:48.999426+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39436	57.129.51.86	4258	TCP
2024-10-06T23:31:50.638531+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39438	57.129.51.86	4258	TCP
2024-10-06T23:31:52.295520+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39440	57.129.51.86	4258	TCP
2024-10-06T23:31:53.965222+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39442	57.129.51.86	4258	TCP
2024-10-06T23:31:55.943443+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39444	57.129.51.86	4258	TCP
2024-10-06T23:31:57.596044+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39446	57.129.51.86	4258	TCP
2024-10-06T23:31:59.241987+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39448	57.129.51.86	4258	TCP
2024-10-06T23:32:00.871292+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39450	57.129.51.86	4258	TCP
2024-10-06T23:32:02.548279+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39452	57.129.51.86	4258	TCP
2024-10-06T23:32:04.183507+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39454	57.129.51.86	4258	TCP
2024-10-06T23:32:05.827913+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39456	57.129.51.86	4258	TCP
2024-10-06T23:32:07.486238+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39458	57.129.51.86	4258	TCP
2024-10-06T23:32:09.124307+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39460	57.129.51.86	4258	TCP
2024-10-06T23:32:10.776267+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39462	57.129.51.86	4258	TCP
2024-10-06T23:32:12.416391+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39464	57.129.51.86	4258	TCP
2024-10-06T23:32:14.075467+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39466	57.129.51.86	4258	TCP
2024-10-06T23:32:15.715041+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39468	57.129.51.86	4258	TCP
2024-10-06T23:32:17.388180+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39470	57.129.51.86	4258	TCP
2024-10-06T23:32:19.028665+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39472	57.129.51.86	4258	TCP
2024-10-06T23:32:20.671763+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39474	57.129.51.86	4258	TCP
2024-10-06T23:32:22.326941+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39476	57.129.51.86	4258	TCP
2024-10-06T23:32:23.980879+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39478	57.129.51.86	4258	TCP
2024-10-06T23:32:25.627271+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39480	57.129.51.86	4258	TCP
2024-10-06T23:32:27.261793+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39482	57.129.51.86	4258	TCP
2024-10-06T23:32:28.948389+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39484	57.129.51.86	4258	TCP
2024-10-06T23:32:30.611375+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39486	57.129.51.86	4258	TCP
2024-10-06T23:32:32.246737+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39488	57.129.51.86	4258	TCP
2024-10-06T23:32:33.886256+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39490	57.129.51.86	4258	TCP
2024-10-06T23:32:35.527056+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39492	57.129.51.86	4258	TCP
2024-10-06T23:32:37.231324+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39494	57.129.51.86	4258	TCP
2024-10-06T23:32:38.875811+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39496	57.129.51.86	4258	TCP
2024-10-06T23:32:40.551473+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39498	57.129.51.86	4258	TCP
2024-10-06T23:32:42.205015+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39500	57.129.51.86	4258	TCP
2024-10-06T23:32:43.923698+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39502	57.129.51.86	4258	TCP
2024-10-06T23:32:45.583360+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39504	57.129.51.86	4258	TCP
2024-10-06T23:32:47.245313+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39506	57.129.51.86	4258	TCP
2024-10-06T23:32:48.889207+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39508	57.129.51.86	4258	TCP
2024-10-06T23:32:50.582157+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39510	57.129.51.86	4258	TCP
2024-10-06T23:32:52.216831+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39512	57.129.51.86	4258	TCP
2024-10-06T23:32:53.874893+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39514	57.129.51.86	4258	TCP
2024-10-06T23:32:55.528836+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39516	57.129.51.86	4258	TCP
2024-10-06T23:32:57.226324+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39518	57.129.51.86	4258	TCP
2024-10-06T23:32:58.878074+0200	2846526	1	A Network Trojan was detected	192.168.2.13	39520	57.129.51.86	4258	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: na.elf

Avira: detected

Found malware configuration

Source: na.elf

Malware Configuration Extractor: Gafgyt {"C2 url": "57.129.51.86:4258"}

Multi AV Scanner detection for submitted file

Source: na.elf

ReversingLabs: Detection: 68%

Machine Learning detection for sample

Source: na.elf

Joe Sandbox ML: detected

Spreading

Opens /proc/net/* files useful for finding connected devices and routers

Source: /tmp/na.elf (PID: 5445)

Opens: /proc/net/route

Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39280 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39272 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39310 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39290 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39264 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39296 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39282 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39298 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39306 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39292 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39326 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39352 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39362 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39322 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39314 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39392 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39438 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39416 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39474 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39344 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39328 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39360 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39286 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39386 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39288 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39312 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39320 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39308 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39262 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39300 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39332 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39394 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39266 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39450 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39398 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39426 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39472 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39440 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39338 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39270 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39382 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39368 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39408 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39316 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39400 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39340 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39330 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39324 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39366 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39390 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39372 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39436 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39402 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39406 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39518 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39464 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39496 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39478 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39502 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39380 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39462 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39354 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39318 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39476 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39358 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39482 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39388 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39520 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39404 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39412 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39492 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39432 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39414 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39498 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39514 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39274 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39302 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39336 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39268 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39342 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39334 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39278 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39294 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39506 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39350 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39468 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39446 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39356 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39418 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39470 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39428 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39516 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39384 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39484 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39434 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39458 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39466 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39422 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39500 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39444 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39378 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39346 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39420 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39448 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39430 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39370 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39304 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39454 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39410 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39276 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39442 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39488 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39486 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39460 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39348 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39452 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39508 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39374 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39284 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39396 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39376 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39512 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39424 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39364 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39490 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39456 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39480 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39494 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39504 -> 57.129.51.86:4258
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:39510 -> 57.129.51.86:4258

Source: global traffic

TCP traffic: 192.168.2.13:39262 -> 57.129.51.86:4258

Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.51.86

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

Source: na.elf	String found in binary or memory: http://fast.no/support/crawler.asp)
Source: na.elf	String found in binary or memory: http://feedback.redkolibri.com/
Source: na.elf	String found in binary or memory: http://www.baidu.com/search/spider.htm)
Source: na.elf	String found in binary or memory: http://www.baidu.com/search/spider.html)
Source: na.elf	String found in binary or memory: http://www.billybobbot.com/crawler/)

System Summary

Malicious sample detected (through community Yara rule)

Source: na.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: na.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_c573932b Author: unknown
Source: na.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 Author: unknown
Source: na.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_6122acdf Author: unknown
Source: na.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: na.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_7167d08f Author: unknown
Source: na.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 5446.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5446.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_c573932b Author: unknown
Source: 5446.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 Author: unknown
Source: 5446.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6122acdf Author: unknown
Source: 5446.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5446.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_7167d08f Author: unknown
Source: 5446.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 5445.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5445.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_c573932b Author: unknown
Source: 5445.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 Author: unknown
Source: 5445.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6122acdf Author: unknown
Source: 5445.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5445.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_7167d08f Author: unknown
Source: 5445.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: Process Memory Space: na.elf PID: 5445, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: na.elf PID: 5445, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: na.elf PID: 5446, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: na.elf PID: 5446, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown

Contains symbols with names commonly found in malware

Source: ELF static info symbol of initial sample	Name: httpattack
Source: ELF static info symbol of initial sample	Name: vseattack

Source: na.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: na.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_c573932b reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 18a3025ebb8af46605970ee8d7d18214854b86200001d576553e102cb71df266, id = c573932b-9b3f-4ab7-a6b6-32dcc7473790, last_modified = 2021-09-16
Source: na.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ffc398303f7208e77c4fbdfb50ac896e531b7cee3be2fa820bc8d70cfb20af3, id = 5bf62ce4-619b-4d46-b221-c5bf552474bb, last_modified = 2021-09-16
Source: na.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_6122acdf os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 283275705c729be23d7dc75056388ecae00390bd25ee7b66b0cfc9b85feee212, id = 6122acdf-1eef-45ea-83ea-699d21c2dc20, last_modified = 2021-09-16
Source: na.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: na.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_7167d08f reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = b9df4ab322a2a329168f684b07b7b05ee3d03165c5b9050a4710eae7aeca6cd9, id = 7167d08f-bfeb-4d78-9783-3a1df2ef0ed3, last_modified = 2021-09-16
Source: na.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 5446.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5446.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_c573932b reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 18a3025ebb8af46605970ee8d7d18214854b86200001d576553e102cb71df266, id = c573932b-9b3f-4ab7-a6b6-32dcc7473790, last_modified = 2021-09-16
Source: 5446.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ffc398303f7208e77c4fbdfb50ac896e531b7cee3be2fa820bc8d70cfb20af3, id = 5bf62ce4-619b-4d46-b221-c5bf552474bb, last_modified = 2021-09-16
Source: 5446.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6122acdf os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 283275705c729be23d7dc75056388ecae00390bd25ee7b66b0cfc9b85feee212, id = 6122acdf-1eef-45ea-83ea-699d21c2dc20, last_modified = 2021-09-16
Source: 5446.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5446.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_7167d08f reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = b9df4ab322a2a329168f684b07b7b05ee3d03165c5b9050a4710eae7aeca6cd9, id = 7167d08f-bfeb-4d78-9783-3a1df2ef0ed3, last_modified = 2021-09-16
Source: 5446.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 5445.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5445.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_c573932b reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 18a3025ebb8af46605970ee8d7d18214854b86200001d576553e102cb71df266, id = c573932b-9b3f-4ab7-a6b6-32dcc7473790, last_modified = 2021-09-16
Source: 5445.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ffc398303f7208e77c4fbdfb50ac896e531b7cee3be2fa820bc8d70cfb20af3, id = 5bf62ce4-619b-4d46-b221-c5bf552474bb, last_modified = 2021-09-16
Source: 5445.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6122acdf os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 283275705c729be23d7dc75056388ecae00390bd25ee7b66b0cfc9b85feee212, id = 6122acdf-1eef-45ea-83ea-699d21c2dc20, last_modified = 2021-09-16
Source: 5445.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5445.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_7167d08f reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = b9df4ab322a2a329168f684b07b7b05ee3d03165c5b9050a4710eae7aeca6cd9, id = 7167d08f-bfeb-4d78-9783-3a1df2ef0ed3, last_modified = 2021-09-16
Source: 5445.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: Process Memory Space: na.elf PID: 5445, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: na.elf PID: 5445, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: na.elf PID: 5446, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: na.elf PID: 5446, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.spre.troj.linELF@0/0@2/0

Source: na.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/i386/crt1.S
Source: na.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/i386/crti.S
Source: na.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/i386/crtn.S
Source: na.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/i386/mmap.S
Source: na.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/i386/vfork.S

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match	File source: na.elf, type: SAMPLE
Source: Yara match	File source: 5446.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5445.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY

Yara detected Mirai

Source: Yara match	File source: na.elf, type: SAMPLE
Source: Yara match	File source: 5446.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5445.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: na.elf PID: 5445, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5446, type: MEMORYSTR

Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36
Source: Initial sample	User agent string found: Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; rv:2.2) Gecko/20110201
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.2; U; ru) Presto/2.5.22 Version/10.51
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko
Source: Initial sample	User agent string found: Mozilla/5.0 (Android; Linux armv7l; rv:9.0) Gecko/20111216 Firefox/9.0 Fennec/9.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60
Source: Initial sample	User agent string found: Mozilla/5.0 (iPad; U; CPU OS 5_1 like Mac OS X) AppleWebKit/531.21.10 (KHTML, like Gecko) Version/4.0.4 Mobile/7B367 Safari/531.21.10 UCBrowser/3.4.3.532
Source: Initial sample	User agent string found: Mozilla/5.0 (Nintendo WiiU) AppleWebKit/536.30 (KHTML, like Gecko) NX/3.0.4.2.12 NintendoBrowser/4.3.1.11264.US
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:25.0) Gecko/20100101 Firefox/25.0
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; pl) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; en) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; ja) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; cn) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; fr) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20100101 Firefox/12.0
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; U; Linux x86_64; de; rv:1.9.2.8) Gecko/20100723 Ubuntu/10.04 (lucid) Firefox/3.6.8
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; rv:13.0) Gecko/20100101 Firefox/13.0.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:11.0) Gecko/20100101 Firefox/11.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:13.0) Gecko/20100101 Firefox/13.0.1
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.289 Version/12.01
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.02
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.0) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.112 Safari/535.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en; rv:1.8.1.11) Gecko/20071128 Camino/1.5.4
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; cs; rv:1.9.2.6) Gecko/20100628 myibrow/4alpha2
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Win 9x 4.90; SG; rv:1.9.2.4) Gecko/20101104 Netscape/9.1.0285
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.2.0 Lightning/4.0.2
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10; rv:33.0) Gecko/20100101 Firefox/33.0

Remote Access Functionality

Yara detected Gafgyt

Source: Yara match	File source: na.elf, type: SAMPLE
Source: Yara match	File source: 5446.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5445.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY

Yara detected Mirai

Source: Yara match	File source: na.elf, type: SAMPLE
Source: Yara match	File source: 5446.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5445.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: na.elf PID: 5445, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5446, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	OS Credential Dumping	1 Remote System Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

Threatname: Gafgyt

{"C2 url": "57.129.51.86:4258"}

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label
na.elf	68%	ReversingLabs	Linux.Trojan.LnxGafgyt
na.elf	100%	Avira	LINUX/Mirai.Gafgyt.
na.elf	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.24	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
57.129.51.86:4258	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://www.baidu.com/search/spider.html)	na.elf	false	unknown
http://www.billybobbot.com/crawler/)	na.elf	false	unknown
http://fast.no/support/crawler.asp)	na.elf	false	unknown
http://feedback.redkolibri.com/	na.elf	false	unknown
http://www.baidu.com/search/spider.htm)	na.elf	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
57.129.51.86	unknown	Belgium		2686	ATGS-MMD-ASUS	true

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
57.129.51.86	na.elf	Get hash	malicious	Gafgyt, Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	na.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.25
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.24
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.25
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.25
	x86.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	arm6.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.25
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.25
	na.elf	Get hash	malicious	Unknown	Browse	162.213.35.25

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ATGS-MMD-ASUS	na.elf	Get hash	malicious	Gafgyt, Mirai	Browse	57.129.51.86
	x86.elf	Get hash	malicious	Mirai	Browse	33.142.84.92
	na.elf	Get hash	malicious	Mirai	Browse	34.28.143.151
	na.elf	Get hash	malicious	Unknown	Browse	56.177.161.22
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	51.60.149.163
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	48.82.49.24
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	32.22.246.59
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	48.11.106.110
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	32.201.63.95
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	48.8.237.251

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, not stripped
Entropy (8bit):	6.640518504620159
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	na.elf
File size:	123'364 bytes
MD5:	f8ba06420003562376e39b51ff51b459
SHA1:	80483e7936e1dc02a96eb46fc95ac59a5c0bd95f
SHA256:	09a11d7f2b873fafca44d235c28319872ef9011241043610ca0e67588751c3dd
SHA512:	5a1a2c326a95113fe1569fe8b6a9290a4623768e5e2558905a08cf2cc5547728741a9c311d86dbdf169067907cb67632b00c2470e122f0b4c972dbf50a2a1b8b
SSDEEP:	3072:SNhAfn3U8UXULUwUbUJ1hYlHRRDsBOnRY5hgkEemJC0OzQaGyPZk:SMf3ts05gehYlxO4RY5hgEmJC0OzQaGN
TLSH:	71C32BB5F740C672D18301F2119BDF624D32F2F7169AA54AE3682DB0CE6A1827563F9C
File Content Preview:	.ELF....................d...4...........4. ...(..........................................................j..........Q.td............................U..S.......w....h........[]...$.............U......=.....t..5....$......$.......u........t....h............

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8048164
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	102288
Section Header Size:	40
Number of Section Headers:	16
Header String Table Index:	13

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x8048094	0x94	0x1c	0x0	0x6	AX	0	0	1
.text	PROGBITS	0x80480b0	0xb0	0x100e8	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x8058198	0x10198	0x17	0x0	0x6	AX	0	0	1
.rodata	PROGBITS	0x80581c0	0x101c0	0x7e00	0x0	0x2	A	0	0	32
.eh_frame	PROGBITS	0x805ffc0	0x17fc0	0x4	0x0	0x2	A	0	0	4
.ctors	PROGBITS	0x8060000	0x18000	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x8060008	0x18008	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x8060010	0x18010	0x4	0x0	0x3	WA	0	0	4
.got.plt	PROGBITS	0x8060014	0x18014	0xc	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x8060020	0x18020	0x3c0	0x0	0x3	WA	0	0	32
.bss	NOBITS	0x80603e0	0x183e0	0x66e4	0x0	0x3	WA	0	0	32
.comment	PROGBITS	0x0	0x183e0	0xb40	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x18f20	0x6f	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x19210	0x2d90	0x10	0x0		15	262	4
.strtab	STRTAB	0x0	0x1bfa0	0x2244	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8048000	0x8048000	0x17fc4	0x17fc4	6.7708	0x5	R E	0x1000	.init .text .fini .rodata .eh_frame
LOAD	0x18000	0x8060000	0x8060000	0x3e0	0x6ac4	4.0865	0x6	RW	0x1000	.ctors .dtors .jcr .got.plt .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x8048094	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80480b0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x8058198	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x80581c0	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x805ffc0	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x8060000	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x8060008	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x8060010	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x8060014	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x8060020	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x80603e0	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
C.111.5166	.symtab	0x805ab20	48	OBJECT	<unknown>	DEFAULT	4
C.148.5485	.symtab	0x805af90	24	OBJECT	<unknown>	DEFAULT	4
C.204.6106	.symtab	0x805b580	92	OBJECT	<unknown>	DEFAULT	4
C.207.6220	.symtab	0x805bd60	1144	OBJECT	<unknown>	DEFAULT	4
C.211.6259	.symtab	0x805d924	24	OBJECT	<unknown>	DEFAULT	4
C.215.6292	.symtab	0x805db44	24	OBJECT	<unknown>	DEFAULT	4
C.229.6439	.symtab	0x805dda0	1128	OBJECT	<unknown>	DEFAULT	4
C.271.6739	.symtab	0x805e320	96	OBJECT	<unknown>	DEFAULT	4
C.276.6789	.symtab	0x805e4c0	36	OBJECT	<unknown>	DEFAULT	4
DNSw	.symtab	0x804d6ab	514	FUNC	<unknown>	DEFAULT	2
HIPER_OVH	.symtab	0x804c326	372	FUNC	<unknown>	DEFAULT	2
Q	.symtab	0x8060420	16384	OBJECT	<unknown>	DEFAULT	11
Randhex	.symtab	0x804cb62	381	FUNC	<unknown>	DEFAULT	2
SendCloudflare	.symtab	0x804b641	312	FUNC	<unknown>	DEFAULT	2
SendDOMINATE	.symtab	0x804cde9	1010	FUNC	<unknown>	DEFAULT	2
SendHOME1	.symtab	0x804c49a	279	FUNC	<unknown>	DEFAULT	2
SendHOME2	.symtab	0x804c5b1	279	FUNC	<unknown>	DEFAULT	2
SendHTTPCloudflare	.symtab	0x804b779	312	FUNC	<unknown>	DEFAULT	2
SendHTTPHex	.symtab	0x804b383	351	FUNC	<unknown>	DEFAULT	2
SendOVH_STORM	.symtab	0x804bcd3	1619	FUNC	<unknown>	DEFAULT	2
SendSTD	.symtab	0x804a29a	257	FUNC	<unknown>	DEFAULT	2
SendSTDHEX	.symtab	0x8049b51	279	FUNC	<unknown>	DEFAULT	2
SendSTD_HEX	.symtab	0x804a4a5	279	FUNC	<unknown>	DEFAULT	2
SendUDP	.symtab	0x80492d7	815	FUNC	<unknown>	DEFAULT	2
UDPRAW	.symtab	0x804c94e	266	FUNC	<unknown>	DEFAULT	2
_GLOBAL_OFFSET_TABLE_	.symtab	0x8060014	0	OBJECT	<unknown>	HIDDEN	9
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x8060004	0	OBJECT	<unknown>	DEFAULT	6
__CTOR_LIST__	.symtab	0x8060000	0	OBJECT	<unknown>	DEFAULT	6
__C_ctype_b	.symtab	0x8060158	4	OBJECT	<unknown>	DEFAULT	10
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x805e680	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x80603d8	4	OBJECT	<unknown>	DEFAULT	10
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x805fcc0	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x8060160	4	OBJECT	<unknown>	DEFAULT	10
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x805e980	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x806000c	0	OBJECT	<unknown>	DEFAULT	7
__DTOR_LIST__	.symtab	0x8060008	0	OBJECT	<unknown>	DEFAULT	7
__EH_FRAME_BEGIN__	.symtab	0x805ffc0	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x805ffc0	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x8060158	4	OBJECT	<unknown>	HIDDEN	10
__GI___C_ctype_b_data	.symtab	0x805e680	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_tolower	.symtab	0x80603d8	4	OBJECT	<unknown>	HIDDEN	10
__GI___C_ctype_tolower_data	.symtab	0x805fcc0	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_toupper	.symtab	0x8060160	4	OBJECT	<unknown>	HIDDEN	10
__GI___C_ctype_toupper_data	.symtab	0x805e980	768	OBJECT	<unknown>	HIDDEN	4
__GI___ctype_b	.symtab	0x806015c	4	OBJECT	<unknown>	HIDDEN	10
__GI___ctype_tolower	.symtab	0x80603dc	4	OBJECT	<unknown>	HIDDEN	10
__GI___ctype_toupper	.symtab	0x8060164	4	OBJECT	<unknown>	HIDDEN	10
__GI___errno_location	.symtab	0x8051c6c	6	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x8057dd8	220	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x8052cb0	29	FUNC	<unknown>	HIDDEN	2
__GI___h_errno_location	.symtab	0x8055204	6	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x805183c	87	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl64	.symtab	0x8051894	63	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x8051ab0	75	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x8054b9c	63	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x8054c13	64	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x8052cd0	183	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x80518d4	40	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x80540b0	273	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x805467c	20	FUNC	<unknown>	HIDDEN	2
__GI_atol	.symtab	0x805467c	20	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x8056888	54	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0x8051930	46	FUNC	<unknown>	HIDDEN	2
__GI_clock_getres	.symtab	0x8054f98	50	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x8051960	46	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x8053264	43	FUNC	<unknown>	HIDDEN	2
__GI_errno	.symtab	0x8066660	4	OBJECT	<unknown>	HIDDEN	11
__GI_execl	.symtab	0x805482c	105	FUNC	<unknown>	HIDDEN	2
__GI_execve	.symtab	0x8054fcc	54	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x80547c4	103	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x8056910	265	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x805183c	87	FUNC	<unknown>	HIDDEN	2
__GI_fcntl64	.symtab	0x8051894	63	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x8056f88	321	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x8057dd8	220	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x8056e40	98	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x80570cc	105	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x8056a1c	24	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x8051990	38	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x8052a94	51	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x8056a34	27	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x8056a50	227	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x8052ac8	116	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x8057dd8	220	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x80519b8	37	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x8055004	38	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x805502c	38	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x8055054	38	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname	.symtab	0x8052f00	48	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x8052f30	818	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x805507c	19	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x80519e0	38	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x8051a08	50	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x8053290	43	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x8055090	38	FUNC	<unknown>	HIDDEN	2
__GI_h_errno	.symtab	0x8066664	4	OBJECT	<unknown>	HIDDEN	11
__GI_inet_addr	.symtab	0x8052ed8	37	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x8055e04	148	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa	.symtab	0x8052ec3	21	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa_r	.symtab	0x8052e74	79	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x80575b0	462	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x80572de	458	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x805449a	171	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x8051a3c	63	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x8052dbc	29	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x8051a7c	50	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x8057d58	95	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x8055c38	35	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x8052b3c	39	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x8055c5c	39	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x8055cac	33	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x8055cd0	176	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x8052b64	21	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x8054f0c	27	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x80550b8	50	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x80550ec	50	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x8051ab0	75	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x80568d8	54	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x805685c	24	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x80541cc	72	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x80543a5	95	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x8057188	99	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x8051b14	54	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x80532f8	51	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x8055120	78	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x8051b4c	63	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x805332c	51	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x8053360	67	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x8051b8c	38	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x80533a4	59	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x805430c	153	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x8054e1b	217	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x805340c	175	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x8055170	85	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x8054898	393	FUNC	<unknown>	HIDDEN	2
__GI_snprintf	.symtab	0x8051c74	33	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x80533e0	43	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x8051c98	31	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x8054404	150	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x8057eb4	54	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x8052b7c	30	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x8057138	29	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x8057138	29	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x8052b9c	27	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x8057220	54	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x8052bb8	19	FUNC	<unknown>	HIDDEN	2
__GI_strncat	.symtab	0x8057158	46	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x8055c84	38	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x8052bcc	25	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x8055ddc	39	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x80571ec	50	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x8052be8	198	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x8052da0	25	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x8055d80	89	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x8054690	26	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x8054a24	325	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x8052ddc	112	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x8051bb4	46	FUNC	<unknown>	HIDDEN	2
__GI_tolower	.symtab	0x8057db8	29	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x8051c4c	29	FUNC	<unknown>	HIDDEN	2
__GI_vfork	.symtab	0x8054ef4	21	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x8051cb8	178	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x80551c8	59	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x8051be4	26	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x805520c	68	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x8055270	134	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x8055250	30	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x8051c00	54	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x8060010	0	OBJECT	<unknown>	DEFAULT	8
__JCR_LIST__	.symtab	0x8060010	0	OBJECT	<unknown>	DEFAULT	8
__app_fini	.symtab	0x8066654	4	OBJECT	<unknown>	HIDDEN	11
__atexit_lock	.symtab	0x80603a0	24	OBJECT	<unknown>	DEFAULT	10
__bsd_signal	.symtab	0x805340c	175	FUNC	<unknown>	HIDDEN	2
__bss_start	.symtab	0x80603e0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x8054bdf	52	FUNC	<unknown>	DEFAULT	2
__ctype_b	.symtab	0x806015c	4	OBJECT	<unknown>	DEFAULT	10
__ctype_tolower	.symtab	0x80603dc	4	OBJECT	<unknown>	DEFAULT	10
__ctype_toupper	.symtab	0x8060164	4	OBJECT	<unknown>	DEFAULT	10
__curbrk	.symtab	0x8066684	4	OBJECT	<unknown>	HIDDEN	11
__data_start	.symtab	0x8060028	0	NOTYPE	<unknown>	DEFAULT	10
__decode_answer	.symtab	0x8057954	249	FUNC	<unknown>	HIDDEN	2
__decode_dotted	.symtab	0x8057f7c	215	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x8057834	171	FUNC	<unknown>	HIDDEN	2
__deregister_frame_info_bases	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__dns_lookup	.symtab	0x8055e98	1876	FUNC	<unknown>	HIDDEN	2
__do_global_ctors_aux	.symtab	0x8058170	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x80480c0	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x8060020	0	OBJECT	<unknown>	HIDDEN	10
__encode_dotted	.symtab	0x8057eec	144	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x8057780	177	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x80578e0	83	FUNC	<unknown>	HIDDEN	2
__environ	.symtab	0x806664c	4	OBJECT	<unknown>	DEFAULT	11
__errno_location	.symtab	0x8051c6c	6	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x8066644	4	OBJECT	<unknown>	HIDDEN	11
__fgetc_unlocked	.symtab	0x8057dd8	220	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x8060000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fini_array_start	.symtab	0x8060000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__get_hosts_byname_r	.symtab	0x8056830	44	FUNC	<unknown>	HIDDEN	2
__get_pc_thunk_bx	.symtab	0x80480b0	0	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x805507c	19	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x8052cb0	29	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__h_errno_location	.symtab	0x8055204	6	FUNC	<unknown>	DEFAULT	2
__h_errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__init_array_end	.symtab	0x8060000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__init_array_start	.symtab	0x8060000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__length_dotted	.symtab	0x8058054	65	FUNC	<unknown>	HIDDEN	2
__length_question	.symtab	0x8057934	30	FUNC	<unknown>	HIDDEN	2
__libc_close	.symtab	0x8051960	46	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x8053264	43	FUNC	<unknown>	DEFAULT	2
__libc_creat	.symtab	0x8051afb	25	FUNC	<unknown>	DEFAULT	2
__libc_fcntl	.symtab	0x805183c	87	FUNC	<unknown>	DEFAULT	2
__libc_fcntl64	.symtab	0x8051894	63	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x8051990	38	FUNC	<unknown>	DEFAULT	2
__libc_getpid	.symtab	0x80519e0	38	FUNC	<unknown>	DEFAULT	2
__libc_lseek64	.symtab	0x8057d58	95	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0x80550ec	50	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x8051ab0	75	FUNC	<unknown>	DEFAULT	2
__libc_poll	.symtab	0x80568d8	54	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x8051b14	54	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x80532f8	51	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x8051b4c	63	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x805332c	51	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x8053360	67	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x8054e1b	217	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x8066648	4	OBJECT	<unknown>	DEFAULT	11
__libc_system	.symtab	0x8054548	305	FUNC	<unknown>	DEFAULT	2
__libc_waitpid	.symtab	0x8051be4	26	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x8051c00	54	FUNC	<unknown>	DEFAULT	2
__malloc_consolidate	.symtab	0x8053d49	424	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x8053520	38	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x80602b0	24	OBJECT	<unknown>	DEFAULT	10
__malloc_state	.symtab	0x8066720	888	OBJECT	<unknown>	DEFAULT	11
__malloc_trim	.symtab	0x8053cbc	141	FUNC	<unknown>	DEFAULT	2
__nameserver	.symtab	0x8066aa8	12	OBJECT	<unknown>	HIDDEN	11
__nameservers	.symtab	0x8066ab4	4	OBJECT	<unknown>	HIDDEN	11
__open_etc_hosts	.symtab	0x8057a50	49	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x80565ec	579	FUNC	<unknown>	HIDDEN	2
__pagesize	.symtab	0x8066650	4	OBJECT	<unknown>	DEFAULT	11
__preinit_array_end	.symtab	0x8060000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__preinit_array_start	.symtab	0x8060000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__pthread_initialize_minimal	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0x8054bdb	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x8054bdb	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x8054bdb	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x8054bdb	3	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x8054bdb	3	FUNC	<unknown>	DEFAULT	2
__pthread_return_void	.symtab	0x8054bde	1	FUNC	<unknown>	DEFAULT	2
__raise	.symtab	0x805685c	24	FUNC	<unknown>	HIDDEN	2
__read_etc_hosts_r	.symtab	0x8057a81	724	FUNC	<unknown>	HIDDEN	2
__register_frame_info_bases	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__resolv_lock	.symtab	0x80603c0	24	OBJECT	<unknown>	DEFAULT	10
__restore	.symtab	0x8054e13	0	NOTYPE	<unknown>	DEFAULT	2
__restore_rt	.symtab	0x8054e0c	0	NOTYPE	<unknown>	DEFAULT	2
__rtld_fini	.symtab	0x8066658	4	OBJECT	<unknown>	HIDDEN	11
__searchdomain	.symtab	0x8066a98	16	OBJECT	<unknown>	HIDDEN	11
__searchdomains	.symtab	0x8066ab8	4	OBJECT	<unknown>	HIDDEN	11
__sigaddset	.symtab	0x80534e0	32	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x8053500	32	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x80534bc	36	FUNC	<unknown>	DEFAULT	2
__socketcall	.symtab	0x8054f28	50	FUNC	<unknown>	HIDDEN	2
__socketcall.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__stdin	.symtab	0x8060174	4	OBJECT	<unknown>	DEFAULT	10
__stdio_READ	.symtab	0x8058098	68	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x80552f8	126	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x8056b34	168	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x8055378	240	FUNC	<unknown>	HIDDEN	2
__stdio_init_mutex	.symtab	0x8051dcd	23	FUNC	<unknown>	HIDDEN	2
__stdio_mutex_initializer.3991	.symtab	0x805ec80	24	OBJECT	<unknown>	DEFAULT	4
__stdio_rfill	.symtab	0x80580dc	40	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x8056e0c	51	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x8058104	101	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x8055468	158	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x8051e6c	43	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x8060178	4	OBJECT	<unknown>	DEFAULT	10
__syscall_error	.symtab	0x80568c0	21	FUNC	<unknown>	HIDDEN	2
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_rt_sigaction	.symtab	0x8054f5c	59	FUNC	<unknown>	HIDDEN	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uClibc_fini	.symtab	0x8054b9c	63	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x8054c13	64	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x8054c53	441	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x80603b8	4	OBJECT	<unknown>	HIDDEN	10
__vfork	.symtab	0x8054ef4	21	FUNC	<unknown>	HIDDEN	2
__xpg_strerror_r	.symtab	0x8052cd0	183	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_charpad	.symtab	0x8051e98	54	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_dl_aux_init	.symtab	0x8056874	18	FUNC	<unknown>	DEFAULT	2
_dl_phdr	.symtab	0x8066abc	4	OBJECT	<unknown>	DEFAULT	11
_dl_phnum	.symtab	0x8066ac0	4	OBJECT	<unknown>	DEFAULT	11
_edata	.symtab	0x80603e0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x8066ac4	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_errno	.symtab	0x8066660	4	OBJECT	<unknown>	DEFAULT	11
_exit	.symtab	0x80518d4	40	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x8058198	3	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x8064440	8192	OBJECT	<unknown>	DEFAULT	11
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x8051ece	106	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x8055674	1476	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_h_errno	.symtab	0x8066664	4	OBJECT	<unknown>	DEFAULT	11
_init	.symtab	0x8048094	3	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x8055508	86	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_init	.symtab	0x80524e0	111	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x80526cd	966	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x8052550	66	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x8052594	271	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x80526a4	41	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x8054bde	1	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x8054bde	1	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_sigintr	.symtab	0x80666a0	128	OBJECT	<unknown>	HIDDEN	11
_start	.symtab	0x8048164	34	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x8056bdc	559	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x8051d6c	97	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x806017c	4	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_add_lock	.symtab	0x8060180	24	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_dec_use	.symtab	0x8056ea4	228	FUNC	<unknown>	DEFAULT	2
_stdio_openlist_del_count	.symtab	0x8064424	4	OBJECT	<unknown>	DEFAULT	11
_stdio_openlist_del_lock	.symtab	0x8060198	24	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_use_count	.symtab	0x8064420	4	OBJECT	<unknown>	DEFAULT	11
_stdio_streams	.symtab	0x80601c0	240	OBJECT	<unknown>	DEFAULT	10
_stdio_term	.symtab	0x8051de4	136	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x80601b0	4	OBJECT	<unknown>	DEFAULT	10
_stdlib_strto_l	.symtab	0x80546ac	277	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x8055560	61	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x805ed60	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x80555a0	209	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x8051f38	1448	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x80540b0	273	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
access	.symtab	0x80518fc	50	FUNC	<unknown>	DEFAULT	2
access.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
astd	.symtab	0x804b27a	265	FUNC	<unknown>	DEFAULT	2
atcp	.symtab	0x804ad2f	1355	FUNC	<unknown>	DEFAULT	2
atoi	.symtab	0x805467c	20	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x805467c	20	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
audp	.symtab	0x804a916	1049	FUNC	<unknown>	DEFAULT	2
bcopy	.symtab	0x8052d88	21	FUNC	<unknown>	DEFAULT	2
bcopy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
been_there_done_that	.symtab	0x8066640	1	OBJECT	<unknown>	DEFAULT	11
been_there_done_that.2832	.symtab	0x806665c	1	OBJECT	<unknown>	DEFAULT	11
bot.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
brk	.symtab	0x8056888	54	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x805340c	175	FUNC	<unknown>	DEFAULT	2
buf.2658	.symtab	0x8066444	16	OBJECT	<unknown>	DEFAULT	11
buf.4993	.symtab	0x8066460	460	OBJECT	<unknown>	DEFAULT	11
c	.symtab	0x8060150	4	OBJECT	<unknown>	DEFAULT	10
chdir	.symtab	0x8051930	46	FUNC	<unknown>	DEFAULT	2
chdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
clock_getres	.symtab	0x8054f98	50	FUNC	<unknown>	DEFAULT	2
clock_getres.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x8051960	46	FUNC	<unknown>	DEFAULT	2
close.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
commServer	.symtab	0x8060040	4	OBJECT	<unknown>	DEFAULT	10
completed.2429	.symtab	0x80603e0	1	OBJECT	<unknown>	DEFAULT	11
connect	.symtab	0x8053264	43	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connectTimeout	.symtab	0x8048e22	456	FUNC	<unknown>	DEFAULT	2
creat	.symtab	0x8051afb	25	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
csum	.symtab	0x80490f6	168	FUNC	<unknown>	DEFAULT	2
currentServer	.symtab	0x806014c	4	OBJECT	<unknown>	DEFAULT	10
data_start	.symtab	0x8060028	0	NOTYPE	<unknown>	DEFAULT	10
decodea.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dnslookup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ	.symtab	0x806664c	4	OBJECT	<unknown>	DEFAULT	11
errno	.symtab	0x8066660	4	OBJECT	<unknown>	DEFAULT	11
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execl	.symtab	0x805482c	105	FUNC	<unknown>	DEFAULT	2
execl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execve	.symtab	0x8054fcc	54	FUNC	<unknown>	DEFAULT	2
execve.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x80547c4	103	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x805fb80	156	OBJECT	<unknown>	DEFAULT	4
fclose	.symtab	0x8056910	265	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x805183c	87	FUNC	<unknown>	DEFAULT	2
fcntl64	.symtab	0x8051894	63	FUNC	<unknown>	DEFAULT	2
fdgets	.symtab	0x804839d	104	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x8056f88	321	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x8057dd8	220	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x8056e40	98	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x80570cc	105	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fmt	.symtab	0x805fb68	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x8056a1c	24	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0x8051990	38	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs_unlocked	.symtab	0x8052a94	51	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x8048110	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x8053ef1	412	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x8056a34	27	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x8056a34	27	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x8056a50	227	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ftcp	.symtab	0x8049606	1355	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked	.symtab	0x8052ac8	116	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getArch	.symtab	0x804dc71	10	FUNC	<unknown>	DEFAULT	2
getHost	.symtab	0x8048bf4	59	FUNC	<unknown>	DEFAULT	2
getOurIP	.symtab	0x8048405	521	FUNC	<unknown>	DEFAULT	2
getPortz	.symtab	0x804dc7b	146	FUNC	<unknown>	DEFAULT	2
getRandomIP	.symtab	0x804836d	48	FUNC	<unknown>	DEFAULT	2
get_hosts_byname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getc_unlocked	.symtab	0x8057dd8	220	FUNC	<unknown>	DEFAULT	2
getdtablesize	.symtab	0x80519b8	37	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x8055004	38	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x805502c	38	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x8055054	38	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname	.symtab	0x8052f00	48	FUNC	<unknown>	DEFAULT	2
gethostbyname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r	.symtab	0x8052f30	818	FUNC	<unknown>	DEFAULT	2
gethostbyname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpagesize	.symtab	0x805507c	19	FUNC	<unknown>	DEFAULT	2
getpagesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x80519e0	38	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x8051a08	50	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockname	.symtab	0x8053290	43	FUNC	<unknown>	DEFAULT	2
getsockname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x80532bc	59	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x8055090	38	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gotIP	.symtab	0x8060404	4	OBJECT	<unknown>	DEFAULT	11
h.4992	.symtab	0x806662c	20	OBJECT	<unknown>	DEFAULT	11
h_errno	.symtab	0x8066664	4	OBJECT	<unknown>	DEFAULT	11
htonl	.symtab	0x8052e58	7	FUNC	<unknown>	DEFAULT	2
htons	.symtab	0x8052e4c	12	FUNC	<unknown>	DEFAULT	2
httpattack	.symtab	0x804b8b1	1058	FUNC	<unknown>	DEFAULT	2
i.4257	.symtab	0x8060154	4	OBJECT	<unknown>	DEFAULT	10
index	.symtab	0x8052b7c	30	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x8052ed8	37	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x8055e04	148	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa	.symtab	0x8052ec3	21	FUNC	<unknown>	DEFAULT	2
inet_ntoa.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa_r	.symtab	0x8052e74	79	FUNC	<unknown>	DEFAULT	2
inet_ntop	.symtab	0x80575b0	462	FUNC	<unknown>	DEFAULT	2
inet_ntop4	.symtab	0x80574a8	264	FUNC	<unknown>	DEFAULT	2
inet_pton	.symtab	0x80572de	458	FUNC	<unknown>	DEFAULT	2
inet_pton4	.symtab	0x8057258	134	FUNC	<unknown>	DEFAULT	2
initConnection	.symtab	0x8051122	309	FUNC	<unknown>	DEFAULT	2
init_rand	.symtab	0x804823e	111	FUNC	<unknown>	DEFAULT	2
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initstate	.symtab	0x8054271	87	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x805449a	171	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x8051a3c	63	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isatty	.symtab	0x8052dbc	29	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isspace	.symtab	0x8051c38	17	FUNC	<unknown>	DEFAULT	2
isspace.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0x8051a7c	50	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lengthd.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lengthq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/i386/crt1.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/i386/crti.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/i386/crtn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/i386/mmap.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/i386/vfork.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
listFork	.symtab	0x8048fea	268	FUNC	<unknown>	DEFAULT	2
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x8057d58	95	FUNC	<unknown>	DEFAULT	2
macAddress	.symtab	0x8060410	6	OBJECT	<unknown>	DEFAULT	11
main	.symtab	0x8051257	1509	FUNC	<unknown>	DEFAULT	2
mainCommSock	.symtab	0x8060400	4	OBJECT	<unknown>	DEFAULT	11
makeIPPacket	.symtab	0x8049259	126	FUNC	<unknown>	DEFAULT	2
makeRandomStr	.symtab	0x8048c2f	103	FUNC	<unknown>	DEFAULT	2
makevsepacket	.symtab	0x8049d49	141	FUNC	<unknown>	DEFAULT	2
malloc	.symtab	0x8053546	1908	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
malloc_trim	.symtab	0x805408d	34	FUNC	<unknown>	DEFAULT	2
memchr	.symtab	0x8055c38	35	FUNC	<unknown>	DEFAULT	2
memchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memcpy	.symtab	0x8052b3c	39	FUNC	<unknown>	DEFAULT	2
memcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memmove	.symtab	0x8055c5c	39	FUNC	<unknown>	DEFAULT	2
memmove.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mempcpy	.symtab	0x8055cac	33	FUNC	<unknown>	DEFAULT	2
mempcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memrchr	.symtab	0x8055cd0	176	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x8052b64	21	FUNC	<unknown>	DEFAULT	2
memset.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mmap	.symtab	0x8054f0c	27	FUNC	<unknown>	DEFAULT	2
munmap	.symtab	0x80550b8	50	FUNC	<unknown>	DEFAULT	2
munmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mylock	.symtab	0x80602c8	24	OBJECT	<unknown>	DEFAULT	10
mylock	.symtab	0x80602e0	24	OBJECT	<unknown>	DEFAULT	10
mylock	.symtab	0x8066668	24	OBJECT	<unknown>	DEFAULT	11
nanosleep	.symtab	0x80550ec	50	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
next_start.1109	.symtab	0x8066440	4	OBJECT	<unknown>	DEFAULT	11
ntohl	.symtab	0x8052e6b	7	FUNC	<unknown>	DEFAULT	2
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0x8052e5f	12	FUNC	<unknown>	DEFAULT	2
ntop.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
numpids	.symtab	0x8060408	8	OBJECT	<unknown>	DEFAULT	11
object.2482	.symtab	0x80603e4	24	OBJECT	<unknown>	DEFAULT	11
open	.symtab	0x8051ab0	75	FUNC	<unknown>	DEFAULT	2
open.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opennameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ourIP	.symtab	0x8066688	4	OBJECT	<unknown>	DEFAULT	11
p.2427	.symtab	0x8060024	0	OBJECT	<unknown>	DEFAULT	10
pids	.symtab	0x806668c	4	OBJECT	<unknown>	DEFAULT	11
poll	.symtab	0x80568d8	54	FUNC	<unknown>	DEFAULT	2
poll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prefix.4202	.symtab	0x805eca5	12	OBJECT	<unknown>	DEFAULT	4
print	.symtab	0x80488f3	584	FUNC	<unknown>	DEFAULT	2
printchar	.symtab	0x80486bd	58	FUNC	<unknown>	DEFAULT	2
printi	.symtab	0x80487ce	293	FUNC	<unknown>	DEFAULT	2
prints	.symtab	0x80486f7	215	FUNC	<unknown>	DEFAULT	2
processCmd	.symtab	0x804dd0d	13248	FUNC	<unknown>	DEFAULT	2
qual_chars.4208	.symtab	0x805ecb8	20	OBJECT	<unknown>	DEFAULT	4
raise	.symtab	0x805685c	24	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x80541c4	5	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand_cmwc	.symtab	0x80482ad	192	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x80541cc	72	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x805f8c0	40	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x80543a5	95	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randtbl	.symtab	0x8060320	128	OBJECT	<unknown>	DEFAULT	10
rawmemchr	.symtab	0x8057188	99	FUNC	<unknown>	DEFAULT	2
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read	.symtab	0x8051b14	54	FUNC	<unknown>	DEFAULT	2
read.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read_etc_hosts_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
realrand	.symtab	0x80510cd	85	FUNC	<unknown>	DEFAULT	2
recv	.symtab	0x80532f8	51	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recvLine	.symtab	0x8048c96	396	FUNC	<unknown>	DEFAULT	2
rtcp	.symtab	0x804a5bc	858	FUNC	<unknown>	DEFAULT	2
sbrk	.symtab	0x8055120	78	FUNC	<unknown>	DEFAULT	2
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
select	.symtab	0x8051b4c	63	FUNC	<unknown>	DEFAULT	2
select.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send	.symtab	0x805332c	51	FUNC	<unknown>	DEFAULT	2
send.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sendHLD	.symtab	0x804d8ad	964	FUNC	<unknown>	DEFAULT	2
sendHTTPtwo	.symtab	0x804b4e2	351	FUNC	<unknown>	DEFAULT	2
sendKILLALL	.symtab	0x804c6c8	646	FUNC	<unknown>	DEFAULT	2
sendPkt	.symtab	0x804d52d	382	FUNC	<unknown>	DEFAULT	2
sendTLS	.symtab	0x804d1db	850	FUNC	<unknown>	DEFAULT	2
senditbudAMP	.symtab	0x8048188	182	FUNC	<unknown>	DEFAULT	2
sendnfo	.symtab	0x804ca58	266	FUNC	<unknown>	DEFAULT	2
sendto	.symtab	0x8053360	67	FUNC	<unknown>	DEFAULT	2
sendto.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsid	.symtab	0x8051b8c	38	FUNC	<unknown>	DEFAULT	2
setsid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsockopt	.symtab	0x80533a4	59	FUNC	<unknown>	DEFAULT	2
setsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate	.symtab	0x8054214	93	FUNC	<unknown>	DEFAULT	2
setstate_r	.symtab	0x805430c	153	FUNC	<unknown>	DEFAULT	2
sigaction	.symtab	0x8054e1b	217	FUNC	<unknown>	DEFAULT	2
sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
signal	.symtab	0x805340c	175	FUNC	<unknown>	DEFAULT	2
signal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigprocmask	.symtab	0x8055170	85	FUNC	<unknown>	DEFAULT	2
sigprocmask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigsetops.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sleep	.symtab	0x8054898	393	FUNC	<unknown>	DEFAULT	2
sleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
snprintf	.symtab	0x8051c74	33	FUNC	<unknown>	DEFAULT	2
snprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket	.symtab	0x80533e0	43	FUNC	<unknown>	DEFAULT	2
socket.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket_connect	.symtab	0x8049c68	225	FUNC	<unknown>	DEFAULT	2
sockprintf	.symtab	0x8048b3b	185	FUNC	<unknown>	DEFAULT	2
spec_and_mask.4207	.symtab	0x805eccc	16	OBJECT	<unknown>	DEFAULT	4
spec_base.4201	.symtab	0x805ecb1	7	OBJECT	<unknown>	DEFAULT	4
spec_chars.4204	.symtab	0x805ecf5	21	OBJECT	<unknown>	DEFAULT	4
spec_flags.4203	.symtab	0x805ed0a	8	OBJECT	<unknown>	DEFAULT	4
spec_or_mask.4206	.symtab	0x805ecdc	16	OBJECT	<unknown>	DEFAULT	4
spec_ranges.4205	.symtab	0x805ecec	9	OBJECT	<unknown>	DEFAULT	4
sprintf	.symtab	0x8051c98	31	FUNC	<unknown>	DEFAULT	2
sprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
srand	.symtab	0x80542c8	67	FUNC	<unknown>	DEFAULT	2
srandom	.symtab	0x80542c8	67	FUNC	<unknown>	DEFAULT	2
srandom_r	.symtab	0x8054404	150	FUNC	<unknown>	DEFAULT	2
static_id	.symtab	0x80603bc	2	OBJECT	<unknown>	DEFAULT	10
static_ns	.symtab	0x8066680	4	OBJECT	<unknown>	DEFAULT	11
stderr	.symtab	0x8060170	4	OBJECT	<unknown>	DEFAULT	10
stdhexflood	.symtab	0x804a39b	266	FUNC	<unknown>	DEFAULT	2
stdin	.symtab	0x8060168	4	OBJECT	<unknown>	DEFAULT	10
stdout	.symtab	0x806016c	4	OBJECT	<unknown>	DEFAULT	10
strcasecmp	.symtab	0x8057eb4	54	FUNC	<unknown>	DEFAULT	2
strcasecmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchr	.symtab	0x8052b7c	30	FUNC	<unknown>	DEFAULT	2
strchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcmp	.symtab	0x8057138	29	FUNC	<unknown>	DEFAULT	2
strcmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcoll	.symtab	0x8057138	29	FUNC	<unknown>	DEFAULT	2
strcpy	.symtab	0x8052b9c	27	FUNC	<unknown>	DEFAULT	2
strcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strdup	.symtab	0x8057220	54	FUNC	<unknown>	DEFAULT	2
strdup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strerror_r	.symtab	0x8052cd0	183	FUNC	<unknown>	DEFAULT	2
strlen	.symtab	0x8052bb8	19	FUNC	<unknown>	DEFAULT	2
strlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncat	.symtab	0x8057158	46	FUNC	<unknown>	DEFAULT	2
strncat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncpy	.symtab	0x8055c84	38	FUNC	<unknown>	DEFAULT	2
strncpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strnlen	.symtab	0x8052bcc	25	FUNC	<unknown>	DEFAULT	2
strnlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strpbrk	.symtab	0x8055ddc	39	FUNC	<unknown>	DEFAULT	2
strpbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strspn	.symtab	0x80571ec	50	FUNC	<unknown>	DEFAULT	2
strspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strstr	.symtab	0x8052be8	198	FUNC	<unknown>	DEFAULT	2
strstr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok	.symtab	0x8052da0	25	FUNC	<unknown>	DEFAULT	2
strtok.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok_r	.symtab	0x8055d80	89	FUNC	<unknown>	DEFAULT	2
strtok_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtol	.symtab	0x8054690	26	FUNC	<unknown>	DEFAULT	2
strtol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sysconf	.symtab	0x8054a24	325	FUNC	<unknown>	DEFAULT	2
sysconf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
system	.symtab	0x8054548	305	FUNC	<unknown>	DEFAULT	2
system.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcgetattr	.symtab	0x8052ddc	112	FUNC	<unknown>	DEFAULT	2
tcgetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcpcsum	.symtab	0x804919e	187	FUNC	<unknown>	DEFAULT	2
time	.symtab	0x8051bb4	46	FUNC	<unknown>	DEFAULT	2
time.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tolower	.symtab	0x8057db8	29	FUNC	<unknown>	DEFAULT	2
tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
toupper	.symtab	0x8051c4c	29	FUNC	<unknown>	DEFAULT	2
toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
trim	.symtab	0x804860e	175	FUNC	<unknown>	DEFAULT	2
type_codes	.symtab	0x805ed12	24	OBJECT	<unknown>	DEFAULT	4
type_sizes	.symtab	0x805ed2a	12	OBJECT	<unknown>	DEFAULT	4
unknown.1161	.symtab	0x805ed36	14	OBJECT	<unknown>	DEFAULT	4
unsafe_state	.symtab	0x80602f8	28	OBJECT	<unknown>	DEFAULT	10
useragents	.symtab	0x8060060	236	OBJECT	<unknown>	DEFAULT	10
usleep	.symtab	0x8054b6c	48	FUNC	<unknown>	DEFAULT	2
usleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
vfork	.symtab	0x8054ef4	21	FUNC	<unknown>	DEFAULT	2
vseattack	.symtab	0x8049dd6	1220	FUNC	<unknown>	DEFAULT	2
vsnprintf	.symtab	0x8051cb8	178	FUNC	<unknown>	DEFAULT	2
vsnprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wait4	.symtab	0x80551c8	59	FUNC	<unknown>	DEFAULT	2
wait4.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
waitpid	.symtab	0x8051be4	26	FUNC	<unknown>	DEFAULT	2
waitpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcrtomb	.symtab	0x805520c	68	FUNC	<unknown>	DEFAULT	2
wcrtomb.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsnrtombs	.symtab	0x8055270	134	FUNC	<unknown>	DEFAULT	2
wcsnrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsrtombs	.symtab	0x8055250	30	FUNC	<unknown>	DEFAULT	2
wcsrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
write	.symtab	0x8051c00	54	FUNC	<unknown>	DEFAULT	2
write.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
xdigits.3116	.symtab	0x805fc74	17	OBJECT	<unknown>	DEFAULT	4
xtdcustom	.symtab	0x804ccdf	266	FUNC	<unknown>	DEFAULT	2

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-06T23:29:24.507861+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39262	57.129.51.86	4258	TCP
2024-10-06T23:29:26.148330+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39264	57.129.51.86	4258	TCP
2024-10-06T23:29:27.788776+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39266	57.129.51.86	4258	TCP
2024-10-06T23:29:29.430673+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39268	57.129.51.86	4258	TCP
2024-10-06T23:29:31.071933+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39270	57.129.51.86	4258	TCP
2024-10-06T23:29:32.717989+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39272	57.129.51.86	4258	TCP
2024-10-06T23:29:34.373303+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39274	57.129.51.86	4258	TCP
2024-10-06T23:29:36.043185+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39276	57.129.51.86	4258	TCP
2024-10-06T23:29:37.681407+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39278	57.129.51.86	4258	TCP
2024-10-06T23:29:39.344042+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39280	57.129.51.86	4258	TCP
2024-10-06T23:29:41.033744+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39282	57.129.51.86	4258	TCP
2024-10-06T23:29:42.722853+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39284	57.129.51.86	4258	TCP
2024-10-06T23:29:44.367656+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39286	57.129.51.86	4258	TCP
2024-10-06T23:29:46.059817+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39288	57.129.51.86	4258	TCP
2024-10-06T23:29:47.696946+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39290	57.129.51.86	4258	TCP
2024-10-06T23:29:49.338628+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39292	57.129.51.86	4258	TCP
2024-10-06T23:29:50.998419+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39294	57.129.51.86	4258	TCP
2024-10-06T23:29:52.633249+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39296	57.129.51.86	4258	TCP
2024-10-06T23:29:54.295807+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39298	57.129.51.86	4258	TCP
2024-10-06T23:29:55.946813+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39300	57.129.51.86	4258	TCP
2024-10-06T23:29:57.613077+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39302	57.129.51.86	4258	TCP
2024-10-06T23:29:59.274294+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39304	57.129.51.86	4258	TCP
2024-10-06T23:30:00.917095+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39306	57.129.51.86	4258	TCP
2024-10-06T23:30:02.778652+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39308	57.129.51.86	4258	TCP
2024-10-06T23:30:04.469008+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39310	57.129.51.86	4258	TCP
2024-10-06T23:30:06.137410+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39312	57.129.51.86	4258	TCP
2024-10-06T23:30:07.779115+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39314	57.129.51.86	4258	TCP
2024-10-06T23:30:09.623940+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39316	57.129.51.86	4258	TCP
2024-10-06T23:30:11.430180+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39318	57.129.51.86	4258	TCP
2024-10-06T23:30:13.093488+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39320	57.129.51.86	4258	TCP
2024-10-06T23:30:14.729781+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39322	57.129.51.86	4258	TCP
2024-10-06T23:30:16.397042+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39324	57.129.51.86	4258	TCP
2024-10-06T23:30:18.061993+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39326	57.129.51.86	4258	TCP
2024-10-06T23:30:19.735176+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39328	57.129.51.86	4258	TCP
2024-10-06T23:30:21.369855+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39330	57.129.51.86	4258	TCP
2024-10-06T23:30:23.026841+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39332	57.129.51.86	4258	TCP
2024-10-06T23:30:24.670358+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39334	57.129.51.86	4258	TCP
2024-10-06T23:30:26.327462+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39336	57.129.51.86	4258	TCP
2024-10-06T23:30:27.964313+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39338	57.129.51.86	4258	TCP
2024-10-06T23:30:29.602576+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39340	57.129.51.86	4258	TCP
2024-10-06T23:30:31.248946+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39342	57.129.51.86	4258	TCP
2024-10-06T23:30:32.908266+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39344	57.129.51.86	4258	TCP
2024-10-06T23:30:34.565055+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39346	57.129.51.86	4258	TCP
2024-10-06T23:30:36.218905+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39348	57.129.51.86	4258	TCP
2024-10-06T23:30:37.870571+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39350	57.129.51.86	4258	TCP
2024-10-06T23:30:39.527804+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39352	57.129.51.86	4258	TCP
2024-10-06T23:30:41.166474+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39354	57.129.51.86	4258	TCP
2024-10-06T23:30:42.813670+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39356	57.129.51.86	4258	TCP
2024-10-06T23:30:44.490325+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39358	57.129.51.86	4258	TCP
2024-10-06T23:30:46.156800+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39360	57.129.51.86	4258	TCP
2024-10-06T23:30:47.827828+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39362	57.129.51.86	4258	TCP
2024-10-06T23:30:49.478802+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39364	57.129.51.86	4258	TCP
2024-10-06T23:30:51.120947+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39366	57.129.51.86	4258	TCP
2024-10-06T23:30:52.795372+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39368	57.129.51.86	4258	TCP
2024-10-06T23:30:54.454357+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39370	57.129.51.86	4258	TCP
2024-10-06T23:30:56.125099+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39372	57.129.51.86	4258	TCP
2024-10-06T23:30:57.765592+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39374	57.129.51.86	4258	TCP
2024-10-06T23:30:59.399969+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39376	57.129.51.86	4258	TCP
2024-10-06T23:31:01.051016+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39378	57.129.51.86	4258	TCP
2024-10-06T23:31:02.683667+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39380	57.129.51.86	4258	TCP
2024-10-06T23:31:04.322986+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39382	57.129.51.86	4258	TCP
2024-10-06T23:31:05.983162+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39384	57.129.51.86	4258	TCP
2024-10-06T23:31:07.618901+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39386	57.129.51.86	4258	TCP
2024-10-06T23:31:09.263763+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39388	57.129.51.86	4258	TCP
2024-10-06T23:31:10.902842+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39390	57.129.51.86	4258	TCP
2024-10-06T23:31:12.543095+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39392	57.129.51.86	4258	TCP
2024-10-06T23:31:14.186315+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39394	57.129.51.86	4258	TCP
2024-10-06T23:31:15.839899+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39396	57.129.51.86	4258	TCP
2024-10-06T23:31:17.488958+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39398	57.129.51.86	4258	TCP
2024-10-06T23:31:19.140134+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39400	57.129.51.86	4258	TCP
2024-10-06T23:31:20.797528+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39402	57.129.51.86	4258	TCP
2024-10-06T23:31:22.434124+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39404	57.129.51.86	4258	TCP
2024-10-06T23:31:24.091012+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39406	57.129.51.86	4258	TCP
2024-10-06T23:31:25.783215+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39408	57.129.51.86	4258	TCP
2024-10-06T23:31:27.434445+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39410	57.129.51.86	4258	TCP
2024-10-06T23:31:29.075083+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39412	57.129.51.86	4258	TCP
2024-10-06T23:31:30.717874+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39414	57.129.51.86	4258	TCP
2024-10-06T23:31:32.391206+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39416	57.129.51.86	4258	TCP
2024-10-06T23:31:34.027807+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39418	57.129.51.86	4258	TCP
2024-10-06T23:31:35.688452+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39420	57.129.51.86	4258	TCP
2024-10-06T23:31:37.342675+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39422	57.129.51.86	4258	TCP
2024-10-06T23:31:38.997305+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39424	57.129.51.86	4258	TCP
2024-10-06T23:31:40.750339+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39426	57.129.51.86	4258	TCP
2024-10-06T23:31:42.389418+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39428	57.129.51.86	4258	TCP
2024-10-06T23:31:44.026152+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39430	57.129.51.86	4258	TCP
2024-10-06T23:31:45.673556+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39432	57.129.51.86	4258	TCP
2024-10-06T23:31:47.346504+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39434	57.129.51.86	4258	TCP
2024-10-06T23:31:48.999426+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39436	57.129.51.86	4258	TCP
2024-10-06T23:31:50.638531+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39438	57.129.51.86	4258	TCP
2024-10-06T23:31:52.295520+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39440	57.129.51.86	4258	TCP
2024-10-06T23:31:53.965222+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39442	57.129.51.86	4258	TCP
2024-10-06T23:31:55.943443+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39444	57.129.51.86	4258	TCP
2024-10-06T23:31:57.596044+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39446	57.129.51.86	4258	TCP
2024-10-06T23:31:59.241987+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39448	57.129.51.86	4258	TCP
2024-10-06T23:32:00.871292+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39450	57.129.51.86	4258	TCP
2024-10-06T23:32:02.548279+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39452	57.129.51.86	4258	TCP
2024-10-06T23:32:04.183507+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39454	57.129.51.86	4258	TCP
2024-10-06T23:32:05.827913+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39456	57.129.51.86	4258	TCP
2024-10-06T23:32:07.486238+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39458	57.129.51.86	4258	TCP
2024-10-06T23:32:09.124307+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39460	57.129.51.86	4258	TCP
2024-10-06T23:32:10.776267+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39462	57.129.51.86	4258	TCP
2024-10-06T23:32:12.416391+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39464	57.129.51.86	4258	TCP
2024-10-06T23:32:14.075467+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39466	57.129.51.86	4258	TCP
2024-10-06T23:32:15.715041+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39468	57.129.51.86	4258	TCP
2024-10-06T23:32:17.388180+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39470	57.129.51.86	4258	TCP
2024-10-06T23:32:19.028665+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39472	57.129.51.86	4258	TCP
2024-10-06T23:32:20.671763+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39474	57.129.51.86	4258	TCP
2024-10-06T23:32:22.326941+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39476	57.129.51.86	4258	TCP
2024-10-06T23:32:23.980879+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39478	57.129.51.86	4258	TCP
2024-10-06T23:32:25.627271+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39480	57.129.51.86	4258	TCP
2024-10-06T23:32:27.261793+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39482	57.129.51.86	4258	TCP
2024-10-06T23:32:28.948389+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39484	57.129.51.86	4258	TCP
2024-10-06T23:32:30.611375+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39486	57.129.51.86	4258	TCP
2024-10-06T23:32:32.246737+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39488	57.129.51.86	4258	TCP
2024-10-06T23:32:33.886256+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39490	57.129.51.86	4258	TCP
2024-10-06T23:32:35.527056+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39492	57.129.51.86	4258	TCP
2024-10-06T23:32:37.231324+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39494	57.129.51.86	4258	TCP
2024-10-06T23:32:38.875811+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39496	57.129.51.86	4258	TCP
2024-10-06T23:32:40.551473+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39498	57.129.51.86	4258	TCP
2024-10-06T23:32:42.205015+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39500	57.129.51.86	4258	TCP
2024-10-06T23:32:43.923698+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39502	57.129.51.86	4258	TCP
2024-10-06T23:32:45.583360+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39504	57.129.51.86	4258	TCP
2024-10-06T23:32:47.245313+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39506	57.129.51.86	4258	TCP
2024-10-06T23:32:48.889207+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39508	57.129.51.86	4258	TCP
2024-10-06T23:32:50.582157+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39510	57.129.51.86	4258	TCP
2024-10-06T23:32:52.216831+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39512	57.129.51.86	4258	TCP
2024-10-06T23:32:53.874893+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39514	57.129.51.86	4258	TCP
2024-10-06T23:32:55.528836+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39516	57.129.51.86	4258	TCP
2024-10-06T23:32:57.226324+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39518	57.129.51.86	4258	TCP
2024-10-06T23:32:58.878074+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	39520	57.129.51.86	4258	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 6, 2024 23:29:24.360832930 CEST	39262	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:24.507678032 CEST	4258	39262	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:24.507860899 CEST	39262	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:24.507860899 CEST	39262	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:24.513042927 CEST	4258	39262	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:26.142522097 CEST	4258	39262	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:26.142872095 CEST	39262	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:26.142875910 CEST	39264	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:26.148161888 CEST	4258	39262	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:26.148209095 CEST	4258	39264	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:26.148284912 CEST	39264	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:26.148329973 CEST	39264	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:26.153537035 CEST	4258	39264	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:27.782687902 CEST	4258	39264	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:27.783117056 CEST	39266	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:27.783170938 CEST	39264	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:27.788611889 CEST	4258	39266	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:27.788659096 CEST	4258	39264	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:27.788733959 CEST	39266	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:27.788775921 CEST	39266	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:27.794112921 CEST	4258	39266	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:29.424962044 CEST	4258	39266	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:29.425216913 CEST	39266	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:29.425260067 CEST	39268	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:29.430449009 CEST	4258	39266	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:29.430495977 CEST	4258	39268	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:29.430605888 CEST	39268	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:29.430672884 CEST	39268	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:29.435601950 CEST	4258	39268	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:31.065979958 CEST	4258	39268	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:31.066533089 CEST	39268	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:31.066729069 CEST	39270	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:31.071660042 CEST	4258	39268	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:31.071698904 CEST	4258	39270	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:31.071933031 CEST	39270	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:31.071933031 CEST	39270	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:31.076919079 CEST	4258	39270	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:32.711924076 CEST	4258	39270	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:32.712179899 CEST	39270	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:32.712179899 CEST	39270	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:32.712409973 CEST	39272	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:32.717672110 CEST	4258	39270	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:32.717772007 CEST	4258	39272	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:32.717892885 CEST	39272	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:32.717988968 CEST	39272	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:32.723411083 CEST	4258	39272	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:34.367341042 CEST	4258	39272	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:34.367741108 CEST	39274	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:34.367808104 CEST	39272	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:34.373096943 CEST	4258	39274	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:34.373143911 CEST	4258	39272	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:34.373225927 CEST	39274	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:34.373302937 CEST	39274	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:34.378515005 CEST	4258	39274	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:36.037396908 CEST	4258	39274	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:36.037672997 CEST	39274	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:36.037866116 CEST	39276	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:36.042977095 CEST	4258	39274	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:36.042999983 CEST	4258	39276	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:36.043100119 CEST	39276	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:36.043184996 CEST	39276	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:36.048264980 CEST	4258	39276	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:37.675205946 CEST	4258	39276	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:37.675787926 CEST	39276	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:37.675822973 CEST	39278	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:37.681082964 CEST	4258	39276	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:37.681130886 CEST	4258	39278	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:37.681349993 CEST	39278	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:37.681406975 CEST	39278	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:37.686803102 CEST	4258	39278	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:39.338063002 CEST	4258	39278	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:39.338408947 CEST	39278	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:39.338455915 CEST	39280	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:39.343816042 CEST	4258	39278	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:39.343837976 CEST	4258	39280	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:39.344042063 CEST	39280	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:39.344042063 CEST	39280	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:39.349400043 CEST	4258	39280	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:41.025600910 CEST	4258	39280	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:41.026360989 CEST	39280	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:41.026709080 CEST	39282	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:41.033031940 CEST	4258	39280	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:41.033067942 CEST	4258	39282	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:41.033571005 CEST	39282	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:41.033744097 CEST	39282	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:41.039335012 CEST	4258	39282	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:42.716490984 CEST	4258	39282	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:42.717297077 CEST	39282	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:42.717452049 CEST	39284	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:42.722228050 CEST	4258	39282	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:42.722379923 CEST	4258	39284	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:42.722852945 CEST	39284	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:42.722852945 CEST	39284	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:42.727936983 CEST	4258	39284	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:44.361136913 CEST	4258	39284	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:44.361852884 CEST	39286	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:44.361886024 CEST	39284	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:44.367171049 CEST	4258	39284	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:44.367187023 CEST	4258	39286	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:44.367547035 CEST	39286	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:44.367655993 CEST	39286	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:44.372904062 CEST	4258	39286	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:46.053581953 CEST	4258	39286	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:46.054164886 CEST	39286	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:46.054224968 CEST	39288	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:46.059617996 CEST	4258	39286	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:46.059667110 CEST	4258	39288	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:46.059739113 CEST	39288	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:46.059817076 CEST	39288	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:46.064848900 CEST	4258	39288	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:47.690803051 CEST	4258	39288	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:47.691065073 CEST	39288	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:47.691113949 CEST	39290	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:47.696737051 CEST	4258	39288	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:47.696783066 CEST	4258	39290	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:47.696903944 CEST	39290	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:47.696945906 CEST	39290	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:47.702474117 CEST	4258	39290	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:49.332209110 CEST	4258	39290	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:49.332885027 CEST	39292	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:49.332962990 CEST	39290	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:49.338202953 CEST	4258	39292	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:49.338342905 CEST	4258	39290	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:49.338536024 CEST	39292	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:49.338628054 CEST	39292	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:49.343878031 CEST	4258	39292	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:50.991796017 CEST	4258	39292	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:50.992208004 CEST	39292	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:50.992403030 CEST	39294	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:50.997814894 CEST	4258	39292	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:50.997862101 CEST	4258	39294	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:50.998291969 CEST	39294	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:50.998419046 CEST	39294	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:51.003755093 CEST	4258	39294	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:52.627335072 CEST	4258	39294	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:52.627587080 CEST	39294	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:52.627625942 CEST	39296	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:52.633084059 CEST	4258	39294	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:52.633136034 CEST	4258	39296	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:52.633203983 CEST	39296	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:52.633249044 CEST	39296	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:52.638710022 CEST	4258	39296	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:54.289362907 CEST	4258	39296	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:54.289694071 CEST	39296	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:54.289865971 CEST	39298	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:54.295227051 CEST	4258	39296	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:54.295274019 CEST	4258	39298	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:54.295661926 CEST	39298	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:54.295806885 CEST	39298	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:54.300962925 CEST	4258	39298	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:55.941355944 CEST	4258	39298	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:55.941617012 CEST	39298	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:55.941700935 CEST	39300	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:55.946582079 CEST	4258	39298	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:55.946615934 CEST	4258	39300	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:55.946746111 CEST	39300	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:55.946813107 CEST	39300	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:55.951617002 CEST	4258	39300	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:57.607732058 CEST	4258	39300	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:57.607942104 CEST	39300	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:57.608023882 CEST	39302	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:57.612829924 CEST	4258	39300	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:57.612884045 CEST	4258	39302	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:57.612981081 CEST	39302	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:57.613076925 CEST	39302	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:57.618510962 CEST	4258	39302	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:59.268196106 CEST	4258	39302	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:59.268517017 CEST	39302	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:59.268721104 CEST	39304	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:59.273962975 CEST	4258	39302	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:59.274008989 CEST	4258	39304	57.129.51.86	192.168.2.13
Oct 6, 2024 23:29:59.274292946 CEST	39304	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:59.274293900 CEST	39304	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:29:59.279519081 CEST	4258	39304	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:00.910670996 CEST	4258	39304	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:00.911346912 CEST	39306	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:00.911429882 CEST	39304	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:00.916757107 CEST	4258	39306	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:00.916800976 CEST	4258	39304	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:00.917011023 CEST	39306	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:00.917094946 CEST	39306	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:00.922502041 CEST	4258	39306	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:02.571068048 CEST	4258	39306	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:02.571433067 CEST	39306	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:02.571521997 CEST	39308	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:02.778125048 CEST	4258	39306	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:02.778173923 CEST	4258	39308	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:02.778650999 CEST	39308	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:02.778651953 CEST	39308	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:02.784343004 CEST	4258	39308	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:04.463222980 CEST	4258	39308	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:04.463701010 CEST	39308	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:04.463797092 CEST	39310	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:04.468816996 CEST	4258	39308	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:04.468851089 CEST	4258	39310	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:04.468944073 CEST	39310	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:04.469007969 CEST	39310	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:04.473893881 CEST	4258	39310	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:06.131592989 CEST	4258	39310	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:06.131864071 CEST	39310	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:06.131922960 CEST	39312	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:06.137053013 CEST	4258	39310	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:06.137085915 CEST	4258	39312	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:06.137262106 CEST	39312	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:06.137409925 CEST	39312	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:06.142190933 CEST	4258	39312	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:07.773811102 CEST	4258	39312	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:07.773952961 CEST	39312	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:07.774043083 CEST	39314	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:07.778899908 CEST	4258	39312	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:07.778934956 CEST	4258	39314	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:07.779093027 CEST	39314	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:07.779114962 CEST	39314	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:07.783960104 CEST	4258	39314	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:09.618619919 CEST	4258	39314	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:09.618876934 CEST	39314	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:09.618913889 CEST	39316	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:09.623800039 CEST	4258	39314	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:09.623816967 CEST	4258	39316	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:09.623886108 CEST	39316	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:09.623939991 CEST	39316	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:09.628782034 CEST	4258	39316	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:11.424813032 CEST	4258	39316	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:11.425062895 CEST	39316	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:11.425084114 CEST	39318	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:11.429950953 CEST	4258	39316	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:11.429964066 CEST	4258	39318	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:11.430179119 CEST	39318	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:11.430180073 CEST	39318	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:11.435024977 CEST	4258	39318	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:13.088073015 CEST	4258	39318	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:13.088344097 CEST	39318	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:13.088495016 CEST	39320	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:13.093231916 CEST	4258	39318	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:13.093348980 CEST	4258	39320	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:13.093446016 CEST	39320	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:13.093487978 CEST	39320	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:13.098370075 CEST	4258	39320	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:14.723340988 CEST	4258	39320	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:14.723879099 CEST	39322	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:14.723892927 CEST	39320	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:14.729259968 CEST	4258	39320	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:14.729294062 CEST	4258	39322	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:14.729695082 CEST	39322	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:14.729780912 CEST	39322	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:14.735040903 CEST	4258	39322	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:16.391365051 CEST	4258	39322	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:16.391695976 CEST	39322	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:16.391706944 CEST	39324	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:16.396821976 CEST	4258	39322	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:16.396857977 CEST	4258	39324	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:16.397000074 CEST	39324	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:16.397042036 CEST	39324	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:16.401999950 CEST	4258	39324	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:18.055628061 CEST	4258	39324	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:18.056137085 CEST	39324	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:18.056210995 CEST	39326	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:18.061054945 CEST	4258	39324	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:18.061678886 CEST	4258	39326	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:18.061991930 CEST	39326	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:18.061992884 CEST	39326	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:18.067276955 CEST	4258	39326	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:19.729141951 CEST	4258	39326	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:19.729429007 CEST	39328	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:19.729564905 CEST	39326	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:19.734950066 CEST	4258	39328	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:19.734994888 CEST	4258	39326	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:19.735136032 CEST	39328	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:19.735176086 CEST	39328	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:19.740550041 CEST	4258	39328	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:21.363940954 CEST	4258	39328	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:21.364393950 CEST	39328	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:21.364521980 CEST	39330	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:21.369400978 CEST	4258	39328	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:21.369657040 CEST	4258	39330	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:21.369802952 CEST	39330	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:21.369854927 CEST	39330	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:21.375030994 CEST	4258	39330	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:23.020298004 CEST	4258	39330	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:23.020812988 CEST	39332	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:23.020831108 CEST	39330	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:23.026449919 CEST	4258	39332	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:23.026498079 CEST	4258	39330	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:23.026750088 CEST	39332	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:23.026840925 CEST	39332	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:23.032279015 CEST	4258	39332	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:24.663460970 CEST	4258	39332	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:24.664258003 CEST	39332	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:24.664319038 CEST	39334	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:24.669969082 CEST	4258	39332	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:24.670015097 CEST	4258	39334	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:24.670192957 CEST	39334	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:24.670357943 CEST	39334	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:24.675457954 CEST	4258	39334	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:26.321154118 CEST	4258	39334	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:26.321547985 CEST	39336	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:26.321583986 CEST	39334	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:26.327047110 CEST	4258	39336	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:26.327090979 CEST	4258	39334	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:26.327326059 CEST	39336	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:26.327461958 CEST	39336	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:26.332734108 CEST	4258	39336	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:27.957987070 CEST	4258	39336	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:27.958692074 CEST	39338	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:27.958693027 CEST	39336	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:27.963975906 CEST	4258	39336	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:27.964024067 CEST	4258	39338	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:27.964221954 CEST	39338	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:27.964313030 CEST	39338	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:27.969654083 CEST	4258	39338	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:29.596204996 CEST	4258	39338	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:29.596484900 CEST	39338	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:29.596683979 CEST	39340	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:29.602071047 CEST	4258	39338	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:29.602118969 CEST	4258	39340	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:29.602457047 CEST	39340	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:29.602576017 CEST	39340	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:29.608769894 CEST	4258	39340	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:31.242134094 CEST	4258	39340	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:31.243012905 CEST	39342	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:31.243088961 CEST	39340	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:31.248574972 CEST	4258	39342	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:31.248621941 CEST	4258	39340	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:31.248944998 CEST	39342	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:31.248945951 CEST	39342	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:31.254549980 CEST	4258	39342	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:32.901459932 CEST	4258	39342	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:32.902134895 CEST	39342	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:32.902246952 CEST	39344	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:32.907804012 CEST	4258	39342	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:32.907857895 CEST	4258	39344	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:32.908265114 CEST	39344	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:32.908266068 CEST	39344	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:32.914397001 CEST	4258	39344	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:34.557794094 CEST	4258	39344	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:34.558428049 CEST	39344	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:34.558439970 CEST	39346	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:34.564367056 CEST	4258	39344	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:34.564421892 CEST	4258	39346	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:34.565054893 CEST	39346	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:34.565054893 CEST	39346	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:34.570591927 CEST	4258	39346	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:36.211815119 CEST	4258	39346	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:36.212574005 CEST	39346	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:36.212615013 CEST	39348	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:36.218238115 CEST	4258	39346	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:36.218283892 CEST	4258	39348	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:36.218904972 CEST	39348	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:36.218904972 CEST	39348	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:36.224441051 CEST	4258	39348	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:37.863749981 CEST	4258	39348	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:37.864301920 CEST	39348	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:37.864301920 CEST	39348	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:37.864351988 CEST	39350	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:37.870136023 CEST	4258	39348	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:37.870188951 CEST	4258	39350	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:37.870487928 CEST	39350	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:37.870570898 CEST	39350	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:37.876053095 CEST	4258	39350	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:39.521086931 CEST	4258	39350	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:39.521759033 CEST	39350	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:39.521836042 CEST	39352	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:39.527190924 CEST	4258	39350	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:39.527242899 CEST	4258	39352	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:39.527481079 CEST	39352	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:39.527803898 CEST	39352	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:39.532872915 CEST	4258	39352	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:41.159533978 CEST	4258	39352	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:41.160303116 CEST	39352	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:41.160424948 CEST	39354	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:41.165946007 CEST	4258	39352	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:41.165996075 CEST	4258	39354	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:41.166472912 CEST	39354	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:41.166474104 CEST	39354	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:41.171919107 CEST	4258	39354	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:42.805756092 CEST	4258	39354	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:42.806499004 CEST	39354	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:42.806534052 CEST	39356	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:42.812819004 CEST	4258	39354	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:42.812872887 CEST	4258	39356	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:42.813484907 CEST	39356	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:42.813669920 CEST	39356	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:42.819025040 CEST	4258	39356	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:44.483578920 CEST	4258	39356	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:44.484160900 CEST	39356	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:44.484246969 CEST	39358	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:44.489743948 CEST	4258	39356	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:44.489845991 CEST	4258	39358	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:44.490324020 CEST	39358	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:44.490324974 CEST	39358	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:44.495479107 CEST	4258	39358	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:46.150105953 CEST	4258	39358	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:46.150810003 CEST	39360	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:46.150837898 CEST	39358	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:46.156241894 CEST	4258	39360	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:46.156415939 CEST	4258	39358	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:46.156697035 CEST	39360	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:46.156800032 CEST	39360	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:46.162421942 CEST	4258	39360	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:47.820208073 CEST	4258	39360	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:47.820574999 CEST	39360	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:47.820763111 CEST	39362	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:47.827142954 CEST	4258	39360	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:47.827192068 CEST	4258	39362	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:47.827466965 CEST	39362	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:47.827827930 CEST	39362	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:47.833142042 CEST	4258	39362	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:49.472280025 CEST	4258	39362	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:49.472944975 CEST	39364	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:49.472992897 CEST	39362	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:49.478396893 CEST	4258	39364	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:49.478441000 CEST	4258	39362	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:49.478666067 CEST	39364	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:49.478801966 CEST	39364	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:49.484167099 CEST	4258	39364	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:51.114509106 CEST	4258	39364	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:51.114883900 CEST	39364	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:51.115040064 CEST	39366	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:51.120407104 CEST	4258	39364	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:51.120455027 CEST	4258	39366	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:51.120843887 CEST	39366	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:51.120946884 CEST	39366	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:51.126105070 CEST	4258	39366	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:52.789155006 CEST	4258	39366	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:52.789779902 CEST	39366	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:52.789861917 CEST	39368	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:52.794861078 CEST	4258	39366	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:52.794878006 CEST	4258	39368	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:52.795289993 CEST	39368	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:52.795372009 CEST	39368	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:52.800307035 CEST	4258	39368	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:54.447541952 CEST	4258	39368	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:54.448215008 CEST	39370	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:54.448323965 CEST	39368	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:54.453970909 CEST	4258	39370	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:54.454014063 CEST	4258	39368	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:54.454257011 CEST	39370	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:54.454356909 CEST	39370	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:54.459561110 CEST	4258	39370	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:56.118740082 CEST	4258	39370	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:56.119116068 CEST	39370	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:56.119179964 CEST	39372	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:56.124695063 CEST	4258	39370	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:56.124744892 CEST	4258	39372	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:56.124954939 CEST	39372	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:56.125098944 CEST	39372	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:56.130292892 CEST	4258	39372	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:57.759100914 CEST	4258	39372	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:57.759722948 CEST	39372	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:57.759733915 CEST	39374	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:57.765180111 CEST	4258	39374	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:57.765227079 CEST	4258	39372	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:57.765458107 CEST	39374	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:57.765592098 CEST	39374	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:57.771022081 CEST	4258	39374	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:59.394033909 CEST	4258	39374	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:59.394366026 CEST	39374	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:59.394439936 CEST	39376	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:59.399564028 CEST	4258	39374	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:59.399585009 CEST	4258	39376	57.129.51.86	192.168.2.13
Oct 6, 2024 23:30:59.399969101 CEST	39376	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:59.399969101 CEST	39376	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:30:59.405144930 CEST	4258	39376	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:01.044985056 CEST	4258	39376	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:01.045538902 CEST	39376	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:01.045633078 CEST	39378	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:01.050714970 CEST	4258	39376	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:01.050735950 CEST	4258	39378	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:01.050975084 CEST	39378	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:01.051016092 CEST	39378	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:01.056024075 CEST	4258	39378	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:02.677100897 CEST	4258	39378	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:02.677825928 CEST	39378	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:02.677951097 CEST	39380	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:02.682761908 CEST	4258	39378	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:02.683141947 CEST	4258	39380	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:02.683666945 CEST	39380	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:02.683666945 CEST	39380	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:02.688710928 CEST	4258	39380	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:04.316334963 CEST	4258	39380	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:04.316844940 CEST	39380	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:04.316873074 CEST	39382	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:04.322293997 CEST	4258	39380	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:04.322315931 CEST	4258	39382	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:04.322881937 CEST	39382	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:04.322985888 CEST	39382	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:04.328044891 CEST	4258	39382	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:05.976428032 CEST	4258	39382	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:05.977160931 CEST	39382	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:05.977169991 CEST	39384	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:05.982867956 CEST	4258	39384	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:05.983057976 CEST	4258	39382	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:05.983114958 CEST	39384	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:05.983161926 CEST	39384	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:05.988315105 CEST	4258	39384	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:07.612912893 CEST	4258	39384	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:07.613286018 CEST	39384	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:07.613542080 CEST	39386	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:07.618527889 CEST	4258	39384	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:07.618571043 CEST	4258	39386	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:07.618901014 CEST	39386	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:07.618901014 CEST	39386	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:07.624456882 CEST	4258	39386	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:09.258234024 CEST	4258	39386	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:09.258464098 CEST	39388	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:09.258541107 CEST	39386	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:09.263479948 CEST	4258	39388	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:09.263495922 CEST	4258	39386	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:09.263762951 CEST	39388	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:09.263762951 CEST	39388	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:09.268871069 CEST	4258	39388	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:10.896389961 CEST	4258	39388	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:10.897144079 CEST	39388	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:10.897161961 CEST	39390	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:10.902393103 CEST	4258	39388	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:10.902414083 CEST	4258	39390	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:10.902841091 CEST	39390	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:10.902842045 CEST	39390	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:10.908215046 CEST	4258	39390	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:12.536953926 CEST	4258	39390	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:12.537368059 CEST	39392	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:12.537388086 CEST	39390	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:12.542721033 CEST	4258	39392	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:12.542742968 CEST	4258	39390	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:12.542993069 CEST	39392	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:12.543095112 CEST	39392	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:12.548360109 CEST	4258	39392	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:14.179867983 CEST	4258	39392	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:14.180296898 CEST	39392	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:14.180376053 CEST	39394	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:14.185997009 CEST	4258	39392	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:14.186034918 CEST	4258	39394	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:14.186315060 CEST	39394	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:14.186315060 CEST	39394	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:14.191361904 CEST	4258	39394	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:15.833655119 CEST	4258	39394	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:15.834314108 CEST	39396	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:15.834383965 CEST	39394	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:15.839555025 CEST	4258	39396	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:15.839674950 CEST	4258	39394	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:15.839814901 CEST	39396	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:15.839899063 CEST	39396	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:15.844857931 CEST	4258	39396	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:17.482875109 CEST	4258	39396	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:17.483288050 CEST	39396	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:17.483515024 CEST	39398	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:17.488466024 CEST	4258	39396	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:17.488487005 CEST	4258	39398	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:17.488612890 CEST	39398	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:17.488957882 CEST	39398	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:17.494086981 CEST	4258	39398	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:19.133403063 CEST	4258	39398	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:19.134023905 CEST	39398	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:19.134047031 CEST	39400	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:19.139414072 CEST	4258	39398	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:19.139461994 CEST	4258	39400	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:19.140043974 CEST	39400	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:19.140134096 CEST	39400	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:19.145535946 CEST	4258	39400	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:20.791129112 CEST	4258	39400	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:20.791743040 CEST	39400	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:20.791822910 CEST	39402	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:20.797327042 CEST	4258	39400	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:20.797380924 CEST	4258	39402	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:20.797528028 CEST	39402	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:20.797528028 CEST	39402	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:20.803232908 CEST	4258	39402	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:22.427608967 CEST	4258	39402	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:22.428263903 CEST	39402	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:22.428355932 CEST	39404	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:22.433470011 CEST	4258	39402	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:22.433506966 CEST	4258	39404	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:22.434001923 CEST	39404	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:22.434123993 CEST	39404	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:22.439441919 CEST	4258	39404	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:24.084522009 CEST	4258	39404	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:24.085253000 CEST	39404	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:24.085318089 CEST	39406	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:24.090543985 CEST	4258	39404	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:24.090586901 CEST	4258	39406	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:24.091011047 CEST	39406	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:24.091012001 CEST	39406	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:24.095959902 CEST	4258	39406	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:25.777281046 CEST	4258	39406	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:25.777671099 CEST	39408	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:25.777813911 CEST	39406	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:25.783016920 CEST	4258	39408	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:25.783046961 CEST	4258	39406	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:25.783214092 CEST	39408	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:25.783215046 CEST	39408	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:25.788218975 CEST	4258	39408	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:27.427798033 CEST	4258	39408	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:27.428437948 CEST	39410	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:27.428442001 CEST	39408	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:27.433937073 CEST	4258	39408	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:27.433993101 CEST	4258	39410	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:27.434356928 CEST	39410	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:27.434444904 CEST	39410	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:27.439543962 CEST	4258	39410	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:29.068694115 CEST	4258	39410	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:29.069524050 CEST	39412	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:29.069555044 CEST	39410	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:29.074728012 CEST	4258	39412	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:29.074774981 CEST	4258	39410	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:29.075083017 CEST	39412	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:29.075083017 CEST	39412	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:29.080126047 CEST	4258	39412	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:30.711697102 CEST	4258	39412	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:30.712341070 CEST	39414	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:30.712352991 CEST	39412	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:30.717474937 CEST	4258	39412	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:30.717498064 CEST	4258	39414	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:30.717782974 CEST	39414	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:30.717874050 CEST	39414	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:30.722906113 CEST	4258	39414	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:32.384845018 CEST	4258	39414	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:32.385413885 CEST	39414	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:32.385428905 CEST	39416	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:32.390798092 CEST	4258	39414	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:32.390820026 CEST	4258	39416	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:32.391206026 CEST	39416	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:32.391206026 CEST	39416	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:32.396307945 CEST	4258	39416	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:34.020945072 CEST	4258	39416	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:34.021586895 CEST	39416	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:34.021747112 CEST	39418	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:34.027456045 CEST	4258	39416	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:34.027503967 CEST	4258	39418	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:34.027806997 CEST	39418	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:34.027806997 CEST	39418	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:34.033236027 CEST	4258	39418	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:35.681514025 CEST	4258	39418	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:35.681921005 CEST	39418	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:35.682080030 CEST	39420	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:35.687870026 CEST	4258	39418	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:35.687892914 CEST	4258	39420	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:35.688347101 CEST	39420	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:35.688452005 CEST	39420	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:35.693694115 CEST	4258	39420	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:37.336385012 CEST	4258	39420	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:37.336880922 CEST	39420	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:37.336889029 CEST	39422	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:37.342253923 CEST	4258	39420	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:37.342276096 CEST	4258	39422	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:37.342674971 CEST	39422	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:37.342674971 CEST	39422	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:37.347968102 CEST	4258	39422	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:38.991391897 CEST	4258	39422	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:38.991868019 CEST	39424	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:38.991873980 CEST	39422	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:38.996913910 CEST	4258	39422	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:38.996948957 CEST	4258	39424	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:38.997304916 CEST	39424	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:38.997304916 CEST	39424	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:39.002921104 CEST	4258	39424	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:40.744725943 CEST	4258	39424	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:40.745182991 CEST	39426	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:40.745322943 CEST	39424	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:40.750057936 CEST	4258	39426	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:40.750292063 CEST	4258	39424	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:40.750339031 CEST	39426	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:40.750339031 CEST	39426	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:40.755361080 CEST	4258	39426	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:42.383522034 CEST	4258	39426	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:42.384007931 CEST	39426	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:42.384120941 CEST	39428	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:42.388962984 CEST	4258	39426	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:42.389036894 CEST	4258	39428	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:42.389417887 CEST	39428	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:42.389417887 CEST	39428	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:42.394315958 CEST	4258	39428	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:44.020098925 CEST	4258	39428	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:44.020289898 CEST	39428	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:44.020426989 CEST	39430	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:44.025598049 CEST	4258	39428	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:44.025619030 CEST	4258	39430	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:44.026151896 CEST	39430	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:44.026151896 CEST	39430	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:44.031228065 CEST	4258	39430	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:45.666785002 CEST	4258	39430	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:45.667552948 CEST	39430	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:45.667634964 CEST	39432	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:45.672950029 CEST	4258	39430	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:45.672977924 CEST	4258	39432	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:45.673405886 CEST	39432	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:45.673556089 CEST	39432	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:45.678888083 CEST	4258	39432	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:47.340221882 CEST	4258	39432	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:47.340699911 CEST	39432	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:47.340816975 CEST	39434	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:47.345921993 CEST	4258	39432	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:47.345944881 CEST	4258	39434	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:47.346503973 CEST	39434	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:47.346503973 CEST	39434	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:47.351732016 CEST	4258	39434	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:48.992547989 CEST	4258	39434	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:48.993032932 CEST	39436	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:48.993113995 CEST	39434	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:48.998970032 CEST	4258	39436	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:48.998997927 CEST	4258	39434	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:48.999425888 CEST	39436	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:48.999425888 CEST	39436	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:49.004554033 CEST	4258	39436	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:50.631514072 CEST	4258	39436	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:50.632316113 CEST	39436	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:50.632316113 CEST	39436	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:50.632452011 CEST	39438	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:50.638027906 CEST	4258	39436	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:50.638107061 CEST	4258	39438	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:50.638470888 CEST	39438	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:50.638530970 CEST	39438	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:50.643924952 CEST	4258	39438	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:52.289069891 CEST	4258	39438	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:52.289433002 CEST	39438	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:52.289552927 CEST	39440	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:52.294686079 CEST	4258	39438	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:52.295095921 CEST	4258	39440	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:52.295413017 CEST	39440	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:52.295520067 CEST	39440	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:52.300666094 CEST	4258	39440	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:53.958803892 CEST	4258	39440	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:53.959376097 CEST	39440	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:53.959595919 CEST	39442	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:53.964915991 CEST	4258	39440	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:53.964967012 CEST	4258	39442	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:53.965125084 CEST	39442	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:53.965221882 CEST	39442	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:53.970802069 CEST	4258	39442	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:55.937067032 CEST	4258	39442	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:55.937688112 CEST	39444	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:55.937695980 CEST	4258	39442	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:55.937693119 CEST	39442	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:55.937983990 CEST	39442	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:55.943027973 CEST	4258	39442	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:55.943078041 CEST	4258	39444	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:55.943315029 CEST	39444	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:55.943443060 CEST	39444	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:55.948759079 CEST	4258	39444	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:57.589042902 CEST	4258	39444	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:57.589930058 CEST	39446	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:57.589924097 CEST	39444	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:57.595716000 CEST	4258	39446	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:57.595767021 CEST	4258	39444	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:57.595909119 CEST	39446	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:57.596044064 CEST	39446	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:57.601254940 CEST	4258	39446	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:59.235737085 CEST	4258	39446	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:59.236377954 CEST	39446	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:59.236423016 CEST	39448	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:59.241216898 CEST	4258	39446	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:59.241426945 CEST	4258	39448	57.129.51.86	192.168.2.13
Oct 6, 2024 23:31:59.241794109 CEST	39448	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:59.241986990 CEST	39448	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:31:59.246711016 CEST	4258	39448	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:00.864706039 CEST	4258	39448	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:00.865262032 CEST	39450	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:00.865339041 CEST	39448	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:00.871014118 CEST	4258	39450	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:00.871061087 CEST	4258	39448	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:00.871292114 CEST	39450	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:00.871292114 CEST	39450	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:00.877223015 CEST	4258	39450	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:02.541085958 CEST	4258	39450	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:02.541624069 CEST	39450	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:02.541640043 CEST	39452	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:02.547476053 CEST	4258	39450	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:02.547527075 CEST	4258	39452	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:02.547970057 CEST	39452	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:02.548279047 CEST	39452	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:02.555468082 CEST	4258	39452	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:04.176423073 CEST	4258	39452	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:04.177203894 CEST	39452	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:04.177223921 CEST	39454	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:04.182821035 CEST	4258	39452	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:04.182874918 CEST	4258	39454	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:04.183506966 CEST	39454	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:04.183506966 CEST	39454	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:04.189028025 CEST	4258	39454	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:05.821576118 CEST	4258	39454	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:05.821962118 CEST	39456	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:05.822082996 CEST	39454	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:05.827738047 CEST	4258	39456	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:05.827783108 CEST	4258	39454	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:05.827860117 CEST	39456	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:05.827913046 CEST	39456	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:05.833775043 CEST	4258	39456	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:07.480931997 CEST	4258	39456	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:07.481048107 CEST	39456	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:07.481076002 CEST	39458	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:07.486124039 CEST	4258	39458	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:07.486141920 CEST	4258	39456	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:07.486187935 CEST	39458	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:07.486238003 CEST	39458	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:07.491055012 CEST	4258	39458	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:09.119091988 CEST	4258	39458	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:09.119263887 CEST	39460	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:09.119366884 CEST	39458	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:09.124193907 CEST	4258	39460	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:09.124207973 CEST	4258	39458	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:09.124268055 CEST	39460	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:09.124306917 CEST	39460	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:09.129205942 CEST	4258	39460	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:10.771006107 CEST	4258	39460	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:10.771188974 CEST	39460	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:10.771203041 CEST	39462	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:10.776118994 CEST	4258	39460	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:10.776134968 CEST	4258	39462	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:10.776246071 CEST	39462	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:10.776267052 CEST	39462	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:10.781034946 CEST	4258	39462	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:12.411118031 CEST	4258	39462	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:12.411346912 CEST	39462	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:12.411410093 CEST	39464	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:12.416285038 CEST	4258	39462	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:12.416304111 CEST	4258	39464	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:12.416363955 CEST	39464	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:12.416390896 CEST	39464	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:12.421211958 CEST	4258	39464	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:14.069351912 CEST	4258	39464	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:14.069910049 CEST	39464	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:14.070020914 CEST	39466	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:14.075216055 CEST	4258	39464	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:14.075246096 CEST	4258	39466	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:14.075467110 CEST	39466	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:14.075467110 CEST	39466	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:14.080694914 CEST	4258	39466	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:15.708430052 CEST	4258	39466	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:15.708949089 CEST	39466	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:15.709036112 CEST	39468	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:15.714550018 CEST	4258	39466	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:15.714570999 CEST	4258	39468	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:15.715039968 CEST	39468	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:15.715040922 CEST	39468	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:15.720505953 CEST	4258	39468	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:17.382328033 CEST	4258	39468	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:17.382627010 CEST	39468	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:17.382926941 CEST	39470	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:17.387487888 CEST	4258	39468	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:17.387934923 CEST	4258	39470	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:17.388179064 CEST	39470	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:17.388180017 CEST	39470	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:17.393214941 CEST	4258	39470	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:19.021692991 CEST	4258	39470	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:19.022321939 CEST	39470	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:19.022365093 CEST	39472	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:19.028038025 CEST	4258	39470	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:19.028089046 CEST	4258	39472	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:19.028665066 CEST	39472	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:19.028665066 CEST	39472	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:19.034339905 CEST	4258	39472	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:20.665972948 CEST	4258	39472	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:20.666237116 CEST	39472	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:20.666498899 CEST	39474	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:20.671138048 CEST	4258	39472	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:20.671533108 CEST	4258	39474	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:20.671644926 CEST	39474	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:20.671762943 CEST	39474	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:20.676656961 CEST	4258	39474	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:22.321147919 CEST	4258	39474	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:22.321537971 CEST	39476	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:22.321649075 CEST	39474	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:22.326767921 CEST	4258	39476	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:22.326798916 CEST	4258	39474	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:22.326891899 CEST	39476	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:22.326941013 CEST	39476	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:22.331990004 CEST	4258	39476	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:23.975419044 CEST	4258	39476	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:23.975737095 CEST	39476	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:23.975739002 CEST	39478	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:23.980701923 CEST	4258	39476	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:23.980761051 CEST	4258	39478	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:23.980856895 CEST	39478	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:23.980879068 CEST	39478	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:23.985801935 CEST	4258	39478	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:25.621717930 CEST	4258	39478	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:25.622096062 CEST	39478	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:25.622104883 CEST	39480	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:25.627110958 CEST	4258	39480	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:25.627221107 CEST	39480	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:25.627270937 CEST	4258	39478	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:25.627270937 CEST	39480	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:25.632312059 CEST	4258	39480	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:27.255686045 CEST	4258	39480	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:27.256215096 CEST	39480	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:27.256215096 CEST	39480	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:27.256236076 CEST	39482	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:27.261300087 CEST	4258	39480	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:27.261324883 CEST	4258	39482	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:27.261704922 CEST	39482	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:27.261792898 CEST	39482	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:27.267081976 CEST	4258	39482	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:28.941428900 CEST	4258	39482	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:28.941920996 CEST	39482	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:28.942122936 CEST	39484	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:28.947335005 CEST	4258	39482	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:28.947592020 CEST	4258	39484	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:28.947989941 CEST	39484	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:28.948389053 CEST	39484	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:28.954008102 CEST	4258	39484	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:30.604706049 CEST	4258	39484	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:30.605312109 CEST	39484	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:30.605518103 CEST	39486	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:30.610611916 CEST	4258	39484	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:30.610632896 CEST	4258	39486	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:30.611069918 CEST	39486	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:30.611375093 CEST	39486	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:30.616409063 CEST	4258	39486	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:32.239942074 CEST	4258	39486	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:32.240514040 CEST	39486	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:32.240614891 CEST	39488	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:32.246083021 CEST	4258	39486	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:32.246130943 CEST	4258	39488	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:32.246644974 CEST	39488	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:32.246737003 CEST	39488	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:32.252516031 CEST	4258	39488	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:33.880700111 CEST	4258	39488	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:33.880954027 CEST	39488	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:33.881159067 CEST	39490	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:33.885870934 CEST	4258	39488	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:33.886048079 CEST	4258	39490	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:33.886178970 CEST	39490	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:33.886255980 CEST	39490	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:33.891441107 CEST	4258	39490	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:35.520590067 CEST	4258	39490	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:35.521370888 CEST	39492	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:35.521387100 CEST	39490	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:35.526566982 CEST	4258	39490	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:35.526613951 CEST	4258	39492	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:35.527055979 CEST	39492	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:35.527055979 CEST	39492	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:35.532797098 CEST	4258	39492	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:37.224944115 CEST	4258	39492	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:37.225610971 CEST	39494	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:37.225667000 CEST	39492	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:37.230878115 CEST	4258	39494	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:37.230921984 CEST	4258	39492	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:37.231323957 CEST	39494	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:37.231323957 CEST	39494	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:37.237237930 CEST	4258	39494	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:38.868709087 CEST	4258	39494	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:38.869205952 CEST	39494	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:38.869275093 CEST	39496	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:38.875473022 CEST	4258	39494	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:38.875525951 CEST	4258	39496	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:38.875811100 CEST	39496	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:38.875811100 CEST	39496	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:38.881247997 CEST	4258	39496	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:40.546061993 CEST	4258	39496	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:40.546297073 CEST	39496	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:40.546320915 CEST	39498	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:40.551279068 CEST	4258	39496	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:40.551299095 CEST	4258	39498	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:40.551433086 CEST	39498	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:40.551472902 CEST	39498	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:40.556417942 CEST	4258	39498	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:42.199053049 CEST	4258	39498	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:42.199697971 CEST	39500	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:42.199783087 CEST	39498	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:42.204619884 CEST	4258	39500	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:42.204849958 CEST	4258	39498	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:42.204932928 CEST	39500	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:42.205014944 CEST	39500	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:42.209990978 CEST	4258	39500	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:43.917392969 CEST	4258	39500	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:43.917898893 CEST	39500	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:43.918103933 CEST	39502	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:43.922993898 CEST	4258	39500	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:43.923290014 CEST	4258	39502	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:43.923696995 CEST	39502	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:43.923697948 CEST	39502	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:43.928755045 CEST	4258	39502	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:45.577445030 CEST	4258	39502	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:45.577889919 CEST	39504	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:45.577980995 CEST	39502	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:45.583127975 CEST	4258	39504	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:45.583228111 CEST	4258	39502	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:45.583313942 CEST	39504	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:45.583359957 CEST	39504	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:45.588365078 CEST	4258	39504	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:47.239782095 CEST	4258	39504	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:47.240082026 CEST	39504	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:47.240082979 CEST	39504	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:47.240088940 CEST	39506	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:47.245167971 CEST	4258	39506	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:47.245182037 CEST	4258	39504	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:47.245266914 CEST	39506	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:47.245312929 CEST	39506	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:47.250245094 CEST	4258	39506	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:48.883224010 CEST	4258	39506	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:48.883696079 CEST	39508	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:48.883703947 CEST	39506	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:48.888999939 CEST	4258	39506	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:48.889014959 CEST	4258	39508	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:48.889116049 CEST	39508	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:48.889206886 CEST	39508	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:48.895021915 CEST	4258	39508	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:50.575676918 CEST	4258	39508	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:50.576289892 CEST	39508	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:50.576291084 CEST	39508	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:50.576317072 CEST	39510	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:50.581691980 CEST	4258	39510	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:50.581712961 CEST	4258	39508	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:50.581947088 CEST	39510	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:50.582156897 CEST	39510	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:50.587227106 CEST	4258	39510	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:52.209383965 CEST	4258	39510	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:52.210927010 CEST	39510	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:52.211007118 CEST	39512	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:52.215890884 CEST	4258	39510	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:52.216248989 CEST	4258	39512	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:52.216731071 CEST	39512	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:52.216830969 CEST	39512	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:52.221816063 CEST	4258	39512	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:53.868638039 CEST	4258	39512	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:53.869237900 CEST	39512	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:53.869306087 CEST	39514	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:53.874398947 CEST	4258	39512	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:53.874428988 CEST	4258	39514	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:53.874689102 CEST	39514	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:53.874892950 CEST	39514	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:53.879921913 CEST	4258	39514	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:55.523082972 CEST	4258	39514	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:55.523464918 CEST	39514	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:55.523557901 CEST	39516	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:55.528311968 CEST	4258	39514	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:55.528476954 CEST	4258	39516	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:55.528614044 CEST	39516	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:55.528836012 CEST	39516	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:55.533847094 CEST	4258	39516	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:57.220163107 CEST	4258	39516	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:57.220663071 CEST	39516	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:57.220666885 CEST	39518	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:57.225691080 CEST	4258	39516	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:57.225713015 CEST	4258	39518	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:57.226129055 CEST	39518	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:57.226324081 CEST	39518	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:57.231314898 CEST	4258	39518	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:58.871259928 CEST	4258	39518	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:58.871901989 CEST	39520	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:58.872034073 CEST	39518	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:58.877341986 CEST	4258	39520	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:58.877362013 CEST	4258	39518	57.129.51.86	192.168.2.13
Oct 6, 2024 23:32:58.877957106 CEST	39520	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:58.878073931 CEST	39520	4258	192.168.2.13	57.129.51.86
Oct 6, 2024 23:32:58.883126020 CEST	4258	39520	57.129.51.86	192.168.2.13

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 6, 2024 23:32:07.573806047 CEST	33112	53	192.168.2.13	1.1.1.1
Oct 6, 2024 23:32:07.573915958 CEST	46571	53	192.168.2.13	1.1.1.1
Oct 6, 2024 23:32:07.877216101 CEST	53	33112	1.1.1.1	192.168.2.13
Oct 6, 2024 23:32:07.877243042 CEST	53	46571	1.1.1.1	192.168.2.13

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 6, 2024 23:32:07.573806047 CEST	192.168.2.13	1.1.1.1	0x1bc8	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:32:07.573915958 CEST	192.168.2.13	1.1.1.1	0xeb68	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 6, 2024 23:32:07.877216101 CEST	1.1.1.1	192.168.2.13	0x1bc8	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:32:07.877216101 CEST	1.1.1.1	192.168.2.13	0x1bc8	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: na.elf PID: 5445, Parent PID: 5370

General

Start time (UTC):	21:29:22
Start date (UTC):	06/10/2024
Path:	/tmp/na.elf
Arguments:	/tmp/na.elf
File size:	123364 bytes
MD5 hash:	f8ba06420003562376e39b51ff51b459

Chronological Activities

Analysis Process: na.elf PID: 5446, Parent PID: 5445

General

Start time (UTC):	21:29:23
Start date (UTC):	06/10/2024
Path:	/tmp/na.elf
Arguments:	-
File size:	123364 bytes
MD5 hash:	f8ba06420003562376e39b51ff51b459

Chronological Activities

Analysis Process: na.elf PID: 5447, Parent PID: 5446

General

Start time (UTC):	21:29:23
Start date (UTC):	06/10/2024
Path:	/tmp/na.elf
Arguments:	-
File size:	123364 bytes
MD5 hash:	f8ba06420003562376e39b51ff51b459

Description:	Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping or `net view` using Net .
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report na.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Threatname: Gafgyt

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: na.elf PID: 5445, Parent PID: 5370

General

Chronological Activities

Analysis Process: na.elf PID: 5446, Parent PID: 5445

General

Chronological Activities

Analysis Process: na.elf PID: 5447, Parent PID: 5446

General

Linux Analysis Report
na.elf