Edit tour

Linux Analysis Report
Hy0AyRD058.elf

Overview

General Information

Sample name:	Hy0AyRD058.elf renamed because original name is a hash value
Original sample name:	5b7af3ef2d6a0a47d117be25c945da5d.elf
Analysis ID:	1529317
MD5:	5b7af3ef2d6a0a47d117be25c945da5d
SHA1:	a915cd0e19f5ddc2929d6822d7cad2b9594fedf5
SHA256:	aa65ab92090df1d04c1ee1fd201ab9094c679552ed8c5a4958285dd5db1af932
Tags:	32elfgafgytmotorola
Infos:

Detection

Gafgyt, Mirai

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Gafgyt

Yara detected Mirai

Contains symbols with names commonly found in malware

Opens /proc/net/* files useful for finding connected devices and routers

Detected TCP or UDP traffic on non-standard ports

Sample contains strings that are user agent strings indicative of HTTP manipulation

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1529317
Start date and time:	2024-10-08 21:02:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	Hy0AyRD058.elf renamed because original name is a hash value
Original Sample Name:	5b7af3ef2d6a0a47d117be25c945da5d.elf
Detection:	MAL
Classification:	mal100.spre.troj.linELF@0/1@0/0

Warnings

VT rate limit hit for: Hy0AyRD058.elf

Runtime Messages

Command:	/tmp/Hy0AyRD058.elf
PID:	6216
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

Hy0AyRD058.elf (PID: 6216, Parent: 6131, MD5: cd177594338c77b895ae27c33f8f86cc) Arguments: /tmp/Hy0AyRD058.elf

Hy0AyRD058.elf New Fork (PID: 6218, Parent: 6216)

Hy0AyRD058.elf New Fork (PID: 6220, Parent: 6218)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Hy0AyRD058.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
Hy0AyRD058.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Hy0AyRD058.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1a21a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a22e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a242:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a256:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a26a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a27e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a292:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a2a6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a2ba:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a2ce:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a2e2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a2f6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a30a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a31e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a332:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a346:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a35a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a36e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a382:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a396:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a3aa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Hy0AyRD058.elf	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x1c4a6:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x1e49c:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64

Memory Dumps

Source	Rule	Description	Author	Strings
6218.1.00007f87f0001000.00007f87f0022000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
6218.1.00007f87f0001000.00007f87f0022000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6218.1.00007f87f0001000.00007f87f0022000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1a21a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a22e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a242:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a256:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a26a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a27e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a292:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a2a6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a2ba:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a2ce:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a2e2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a2f6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a30a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a31e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a332:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a346:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a35a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a36e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a382:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a396:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a3aa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6218.1.00007f87f0001000.00007f87f0022000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x1c4a6:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x1e49c:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
6216.1.00007f87f0001000.00007f87f0022000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
6216.1.00007f87f0001000.00007f87f0022000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6216.1.00007f87f0001000.00007f87f0022000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1a21a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a22e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a242:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a256:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a26a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a27e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a292:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a2a6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a2ba:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a2ce:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a2e2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a2f6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a30a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a31e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a332:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a346:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a35a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a36e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a382:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a396:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a3aa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6216.1.00007f87f0001000.00007f87f0022000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x1c4a6:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x1e49c:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: Hy0AyRD058.elf PID: 6216	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: Hy0AyRD058.elf PID: 6216	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xa482:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa496:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa4aa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa4be:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa4d2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa4e6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa4fa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa50e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa522:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa536:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa54a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa55e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa572:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa586:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa59a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa5ae:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa5c2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa5d6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa5ea:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa5fe:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa612:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Hy0AyRD058.elf PID: 6216	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xd91f:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0xdb8c:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0xfd0c:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x1080e:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: Hy0AyRD058.elf PID: 6218	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: Hy0AyRD058.elf PID: 6218	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xa751:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa765:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa779:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa78d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa7a1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa7b5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa7c9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa7dd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa7f1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa805:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa819:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa82d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa841:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa855:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa869:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa87d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa891:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa8a5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa8b9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa8cd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa8e1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Hy0AyRD058.elf PID: 6218	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xdbee:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0xde5b:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0xffdb:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x10add:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Click to see the 9 entries

Suricata Signatures

ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T21:02:55.496251+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56324	162.215.219.170	4444	TCP
2024-10-08T21:02:57.133263+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56326	162.215.219.170	4444	TCP
2024-10-08T21:02:58.750484+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56328	162.215.219.170	4444	TCP
2024-10-08T21:03:00.307289+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56330	162.215.219.170	4444	TCP
2024-10-08T21:03:01.869068+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56332	162.215.219.170	4444	TCP
2024-10-08T21:03:03.459450+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56334	162.215.219.170	4444	TCP
2024-10-08T21:03:05.047074+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56336	162.215.219.170	4444	TCP
2024-10-08T21:03:06.609585+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56338	162.215.219.170	4444	TCP
2024-10-08T21:03:08.213150+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56340	162.215.219.170	4444	TCP
2024-10-08T21:03:09.815142+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56342	162.215.219.170	4444	TCP
2024-10-08T21:03:12.174568+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56344	162.215.219.170	4444	TCP
2024-10-08T21:03:13.744182+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56346	162.215.219.170	4444	TCP
2024-10-08T21:03:15.310811+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56348	162.215.219.170	4444	TCP
2024-10-08T21:03:16.890301+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56350	162.215.219.170	4444	TCP
2024-10-08T21:03:18.449612+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56352	162.215.219.170	4444	TCP
2024-10-08T21:03:20.027584+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56354	162.215.219.170	4444	TCP
2024-10-08T21:03:21.651811+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56356	162.215.219.170	4444	TCP
2024-10-08T21:03:23.230448+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56358	162.215.219.170	4444	TCP
2024-10-08T21:03:24.790378+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56360	162.215.219.170	4444	TCP
2024-10-08T21:03:26.394930+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56362	162.215.219.170	4444	TCP
2024-10-08T21:03:28.073034+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56364	162.215.219.170	4444	TCP
2024-10-08T21:03:29.650706+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56366	162.215.219.170	4444	TCP
2024-10-08T21:03:31.266481+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56368	162.215.219.170	4444	TCP
2024-10-08T21:03:32.822322+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56370	162.215.219.170	4444	TCP
2024-10-08T21:03:34.428274+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56372	162.215.219.170	4444	TCP
2024-10-08T21:03:36.013962+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56374	162.215.219.170	4444	TCP
2024-10-08T21:03:37.587942+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56376	162.215.219.170	4444	TCP
2024-10-08T21:03:39.170441+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56378	162.215.219.170	4444	TCP
2024-10-08T21:03:40.990596+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56380	162.215.219.170	4444	TCP
2024-10-08T21:03:42.578532+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56382	162.215.219.170	4444	TCP
2024-10-08T21:03:44.154835+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56384	162.215.219.170	4444	TCP
2024-10-08T21:03:45.715475+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56386	162.215.219.170	4444	TCP
2024-10-08T21:03:47.276276+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56388	162.215.219.170	4444	TCP
2024-10-08T21:03:48.977379+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56390	162.215.219.170	4444	TCP
2024-10-08T21:03:50.556767+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56392	162.215.219.170	4444	TCP
2024-10-08T21:03:52.123294+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56394	162.215.219.170	4444	TCP
2024-10-08T21:03:53.699098+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56396	162.215.219.170	4444	TCP
2024-10-08T21:03:55.264748+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56398	162.215.219.170	4444	TCP
2024-10-08T21:03:56.823032+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56400	162.215.219.170	4444	TCP
2024-10-08T21:03:58.390868+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56402	162.215.219.170	4444	TCP
2024-10-08T21:03:59.983286+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56404	162.215.219.170	4444	TCP
2024-10-08T21:04:01.574888+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56406	162.215.219.170	4444	TCP
2024-10-08T21:04:03.152793+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56408	162.215.219.170	4444	TCP
2024-10-08T21:04:05.032002+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56410	162.215.219.170	4444	TCP
2024-10-08T21:04:06.891876+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56412	162.215.219.170	4444	TCP
2024-10-08T21:04:08.467941+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56414	162.215.219.170	4444	TCP
2024-10-08T21:04:10.037572+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56416	162.215.219.170	4444	TCP
2024-10-08T21:04:11.621167+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56418	162.215.219.170	4444	TCP
2024-10-08T21:04:13.199113+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56420	162.215.219.170	4444	TCP
2024-10-08T21:04:14.763026+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56422	162.215.219.170	4444	TCP
2024-10-08T21:04:16.342184+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56424	162.215.219.170	4444	TCP
2024-10-08T21:04:17.907327+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56426	162.215.219.170	4444	TCP
2024-10-08T21:04:19.481167+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56428	162.215.219.170	4444	TCP
2024-10-08T21:04:21.058759+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56430	162.215.219.170	4444	TCP
2024-10-08T21:04:22.699778+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56432	162.215.219.170	4444	TCP
2024-10-08T21:04:24.443999+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56434	162.215.219.170	4444	TCP
2024-10-08T21:04:26.033678+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56436	162.215.219.170	4444	TCP
2024-10-08T21:04:27.592962+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56438	162.215.219.170	4444	TCP
2024-10-08T21:04:29.174133+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56440	162.215.219.170	4444	TCP
2024-10-08T21:04:30.749528+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56442	162.215.219.170	4444	TCP
2024-10-08T21:04:32.324648+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56444	162.215.219.170	4444	TCP
2024-10-08T21:04:33.885884+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56446	162.215.219.170	4444	TCP
2024-10-08T21:04:35.466799+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56448	162.215.219.170	4444	TCP
2024-10-08T21:04:37.086918+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56450	162.215.219.170	4444	TCP
2024-10-08T21:04:38.661671+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56452	162.215.219.170	4444	TCP
2024-10-08T21:04:40.498602+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56454	162.215.219.170	4444	TCP
2024-10-08T21:04:42.058667+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56456	162.215.219.170	4444	TCP
2024-10-08T21:04:43.620029+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56458	162.215.219.170	4444	TCP
2024-10-08T21:04:45.607139+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56460	162.215.219.170	4444	TCP
2024-10-08T21:04:47.168454+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56462	162.215.219.170	4444	TCP
2024-10-08T21:04:48.783836+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56464	162.215.219.170	4444	TCP
2024-10-08T21:04:50.354735+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56466	162.215.219.170	4444	TCP
2024-10-08T21:04:51.933731+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56468	162.215.219.170	4444	TCP
2024-10-08T21:04:53.518474+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56470	162.215.219.170	4444	TCP
2024-10-08T21:04:55.089872+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56472	162.215.219.170	4444	TCP
2024-10-08T21:04:56.874437+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56474	162.215.219.170	4444	TCP
2024-10-08T21:04:58.440397+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56476	162.215.219.170	4444	TCP
2024-10-08T21:05:00.015177+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56478	162.215.219.170	4444	TCP
2024-10-08T21:05:01.592493+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56480	162.215.219.170	4444	TCP
2024-10-08T21:05:03.189175+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56482	162.215.219.170	4444	TCP
2024-10-08T21:05:04.744880+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56484	162.215.219.170	4444	TCP
2024-10-08T21:05:06.307963+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56486	162.215.219.170	4444	TCP
2024-10-08T21:05:07.874388+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56488	162.215.219.170	4444	TCP
2024-10-08T21:05:10.172384+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56490	162.215.219.170	4444	TCP
2024-10-08T21:05:11.767581+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56492	162.215.219.170	4444	TCP
2024-10-08T21:05:13.343575+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56494	162.215.219.170	4444	TCP
2024-10-08T21:05:14.901912+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56496	162.215.219.170	4444	TCP
2024-10-08T21:05:16.464306+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56498	162.215.219.170	4444	TCP
2024-10-08T21:05:18.029861+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56500	162.215.219.170	4444	TCP
2024-10-08T21:05:19.590108+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56502	162.215.219.170	4444	TCP
2024-10-08T21:05:21.169210+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56504	162.215.219.170	4444	TCP
2024-10-08T21:05:22.732201+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56506	162.215.219.170	4444	TCP
2024-10-08T21:05:24.292634+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56508	162.215.219.170	4444	TCP
2024-10-08T21:05:25.888017+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56510	162.215.219.170	4444	TCP
2024-10-08T21:05:27.475324+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56512	162.215.219.170	4444	TCP
2024-10-08T21:05:29.030061+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56514	162.215.219.170	4444	TCP
2024-10-08T21:05:30.592685+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56516	162.215.219.170	4444	TCP
2024-10-08T21:05:32.173091+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56518	162.215.219.170	4444	TCP
2024-10-08T21:05:33.745314+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56520	162.215.219.170	4444	TCP
2024-10-08T21:05:35.325528+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56522	162.215.219.170	4444	TCP
2024-10-08T21:05:36.929133+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56524	162.215.219.170	4444	TCP
2024-10-08T21:05:38.482068+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56526	162.215.219.170	4444	TCP
2024-10-08T21:05:40.061892+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56528	162.215.219.170	4444	TCP
2024-10-08T21:05:41.621012+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56530	162.215.219.170	4444	TCP
2024-10-08T21:05:43.204572+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56532	162.215.219.170	4444	TCP
2024-10-08T21:05:44.902140+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56534	162.215.219.170	4444	TCP
2024-10-08T21:05:46.467812+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56536	162.215.219.170	4444	TCP
2024-10-08T21:05:48.044567+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56538	162.215.219.170	4444	TCP
2024-10-08T21:05:49.698287+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56540	162.215.219.170	4444	TCP
2024-10-08T21:05:51.282942+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56542	162.215.219.170	4444	TCP
2024-10-08T21:05:52.873112+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56544	162.215.219.170	4444	TCP
2024-10-08T21:05:54.435635+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56546	162.215.219.170	4444	TCP
2024-10-08T21:05:55.998121+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56548	162.215.219.170	4444	TCP
2024-10-08T21:05:57.582031+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56550	162.215.219.170	4444	TCP
2024-10-08T21:05:59.313797+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56552	162.215.219.170	4444	TCP
2024-10-08T21:06:00.903794+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56554	162.215.219.170	4444	TCP
2024-10-08T21:06:02.547280+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56556	162.215.219.170	4444	TCP
2024-10-08T21:06:04.109055+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56558	162.215.219.170	4444	TCP
2024-10-08T21:06:05.677403+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56560	162.215.219.170	4444	TCP
2024-10-08T21:06:07.262927+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56562	162.215.219.170	4444	TCP
2024-10-08T21:06:08.826727+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56564	162.215.219.170	4444	TCP
2024-10-08T21:06:10.404941+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56566	162.215.219.170	4444	TCP
2024-10-08T21:06:11.983104+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56568	162.215.219.170	4444	TCP
2024-10-08T21:06:13.544361+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56570	162.215.219.170	4444	TCP
2024-10-08T21:06:15.106366+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56572	162.215.219.170	4444	TCP
2024-10-08T21:06:16.672046+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56574	162.215.219.170	4444	TCP
2024-10-08T21:06:18.251359+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56576	162.215.219.170	4444	TCP
2024-10-08T21:06:20.110593+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56578	162.215.219.170	4444	TCP
2024-10-08T21:06:21.742804+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56580	162.215.219.170	4444	TCP
2024-10-08T21:06:23.380759+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56582	162.215.219.170	4444	TCP
2024-10-08T21:06:24.982569+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56584	162.215.219.170	4444	TCP
2024-10-08T21:06:26.543199+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56586	162.215.219.170	4444	TCP
2024-10-08T21:06:28.140657+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56588	162.215.219.170	4444	TCP
2024-10-08T21:06:29.700361+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56590	162.215.219.170	4444	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Hy0AyRD058.elf

Avira: detected

Found malware configuration

Source: Hy0AyRD058.elf

Malware Configuration Extractor: Gafgyt {"C2 url": "162.215.219.170:4444"}

Multi AV Scanner detection for submitted file

Source: Hy0AyRD058.elf

ReversingLabs: Detection: 63%

Spreading

Opens /proc/net/* files useful for finding connected devices and routers

Source: /tmp/Hy0AyRD058.elf (PID: 6216)

Opens: /proc/net/route

Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56338 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56392 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56428 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56340 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56398 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56328 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56334 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56332 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56370 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56352 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56450 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56330 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56346 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56494 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56410 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56462 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56414 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56452 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56436 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56488 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56394 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56472 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56492 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56484 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56354 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56490 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56360 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56372 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56368 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56386 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56404 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56376 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56508 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56402 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56396 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56542 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56440 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56366 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56432 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56342 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56456 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56424 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56552 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56422 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56326 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56364 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56384 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56454 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56444 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56506 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56530 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56336 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56420 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56388 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56382 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56514 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56470 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56374 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56548 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56536 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56446 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56496 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56458 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56408 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56486 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56434 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56362 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56466 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56390 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56412 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56500 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56416 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56400 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56516 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56512 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56324 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56570 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56358 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56418 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56460 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56426 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56544 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56574 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56430 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56380 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56568 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56522 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56478 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56480 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56348 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56518 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56502 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56504 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56526 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56540 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56556 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56538 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56476 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56582 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56546 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56528 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56524 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56344 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56578 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56566 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56558 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56448 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56350 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56406 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56482 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56560 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56356 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56584 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56464 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56378 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56498 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56442 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56438 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56564 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56580 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56510 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56474 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56562 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56468 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56532 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56520 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56550 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56576 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56534 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56588 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56554 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56586 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56572 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56590 -> 162.215.219.170:4444

Source: global traffic

TCP traffic: 192.168.2.23:56324 -> 162.215.219.170:4444

Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443

Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170

Source: Hy0AyRD058.elf	String found in binary or memory: http://fast.no/support/crawler.asp)
Source: Hy0AyRD058.elf	String found in binary or memory: http://feedback.redkolibri.com/
Source: Hy0AyRD058.elf	String found in binary or memory: http://www.baidu.com/search/spider.htm)
Source: Hy0AyRD058.elf	String found in binary or memory: http://www.baidu.com/search/spider.html)
Source: Hy0AyRD058.elf	String found in binary or memory: http://www.billybobbot.com/crawler/)

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: Hy0AyRD058.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Hy0AyRD058.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6218.1.00007f87f0001000.00007f87f0022000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6218.1.00007f87f0001000.00007f87f0022000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6216.1.00007f87f0001000.00007f87f0022000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6216.1.00007f87f0001000.00007f87f0022000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: Hy0AyRD058.elf PID: 6216, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Hy0AyRD058.elf PID: 6216, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: Hy0AyRD058.elf PID: 6218, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Hy0AyRD058.elf PID: 6218, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown

Contains symbols with names commonly found in malware

Source: ELF static info symbol of initial sample	Name: httpattack
Source: ELF static info symbol of initial sample	Name: vseattack

Source: Hy0AyRD058.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Hy0AyRD058.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6218.1.00007f87f0001000.00007f87f0022000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6218.1.00007f87f0001000.00007f87f0022000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6216.1.00007f87f0001000.00007f87f0022000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6216.1.00007f87f0001000.00007f87f0022000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: Hy0AyRD058.elf PID: 6216, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Hy0AyRD058.elf PID: 6216, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: Hy0AyRD058.elf PID: 6218, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Hy0AyRD058.elf PID: 6218, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.spre.troj.linELF@0/1@0/0

Source: /tmp/Hy0AyRD058.elf (PID: 6216)

Queries kernel information via 'uname':

Jump to behavior

Source: Hy0AyRD058.elf, 6216.1.00007ffe0e592000.00007ffe0e5b3000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.Wy7dRd
Source: Hy0AyRD058.elf, 6216.1.0000564c15551000.0000564c155b5000.rw-.sdmp, Hy0AyRD058.elf, 6218.1.0000564c15551000.0000564c155b5000.rw-.sdmp	Binary or memory string: LV!/etc/qemu-binfmt/m68k
Source: Hy0AyRD058.elf, 6216.1.00007ffe0e592000.00007ffe0e5b3000.rw-.sdmp, Hy0AyRD058.elf, 6218.1.00007ffe0e592000.00007ffe0e5b3000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-m68k/tmp/Hy0AyRD058.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/Hy0AyRD058.elf
Source: Hy0AyRD058.elf, 6216.1.00007ffe0e592000.00007ffe0e5b3000.rw-.sdmp, Hy0AyRD058.elf, 6218.1.00007ffe0e592000.00007ffe0e5b3000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-m68k
Source: Hy0AyRD058.elf, 6216.1.0000564c15551000.0000564c155b5000.rw-.sdmp, Hy0AyRD058.elf, 6218.1.0000564c15551000.0000564c155b5000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/m68k
Source: Hy0AyRD058.elf, 6216.1.00007ffe0e592000.00007ffe0e5b3000.rw-.sdmp	Binary or memory string: LV/tmp/qemu-open.Wy7dRd\D

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match	File source: Hy0AyRD058.elf, type: SAMPLE
Source: Yara match	File source: 6218.1.00007f87f0001000.00007f87f0022000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6216.1.00007f87f0001000.00007f87f0022000.r-x.sdmp, type: MEMORY

Yara detected Mirai

Source: Yara match	File source: Hy0AyRD058.elf, type: SAMPLE
Source: Yara match	File source: 6218.1.00007f87f0001000.00007f87f0022000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6216.1.00007f87f0001000.00007f87f0022000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Hy0AyRD058.elf PID: 6216, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Hy0AyRD058.elf PID: 6218, type: MEMORYSTR

Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36
Source: Initial sample	User agent string found: Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; rv:2.2) Gecko/20110201
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.2; U; ru) Presto/2.5.22 Version/10.51
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko
Source: Initial sample	User agent string found: Mozilla/5.0 (Android; Linux armv7l; rv:9.0) Gecko/20111216 Firefox/9.0 Fennec/9.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60
Source: Initial sample	User agent string found: Mozilla/5.0 (iPad; U; CPU OS 5_1 like Mac OS X) AppleWebKit/531.21.10 (KHTML, like Gecko) Version/4.0.4 Mobile/7B367 Safari/531.21.10 UCBrowser/3.4.3.532
Source: Initial sample	User agent string found: Mozilla/5.0 (Nintendo WiiU) AppleWebKit/536.30 (KHTML, like Gecko) NX/3.0.4.2.12 NintendoBrowser/4.3.1.11264.US
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:25.0) Gecko/20100101 Firefox/25.0
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; pl) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; en) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; ja) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; cn) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; fr) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20100101 Firefox/12.0
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; U; Linux x86_64; de; rv:1.9.2.8) Gecko/20100723 Ubuntu/10.04 (lucid) Firefox/3.6.8
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; rv:13.0) Gecko/20100101 Firefox/13.0.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:11.0) Gecko/20100101 Firefox/11.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:13.0) Gecko/20100101 Firefox/13.0.1
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.289 Version/12.01
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.02
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.0) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.112 Safari/535.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en; rv:1.8.1.11) Gecko/20071128 Camino/1.5.4
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; cs; rv:1.9.2.6) Gecko/20100628 myibrow/4alpha2
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Win 9x 4.90; SG; rv:1.9.2.4) Gecko/20101104 Netscape/9.1.0285
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.2.0 Lightning/4.0.2
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10; rv:33.0) Gecko/20100101 Firefox/33.0

Remote Access Functionality

Yara detected Gafgyt

Source: Yara match	File source: Hy0AyRD058.elf, type: SAMPLE
Source: Yara match	File source: 6218.1.00007f87f0001000.00007f87f0022000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6216.1.00007f87f0001000.00007f87f0022000.r-x.sdmp, type: MEMORY

Yara detected Mirai

Source: Yara match	File source: Hy0AyRD058.elf, type: SAMPLE
Source: Yara match	File source: 6218.1.00007f87f0001000.00007f87f0022000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6216.1.00007f87f0001000.00007f87f0022000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Hy0AyRD058.elf PID: 6216, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Hy0AyRD058.elf PID: 6218, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	1 Remote System Discovery	Remote Desktop Protocol	Data from Removable Media	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

Threatname: Gafgyt

{"C2 url": "162.215.219.170:4444"}

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Hy0AyRD058.elf	63%	ReversingLabs	Linux.Trojan.LnxGafgyt
Hy0AyRD058.elf	100%	Avira	LINUX/Mirai.Gafgyt.

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.billybobbot.com/crawler/)	0%	URL Reputation	safe
http://fast.no/support/crawler.asp)	0%	URL Reputation	safe
http://feedback.redkolibri.com/	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
162.215.219.170:4444	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.baidu.com/search/spider.html)	Hy0AyRD058.elf	false		unknown
http://www.billybobbot.com/crawler/)	Hy0AyRD058.elf	false	URL Reputation: safe	unknown
http://fast.no/support/crawler.asp)	Hy0AyRD058.elf	false	URL Reputation: safe	unknown
http://feedback.redkolibri.com/	Hy0AyRD058.elf	false	URL Reputation: safe	unknown
http://www.baidu.com/search/spider.htm)	Hy0AyRD058.elf	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
162.215.219.170	unknown	United States	46606	UNIFIEDLAYER-AS-1US	true
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.43	NCVLNSfw1e.elf	Get hash	malicious	Unknown	Browse
	MO52No4WnT.elf	Get hash	malicious	Unknown	Browse
	BOVYJVrOjt.elf	Get hash	malicious	Mirai	Browse
	UZPtyH1Maa.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Mirai	Browse
91.189.91.42	NCVLNSfw1e.elf	Get hash	malicious	Unknown	Browse
	MO52No4WnT.elf	Get hash	malicious	Unknown	Browse
	BOVYJVrOjt.elf	Get hash	malicious	Mirai	Browse
	UZPtyH1Maa.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Mirai	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	NCVLNSfw1e.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	5skkMenK5x.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	MO52No4WnT.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	gMYQFxufu0.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	4LbWi40g57.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	BOVYJVrOjt.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	UZPtyH1Maa.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	irods-runtime-4.1.9-centos7-x86_64.rpm	Get hash	malicious	Xmrig	Browse	185.125.188.62
	na.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	na.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
CANONICAL-ASGB	NCVLNSfw1e.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	5skkMenK5x.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	MO52No4WnT.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	gMYQFxufu0.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	4LbWi40g57.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	BOVYJVrOjt.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	UZPtyH1Maa.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	irods-runtime-4.1.9-centos7-x86_64.rpm	Get hash	malicious	Xmrig	Browse	185.125.188.62
	na.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	na.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
UNIFIEDLAYER-AS-1US	https://phisher-parts-production-us-east-1.s3.amazonaws.com/da08a569-c476-4c06-9e6f-9e3c8ae51232/2024-10-08/dm05v41jqt45dhgffdnn8f9og9hsqbgjjjhn2jo1/7abc4121254d93d61494ed63a8489e54fc18f49b8fee3f2e42bc06d8de3bd8f4?response-content-disposition=attachment%3B%20filename%3D%22Trailhead%20Media%2024-090.pdf%22%3B%20filename%2A%3DUTF-8%27%27Trailhead%2520Media%252024-090.pdf&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=ASIA37KREM2QGGSCSFZ4%2F20241008%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20241008T163442Z&X-Amz-Expires=13860&X-Amz-Security-Token=IQoJb3JpZ2luX2VjEO%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaCXVzLWVhc3QtMSJHMEUCIDgEEKEw%2BhLGwBtqA9K8lbT2NL7hbWhvf2%2BPjyD670ZwAiEAjxudbMDljL%2FUqXOnRGbBuWM4gt9lBw1st5sI4FM7vZ8q%2FwMIRxAAGgw4MjMxOTMyNjU4MjQiDFL6sO98KdRGT%2FyB6ircA40orR%2Bw3i4U%2B9phl56wCil07vS%2BjAp0tNBfyQAkuYLNSI62vBzUSfUh8AtFx4keNf0RgCCwE%2F5gCyMz9dJzZLyDD2IAKWq0%2BZVLBi%2F7b8rVNUO1YeOio8ujPMfp7PNvhweEfhhY8gWxNds6w8BqlSQW47gyG6lKcp0A7mT5WgKaRXw1WeqCAEMdJCJlPtEma%2BQC5iWhRM0pLWgiBkR6hefhuzg2Tz54kHG3UNQwcDWAaKnjqYhM7zFoyV4AQaheZ%2FfeYnY1yedYoX4pPvs1ESF9JlWKqYxq45XmyrelrdgZHdinsHB9NygBDgLYdQlVcA8q8aEDwM5yaKxZUCkRDUT%2BJb0%2BCtt9rbu6zRC%2FVmZKIGqbIpVGNy4amYEf%2BnSXLUdz7lVpXGsb3kLoOghblbHcyVEfagdESdqIrQuvWG9mqEGbD0OQjdCwVx4Q4jbP%2F64E0vyYOxW5KEhabAoO8CQ4rv8pn47DEAsuKYtGkCRN%2FxqSxHV6ean9UbkBuNzcfqn%2FVpGx3A2uxr7Lyff7MJArWEMXsvfWi5LKjU8A8WeqnHljxyB6lsfFsi3p6KnjmkR9k7rwdRb2wdfEKvrkoq5%2B9cMWCTkzI1xSuI12GZdP74XfakNrsOJTGxzpMOaBlbgGOqUB6EOKQuRv4stEwpQj1THsV61McwaeBhcQW1ZeiHMR%2FPMuUFHOTfzikGnzEF0dw579Pv6WD2vyvq7i7uJv%2BRQQTqPgYSf6GCpXd%2Bpo4bQXTs9GoUG1Dv0s2Tos1ZBR6T7%2BCdAb%2F%2BMYiPDy86%2FFbh1RI6E5jnVh%2ByCIGL%2Bg53Mj67qwCe%2F7aw%2B6TyAnJVcGnug9ml35ow0E3Vc4ob87u3B9PwqgKEDQ&X-Amz-SignedHeaders=host&X-Amz-Signature=e4981c31034331c2fd0b62d9cfd5b86f4ce28daacc9bf862502fbb9c444389d2	Get hash	malicious	HTMLPhisher	Browse	162.214.125.2
	https://hnt.zkg.mybluehost.me/CA/LET	Get hash	malicious	HTMLPhisher	Browse	50.6.153.248
	paymentremittanceinformationCQDM.html	Get hash	malicious	Unknown	Browse	69.49.245.172
	https://ipfs.io/ipfs/QmNRP5R9QkxB8MVgk2kWzrmB6GoTVL3gcLheGnJuUDPaXv?filename=forme.html#jstubblefield@securustechnologies.com	Get hash	malicious	HTMLPhisher	Browse	162.241.27.10
	NIJIMUN6pQ.exe	Get hash	malicious	AgentTesla	Browse	192.254.225.166
	5FRWRDOqk7.exe	Get hash	malicious	FormBook	Browse	162.240.81.18
	enkJ6J7dAn.exe	Get hash	malicious	FormBook	Browse	162.241.244.106
	Remittance_Raveis.htm	Get hash	malicious	Unknown	Browse	69.49.245.172
	vD6qU34v9S.exe	Get hash	malicious	AgentTesla	Browse	192.254.225.136
	na.elf	Get hash	malicious	Unknown	Browse	50.6.126.101
INIT7CH	NCVLNSfw1e.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	MO52No4WnT.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	BOVYJVrOjt.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	UZPtyH1Maa.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	na.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	na.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	na.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	na.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	na.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	na.elf	Get hash	malicious	Mirai	Browse	109.202.202.202

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/tmp/qemu-open.Wy7dRd (deleted)

Download File

Process:	/tmp/Hy0AyRD058.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	230
Entropy (8bit):	3.709552666863289
Encrypted:	false
SSDEEP:	6:iekrEcvwAsE5KlwSd4pzKaV6Lpms/a/1VCxGF:ur+m5MwSdIKaV6L1adVRF
MD5:	2E667F43AE18CD1FE3C108641708A82C
SHA1:	12B90DE2DA0FBCFE66F3D6130905E56C8D6A68D3
SHA-256:	6F721492E7A337C5B498A8F55F5EB7AC745AFF716D0B5B08EFF2C1B6B250F983
SHA-512:	D2A0EE2509154EC1098994F38BE172F98F4150399C534A04D5C675D7C05630802225019F19344CC9070C576BC465A4FEB382AC7712DE6BF25E9244B54A9DB830
Malicious:	false
Reputation:	high, very likely benign file
Preview:	Iface.Destination.Gateway .Flags.RefCnt.Use.Metric.Mask..MTU.Window.IRTT .ens160.00000000.c0a80201.0003.0.0.0.00000000.0.0.0.ens160.c0a80200.00000000.0001.0.0.0.ffffff00.0.0.0.

Static File Info

General

File type:	ELF 32-bit MSB executable, Motorola m68k, 68020, version 1 (SYSV), statically linked, not stripped
Entropy (8bit):	6.31425866456526
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	Hy0AyRD058.elf
File size:	160'042 bytes
MD5:	5b7af3ef2d6a0a47d117be25c945da5d
SHA1:	a915cd0e19f5ddc2929d6822d7cad2b9594fedf5
SHA256:	aa65ab92090df1d04c1ee1fd201ab9094c679552ed8c5a4958285dd5db1af932
SHA512:	f93e9f118d0ba2790c27763bd1f861f93684edd03a42bd73846141c26963271a9b5706403ea48b18f48765381e22ef6e2397997f9565bdbbdfbeedc546cc6cf8
SSDEEP:	3072:gGsOCPg20ldfHqEY+QeqacWucW0JcWcBhoz40vXEHDbV58DMvEJ3OjpHmmu1kTLy:TjQeqacWucW0JcWcBe40UjR58DMEJ3OG
TLSH:	C7F3F8B6F401CFA2F04AD67208DB8E256E31A7E30B53212263673A67ED761C53C57E46
File Content Preview:	.ELF.......................D...4...d.....4. ...(.................................. ...........&...&.......i....... .dt.Q............................NV..a....da....PN^NuNV..J9..).f>"y..&8 QJ.g.X.#...&8N."y..&8 QJ.f.A.....J.g.Hy..&.N.X.......).N^NuNV..N^NuN

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	MC68000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x80000144
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	136804
Section Header Size:	40
Number of Section Headers:	15
Header String Table Index:	12

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80000094	0x94	0x14	0x0	0x6	AX	0	0	2
.text	PROGBITS	0x800000a8	0xa8	0x18b7c	0x0	0x6	AX	0	0	4
.fini	PROGBITS	0x80018c24	0x18c24	0xe	0x0	0x6	AX	0	0	2
.rodata	PROGBITS	0x80018c32	0x18c32	0x79e8	0x0	0x2	A	0	0	2
.eh_frame	PROGBITS	0x8002261c	0x2061c	0x4	0x0	0x3	WA	0	0	4
.ctors	PROGBITS	0x80022620	0x20620	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x80022628	0x20628	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x80022630	0x20630	0x4	0x0	0x3	WA	0	0	4
.data	PROGBITS	0x80022634	0x20634	0x368	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x8002299c	0x2099c	0x6664	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x2099c	0xc60	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x215fc	0x66	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x218bc	0x3230	0x10	0x0		14	298	4
.strtab	STRTAB	0x0	0x24aec	0x263e	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x80000000	0x80000000	0x2061a	0x2061a	6.3393	0x5	R E	0x2000	.init .text .fini .rodata
LOAD	0x2061c	0x8002261c	0x8002261c	0x380	0x69e4	4.4766	0x6	RW	0x2000	.eh_frame .ctors .dtors .jcr .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x80000094	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x800000a8	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x80018c24	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x80018c32	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x8002261c	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x80022620	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x80022628	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x80022630	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x80022634	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x8002299c	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	11
C.194.6386	.symtab	0x8001bf0c	92	OBJECT	<unknown>	DEFAULT	4
C.196.6493	.symtab	0x8001c6d4	1144	OBJECT	<unknown>	DEFAULT	4
C.211.6698	.symtab	0x8001e6ce	1128	OBJECT	<unknown>	DEFAULT	4
C.252.6998	.symtab	0x8001ec32	96	OBJECT	<unknown>	DEFAULT	4
DNSw	.symtab	0x80005ad4	632	FUNC	<unknown>	DEFAULT	2
HIPER_OVH	.symtab	0x800045a6	362	FUNC	<unknown>	DEFAULT	2
Q	.symtab	0x800229ce	16384	OBJECT	<unknown>	DEFAULT	10
Randhex	.symtab	0x80004e20	370	FUNC	<unknown>	DEFAULT	2
SendCloudflare	.symtab	0x80003752	338	FUNC	<unknown>	DEFAULT	2
SendDOMINATE	.symtab	0x800050a2	1120	FUNC	<unknown>	DEFAULT	2
SendHOME1	.symtab	0x80004710	314	FUNC	<unknown>	DEFAULT	2
SendHOME2	.symtab	0x8000484a	314	FUNC	<unknown>	DEFAULT	2
SendHTTPCloudflare	.symtab	0x800038a4	338	FUNC	<unknown>	DEFAULT	2
SendHTTPHex	.symtab	0x8000345a	380	FUNC	<unknown>	DEFAULT	2
SendOVH_STORM	.symtab	0x80003e58	1870	FUNC	<unknown>	DEFAULT	2
SendSTD	.symtab	0x800023c4	264	FUNC	<unknown>	DEFAULT	2
SendSTDHEX	.symtab	0x80001c00	362	FUNC	<unknown>	DEFAULT	2
SendSTD_HEX	.symtab	0x800025dc	314	FUNC	<unknown>	DEFAULT	2
SendUDP	.symtab	0x8000142c	850	FUNC	<unknown>	DEFAULT	2
UDPRAW	.symtab	0x80004c00	272	FUNC	<unknown>	DEFAULT	2
_Exit	.symtab	0x800098ac	92	FUNC	<unknown>	DEFAULT	2
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x80022624	0	OBJECT	<unknown>	DEFAULT	6
__CTOR_LIST__	.symtab	0x80022620	0	OBJECT	<unknown>	DEFAULT	6
__C_ctype_b	.symtab	0x8002273c	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x8001ef3c	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x80022994	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x8002031a	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x80022744	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x8001f23c	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x8002262c	0	OBJECT	<unknown>	DEFAULT	7
__DTOR_LIST__	.symtab	0x80022628	0	OBJECT	<unknown>	DEFAULT	7
__EH_FRAME_BEGIN__	.symtab	0x8002261c	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x8002261c	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x8002273c	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_tolower	.symtab	0x80022994	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_toupper	.symtab	0x80022744	4	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_b	.symtab	0x80022740	4	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_tolower	.symtab	0x80022998	4	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_toupper	.symtab	0x80022748	4	OBJECT	<unknown>	HIDDEN	9
__GI___errno_location	.symtab	0x8000a040	16	FUNC	<unknown>	HIDDEN	2
__GI___fcntl_nocancel	.symtab	0x8000977e	302	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x80013514	500	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x8000c89c	36	FUNC	<unknown>	HIDDEN	2
__GI___h_errno_location	.symtab	0x8001113c	16	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x80009650	302	FUNC	<unknown>	HIDDEN	2
__GI___sigaddset	.symtab	0x8000cf90	68	FUNC	<unknown>	HIDDEN	2
__GI___sigdelset	.symtab	0x8000cfd4	72	FUNC	<unknown>	HIDDEN	2
__GI___sigismember	.symtab	0x8000cf40	80	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x80010090	106	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x8001019a	124	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x8000c8c0	266	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x800098ac	92	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x8000e790	376	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x8000f0c0	28	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x80015214	64	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0x800099d8	16	FUNC	<unknown>	HIDDEN	2
__GI_clock_getres	.symtab	0x800107a0	116	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x800099e8	96	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0x80010c18	292	FUNC	<unknown>	HIDDEN	2
__GI_config_close	.symtab	0x8001114c	72	FUNC	<unknown>	HIDDEN	2
__GI_config_open	.symtab	0x80011194	106	FUNC	<unknown>	HIDDEN	2
__GI_config_read	.symtab	0x800113ee	744	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x8000cca8	48	FUNC	<unknown>	HIDDEN	2
__GI_errno	.symtab	0x80028be0	4	OBJECT	<unknown>	HIDDEN	10
__GI_execl	.symtab	0x80015134	178	FUNC	<unknown>	HIDDEN	2
__GI_execve	.symtab	0x800152e0	128	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x8000f338	220	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x80011834	476	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x80009650	302	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x800132f6	542	FUNC	<unknown>	HIDDEN	2
__GI_fgetc	.symtab	0x80012fe4	278	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x80013514	500	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x800130fc	158	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x80013708	226	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x80011a10	38	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x80009a48	86	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x8000bae8	80	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x800159e0	38	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x80015a08	370	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x80015360	148	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x8000bb38	162	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x80013514	500	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x80009aa0	52	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x80010814	30	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x80010834	30	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x80010854	30	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname	.symtab	0x8000cc4c	28	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2	.symtab	0x8000cc68	64	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2_r	.symtab	0x800145b8	928	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x80017c10	1018	FUNC	<unknown>	HIDDEN	2
__GI_gethostname	.symtab	0x8001800c	138	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x80010874	42	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x80009ad4	28	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x80009af0	126	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x8000ccd8	50	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x800108a0	30	FUNC	<unknown>	HIDDEN	2
__GI_h_errno	.symtab	0x80028be4	4	OBJECT	<unknown>	HIDDEN	10
__GI_htonl	.symtab	0x8000cb3a	12	FUNC	<unknown>	HIDDEN	2
__GI_htons	.symtab	0x8000cb46	22	FUNC	<unknown>	HIDDEN	2
__GI_inet_addr	.symtab	0x8000cc1c	48	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x80014440	376	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa	.symtab	0x8000cbfc	30	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa_r	.symtab	0x8000cb5c	160	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x800169d0	112	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x800164f0	96	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x8000ef6a	342	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x80009b70	172	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x8000ca2c	52	FUNC	<unknown>	HIDDEN	2
__GI_isspace	.symtab	0x80009fd8	40	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x80009c8c	20	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x8001822c	204	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x800137ec	348	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x8000c006	240	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x80013e08	288	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x80013f28	42	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x80013f54	358	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x8000c0f8	310	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x80010922	70	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x800153f4	150	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x80010968	112	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x80010a4a	20	FUNC	<unknown>	HIDDEN	2
__GI_ntohl	.symtab	0x8000cb18	12	FUNC	<unknown>	HIDDEN	2
__GI_ntohs	.symtab	0x8000cb24	22	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x80009d2c	80	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0x80010e44	268	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x8001811a	28	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x80014958	28	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x8000e918	112	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x8000eca8	270	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x80015f04	270	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x80009d7c	128	FUNC	<unknown>	HIDDEN	2
__GI_readdir64	.symtab	0x80010ff0	330	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x8000cd50	56	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x80010a60	106	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x80009e90	36	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x8000cd88	56	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x8000cdc0	70	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x80009eb4	86	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x8000ce08	64	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x8000eb00	424	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x80014974	34	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x8000ce7c	196	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x80010acc	162	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x8000f414	362	FUNC	<unknown>	HIDDEN	2
__GI_snprintf	.symtab	0x8000a050	52	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x8000ce48	50	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x8000a084	52	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x8000edb6	436	FUNC	<unknown>	HIDDEN	2
__GI_stat	.symtab	0x80018138	148	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x80018a2c	120	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x8000c230	386	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul	.symtab	0x800140bc	352	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x8000c3b4	110	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x8000c3b4	110	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x8000c424	52	FUNC	<unknown>	HIDDEN	2
__GI_strcspn	.symtab	0x8001421c	86	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x800182f8	80	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x8000c458	264	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x80016014	320	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x8000c560	342	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x800143e8	86	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x80014274	112	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x800142e4	104	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x8000c6b8	484	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x8000ca08	36	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x8001434c	154	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x8000f0dc	34	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x8000f79e	2068	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x8000ca60	182	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x80009f0c	38	FUNC	<unknown>	HIDDEN	2
__GI_tolower	.symtab	0x80018bb0	64	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x8000a000	64	FUNC	<unknown>	HIDDEN	2
__GI_uname	.symtab	0x800181cc	96	FUNC	<unknown>	HIDDEN	2
__GI_vfork	.symtab	0x80010708	38	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x8000a0b8	198	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x80010bf8	32	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x80009f34	34	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x800116d8	100	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x80011764	206	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x8001173c	38	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x80009f58	128	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x80022630	0	OBJECT	<unknown>	DEFAULT	8
__JCR_LIST__	.symtab	0x80022630	0	OBJECT	<unknown>	DEFAULT	8
__app_fini	.symtab	0x80028bd8	4	OBJECT	<unknown>	HIDDEN	10
__atexit_lock	.symtab	0x80022968	24	OBJECT	<unknown>	DEFAULT	9
__bss_start	.symtab	0x8002299c	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x80010156	68	FUNC	<unknown>	DEFAULT	2
__check_suid	.symtab	0x800100fa	92	FUNC	<unknown>	DEFAULT	2
__close_nameservers	.symtab	0x80017b44	130	FUNC	<unknown>	HIDDEN	2
__ctype_b	.symtab	0x80022740	4	OBJECT	<unknown>	DEFAULT	9
__ctype_tolower	.symtab	0x80022998	4	OBJECT	<unknown>	DEFAULT	9
__ctype_toupper	.symtab	0x80022748	4	OBJECT	<unknown>	DEFAULT	9
__curbrk	.symtab	0x80028be8	4	OBJECT	<unknown>	DEFAULT	10
__data_start	.symtab	0x8002263c	0	NOTYPE	<unknown>	DEFAULT	9
__decode_answer	.symtab	0x80016c70	452	FUNC	<unknown>	DEFAULT	2
__decode_dotted	.symtab	0x80016a40	400	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x80018518	478	FUNC	<unknown>	HIDDEN	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__dns_lookup	.symtab	0x80016e34	1838	FUNC	<unknown>	HIDDEN	2
__do_global_ctors_aux	.symtab	0x80018bf0	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x800000a8	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x80022634	0	OBJECT	<unknown>	HIDDEN	9
__encode_dotted	.symtab	0x80018aa4	268	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x80018348	464	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x800186f8	186	FUNC	<unknown>	HIDDEN	2
__environ	.symtab	0x80028bd0	4	OBJECT	<unknown>	DEFAULT	10
__errno_location	.symtab	0x8000a040	16	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x80028bc8	4	OBJECT	<unknown>	HIDDEN	10
__fcntl_nocancel	.symtab	0x8000977e	302	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x80013514	500	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x80022620	0	NOTYPE	<unknown>	HIDDEN	6
__fini_array_start	.symtab	0x80022620	0	NOTYPE	<unknown>	HIDDEN	6
__get_hosts_byname_r	.symtab	0x80017bc8	50	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x800157ba	548	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x80010874	42	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x8000c89c	36	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__h_errno_location	.symtab	0x8001113c	16	FUNC	<unknown>	DEFAULT	2
__h_errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__init_array_end	.symtab	0x80022620	0	NOTYPE	<unknown>	HIDDEN	6
__init_array_start	.symtab	0x80022620	0	NOTYPE	<unknown>	HIDDEN	6
__length_question	.symtab	0x80016bd0	160	FUNC	<unknown>	DEFAULT	2
__libc_close	.symtab	0x800099e8	96	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x8000cca8	48	FUNC	<unknown>	DEFAULT	2
__libc_fcntl	.symtab	0x80009650	302	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x80009a48	86	FUNC	<unknown>	DEFAULT	2
__libc_lseek64	.symtab	0x8001822c	204	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0x80010a4a	20	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x80009d2c	80	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x80009d7c	128	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x8000cd50	56	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x80009e90	36	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x8000cd88	56	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x8000cdc0	70	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x80014974	34	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x80028bcc	4	OBJECT	<unknown>	DEFAULT	10
__libc_system	.symtab	0x80010538	464	FUNC	<unknown>	DEFAULT	2
__libc_waitpid	.symtab	0x80009f34	34	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x80009f58	128	FUNC	<unknown>	DEFAULT	2
__local_nameserver	.symtab	0x800202fa	16	OBJECT	<unknown>	HIDDEN	4
__malloc_alloc	.symtab	0x8000d108	1658	FUNC	<unknown>	DEFAULT	2
__malloc_consolidate	.symtab	0x8000e0ca	592	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x8000d01c	236	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x8002288c	24	OBJECT	<unknown>	DEFAULT	9
__malloc_state	.symtab	0x80028c6c	888	OBJECT	<unknown>	DEFAULT	10
__malloc_trim	.symtab	0x8000e31a	254	FUNC	<unknown>	DEFAULT	2
__nameserver	.symtab	0x80028ff4	4	OBJECT	<unknown>	HIDDEN	10
__nameservers	.symtab	0x80028ff8	4	OBJECT	<unknown>	HIDDEN	10
__open_etc_hosts	.symtab	0x800187b4	34	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x80017622	1314	FUNC	<unknown>	HIDDEN	2
__pagesize	.symtab	0x80028bd4	4	OBJECT	<unknown>	DEFAULT	10
__preinit_array_end	.symtab	0x80022620	0	NOTYPE	<unknown>	HIDDEN	6
__preinit_array_start	.symtab	0x80022620	0	NOTYPE	<unknown>	HIDDEN	6
__progname	.symtab	0x80022984	4	OBJECT	<unknown>	DEFAULT	9
__progname_full	.symtab	0x80022988	4	OBJECT	<unknown>	DEFAULT	9
__pthread_initialize_minimal	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0x8001004a	10	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x80010040	10	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x80010040	10	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x80010040	10	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x80010040	10	FUNC	<unknown>	DEFAULT	2
__read_etc_hosts_r	.symtab	0x800187d6	596	FUNC	<unknown>	HIDDEN	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__res_sync	.symtab	0x80028fec	4	OBJECT	<unknown>	HIDDEN	10
__resolv_attempts	.symtab	0x80022991	1	OBJECT	<unknown>	HIDDEN	9
__resolv_lock	.symtab	0x80028bf0	24	OBJECT	<unknown>	DEFAULT	10
__resolv_timeout	.symtab	0x80022990	1	OBJECT	<unknown>	HIDDEN	9
__rtld_fini	.symtab	0x80028bdc	4	OBJECT	<unknown>	HIDDEN	10
__searchdomain	.symtab	0x80028ff0	4	OBJECT	<unknown>	HIDDEN	10
__searchdomains	.symtab	0x80028ffc	4	OBJECT	<unknown>	HIDDEN	10
__set_h_errno	.symtab	0x80017bfc	20	FUNC	<unknown>	DEFAULT	2
__sigaddset	.symtab	0x8000cf90	68	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x8000cfd4	72	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x8000cf40	80	FUNC	<unknown>	DEFAULT	2
__socketcall	.symtab	0x80010730	112	FUNC	<unknown>	HIDDEN	2
__socketcall.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__stdin	.symtab	0x80022758	4	OBJECT	<unknown>	DEFAULT	9
__stdio_READ	.symtab	0x80015b7c	136	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x80011a38	338	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x80015c04	342	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x80011f7c	518	FUNC	<unknown>	HIDDEN	2
__stdio_init_mutex	.symtab	0x8000a1da	32	FUNC	<unknown>	HIDDEN	2
__stdio_mutex_initializer.4484	.symtab	0x8001f53c	24	OBJECT	<unknown>	DEFAULT	4
__stdio_rfill	.symtab	0x80015d5c	90	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x80015e9c	102	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x80015db8	226	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x80012184	414	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x8000a2f4	116	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x8002275c	4	OBJECT	<unknown>	DEFAULT	9
__syscall_chdir	.symtab	0x80009978	96	FUNC	<unknown>	DEFAULT	2
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_getdents64	.symtab	0x80015738	130	FUNC	<unknown>	DEFAULT	2
__syscall_kill	.symtab	0x80009c1c	112	FUNC	<unknown>	DEFAULT	2
__syscall_nanosleep	.symtab	0x800109d8	114	FUNC	<unknown>	DEFAULT	2
__syscall_open	.symtab	0x80009ca0	140	FUNC	<unknown>	DEFAULT	2
__syscall_poll	.symtab	0x80018098	130	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction	.symtab	0x80015254	138	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_select	.symtab	0x80009dfc	148	FUNC	<unknown>	DEFAULT	2
__syscall_wait4	.symtab	0x80010b70	136	FUNC	<unknown>	DEFAULT	2
__uClibc_fini	.symtab	0x80010090	106	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x8001019a	124	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x80010216	802	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x80022980	4	OBJECT	<unknown>	HIDDEN	9
__vfork	.symtab	0x80010708	38	FUNC	<unknown>	HIDDEN	2
__xpg_strerror_r	.symtab	0x8000c8c0	266	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__xstat32_conv	.symtab	0x800155f4	322	FUNC	<unknown>	HIDDEN	2
__xstat64_conv	.symtab	0x8001548c	360	FUNC	<unknown>	HIDDEN	2
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_bss_custom_printf_spec	.symtab	0x800289d8	10	OBJECT	<unknown>	DEFAULT	10
_charpad	.symtab	0x8000a368	74	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_custom_printf_arginfo	.symtab	0x80028c14	40	OBJECT	<unknown>	HIDDEN	10
_custom_printf_handler	.symtab	0x80028c3c	40	OBJECT	<unknown>	HIDDEN	10
_custom_printf_spec	.symtab	0x80022888	4	OBJECT	<unknown>	HIDDEN	9
_dl_aux_init	.symtab	0x800151e8	44	FUNC	<unknown>	DEFAULT	2
_dl_phdr	.symtab	0x80028fe4	4	OBJECT	<unknown>	DEFAULT	10
_dl_phnum	.symtab	0x80028fe8	4	OBJECT	<unknown>	DEFAULT	10
_do_one_spec	.symtab	0x8000a45a	2310	FUNC	<unknown>	DEFAULT	2
_edata	.symtab	0x8002299c	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x80029000	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_errno	.symtab	0x80028be0	4	OBJECT	<unknown>	DEFAULT	10
_exit	.symtab	0x800098ac	92	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x80018c24	0	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x800269d8	8192	OBJECT	<unknown>	DEFAULT	10
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x8000a3b2	168	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x80012630	2482	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_h_errno	.symtab	0x80028be4	4	OBJECT	<unknown>	DEFAULT	10
_init	.symtab	0x80000094	0	FUNC	<unknown>	DEFAULT	1
_is_equal_or_bigger_arg	.symtab	0x8000b364	102	FUNC	<unknown>	DEFAULT	2
_load_inttype	.symtab	0x80012324	238	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_mmap	.symtab	0x800108c0	98	FUNC	<unknown>	DEFAULT	2
_ppfs_init	.symtab	0x8000aef4	208	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x8000b3ca	1822	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x8000afc4	108	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x8000b030	736	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x8000b310	84	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x8001006e	34	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x80010054	26	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_sigintr	.symtab	0x80028c64	8	OBJECT	<unknown>	HIDDEN	10
_start	.symtab	0x80000144	0	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x80011b8c	1008	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x8000a180	90	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x80022760	4	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_add_lock	.symtab	0x80022764	24	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_dec_use	.symtab	0x8001319c	346	FUNC	<unknown>	HIDDEN	2
_stdio_openlist_del_count	.symtab	0x800269d4	4	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_del_lock	.symtab	0x8002277c	24	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_use_count	.symtab	0x800269d0	4	OBJECT	<unknown>	DEFAULT	10
_stdio_streams	.symtab	0x80022798	240	OBJECT	<unknown>	DEFAULT	9
_stdio_term	.symtab	0x8000a1fa	248	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x80022794	4	OBJECT	<unknown>	DEFAULT	9
_stdlib_strto_l	.symtab	0x8000f100	568	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x80012414	96	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x8001f601	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x80012474	442	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x8000ad60	404	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wordcopy_bwd_aligned	.symtab	0x80013948	638	FUNC	<unknown>	DEFAULT	2
_wordcopy_bwd_dest_aligned	.symtab	0x80013bc6	578	FUNC	<unknown>	DEFAULT	2
_wordcopy_fwd_aligned	.symtab	0x8000bbdc	566	FUNC	<unknown>	DEFAULT	2
_wordcopy_fwd_dest_aligned	.symtab	0x8000be12	500	FUNC	<unknown>	DEFAULT	2
abort	.symtab	0x8000e790	376	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
access	.symtab	0x80009908	112	FUNC	<unknown>	DEFAULT	2
access.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
astd	.symtab	0x80003348	274	FUNC	<unknown>	DEFAULT	2
atcp	.symtab	0x80002ec6	1154	FUNC	<unknown>	DEFAULT	2
atoi	.symtab	0x8000f0c0	28	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x8000f0c0	28	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
audp	.symtab	0x80002a82	1092	FUNC	<unknown>	DEFAULT	2
bb_get_chunk_with_continuation	.symtab	0x800111fe	496	FUNC	<unknown>	DEFAULT	2
bcopy	.symtab	0x8000c9cc	30	FUNC	<unknown>	DEFAULT	2
bcopy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
been_there_done_that	.symtab	0x80028bc4	4	OBJECT	<unknown>	DEFAULT	10
bot.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
brk	.symtab	0x80015214	64	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x8000ce7c	196	FUNC	<unknown>	DEFAULT	2
buf.2903	.symtab	0x800289e8	16	OBJECT	<unknown>	DEFAULT	10
buf.5403	.symtab	0x800289f8	440	OBJECT	<unknown>	DEFAULT	10
bzero	.symtab	0x8000c9ec	28	FUNC	<unknown>	DEFAULT	2
bzero.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
c	.symtab	0x80022734	4	OBJECT	<unknown>	DEFAULT	9
call___do_global_ctors_aux	.symtab	0x80018c1a	0	FUNC	<unknown>	DEFAULT	2
call___do_global_dtors_aux	.symtab	0x800000f6	0	FUNC	<unknown>	DEFAULT	2
call_frame_dummy	.symtab	0x8000013c	0	FUNC	<unknown>	DEFAULT	2
calloc	.symtab	0x80014998	382	FUNC	<unknown>	DEFAULT	2
calloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
chdir	.symtab	0x800099d8	16	FUNC	<unknown>	DEFAULT	2
chdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
clock_getres	.symtab	0x800107a0	116	FUNC	<unknown>	DEFAULT	2
clock_getres.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x800099e8	96	FUNC	<unknown>	DEFAULT	2
close.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
closedir	.symtab	0x80010c18	292	FUNC	<unknown>	DEFAULT	2
closedir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
closenameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
commServer	.symtab	0x80022640	4	OBJECT	<unknown>	DEFAULT	9
completed.4531	.symtab	0x8002299c	1	OBJECT	<unknown>	DEFAULT	10
connect	.symtab	0x8000cca8	48	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connectTimeout	.symtab	0x80000f20	476	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
csum	.symtab	0x8000120c	228	FUNC	<unknown>	DEFAULT	2
currentServer	.symtab	0x80022730	4	OBJECT	<unknown>	DEFAULT	9
data_start	.symtab	0x8002263c	0	NOTYPE	<unknown>	DEFAULT	9
decoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dnslookup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ	.symtab	0x80028bd0	4	OBJECT	<unknown>	DEFAULT	10
errno	.symtab	0x80028be0	4	OBJECT	<unknown>	DEFAULT	10
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execl	.symtab	0x80015134	178	FUNC	<unknown>	DEFAULT	2
execl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execve	.symtab	0x800152e0	128	FUNC	<unknown>	DEFAULT	2
execve.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x8000f338	220	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x80020236	108	OBJECT	<unknown>	DEFAULT	4
fclose	.symtab	0x80011834	476	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x80009650	302	FUNC	<unknown>	DEFAULT	2
fd_to_DIR	.symtab	0x80010d3c	264	FUNC	<unknown>	DEFAULT	2
fdgets	.symtab	0x800003d6	118	FUNC	<unknown>	DEFAULT	2
fdopendir	.symtab	0x80010f50	160	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x800132f6	542	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc	.symtab	0x80012fe4	278	FUNC	<unknown>	DEFAULT	2
fgetc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x80013514	500	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x800130fc	158	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x80013708	226	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fix_errno	.symtab	0x80010720	0	NOTYPE	<unknown>	DEFAULT	2
fmt	.symtab	0x80020222	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x80011a10	38	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0x80009a48	86	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs_unlocked	.symtab	0x8000bae8	80	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x800000fe	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x8000e418	844	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x800159e0	38	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x800159e0	38	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x80015a08	370	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fstat	.symtab	0x80015360	148	FUNC	<unknown>	DEFAULT	2
fstat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ftcp	.symtab	0x8000177e	1154	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked	.symtab	0x8000bb38	162	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getArch	.symtab	0x80006262	16	FUNC	<unknown>	DEFAULT	2
getHost	.symtab	0x80000ca2	56	FUNC	<unknown>	DEFAULT	2
getOurIP	.symtab	0x8000044c	512	FUNC	<unknown>	DEFAULT	2
getPortz	.symtab	0x80006272	150	FUNC	<unknown>	DEFAULT	2
getRandomIP	.symtab	0x8000039e	56	FUNC	<unknown>	DEFAULT	2
get_hosts_byname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getc	.symtab	0x80012fe4	278	FUNC	<unknown>	DEFAULT	2
getc_unlocked	.symtab	0x80013514	500	FUNC	<unknown>	DEFAULT	2
getdents64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdtablesize	.symtab	0x80009aa0	52	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x80010814	30	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x80010834	30	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x80010854	30	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname	.symtab	0x8000cc4c	28	FUNC	<unknown>	DEFAULT	2
gethostbyname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname2	.symtab	0x8000cc68	64	FUNC	<unknown>	DEFAULT	2
gethostbyname2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname2_r	.symtab	0x800145b8	928	FUNC	<unknown>	DEFAULT	2
gethostbyname2_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r	.symtab	0x80017c10	1018	FUNC	<unknown>	DEFAULT	2
gethostbyname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostname	.symtab	0x8001800c	138	FUNC	<unknown>	DEFAULT	2
gethostname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpagesize	.symtab	0x80010874	42	FUNC	<unknown>	DEFAULT	2
getpagesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x80009ad4	28	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x80009af0	126	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockname	.symtab	0x8000ccd8	50	FUNC	<unknown>	DEFAULT	2
getsockname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x8000cd0c	66	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x800108a0	30	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gotIP	.symtab	0x800229bc	4	OBJECT	<unknown>	DEFAULT	10
h_errno	.symtab	0x80028be4	4	OBJECT	<unknown>	DEFAULT	10
have_current_got	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
have_current_got	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
have_current_got	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
hoste.5402	.symtab	0x80028bb0	20	OBJECT	<unknown>	DEFAULT	10
htonl	.symtab	0x8000cb3a	12	FUNC	<unknown>	DEFAULT	2
htons	.symtab	0x8000cb46	22	FUNC	<unknown>	DEFAULT	2
httpattack	.symtab	0x800039f6	1122	FUNC	<unknown>	DEFAULT	2
i.4546	.symtab	0x80022738	4	OBJECT	<unknown>	DEFAULT	9
index	.symtab	0x8000c230	386	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x8000cc1c	48	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x80014440	376	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa	.symtab	0x8000cbfc	30	FUNC	<unknown>	DEFAULT	2
inet_ntoa.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa_r	.symtab	0x8000cb5c	160	FUNC	<unknown>	DEFAULT	2
inet_ntop	.symtab	0x800169d0	112	FUNC	<unknown>	DEFAULT	2
inet_ntop4	.symtab	0x80016550	438	FUNC	<unknown>	DEFAULT	2
inet_ntop6	.symtab	0x80016706	714	FUNC	<unknown>	DEFAULT	2
inet_pton	.symtab	0x800164f0	96	FUNC	<unknown>	DEFAULT	2
inet_pton4	.symtab	0x80016154	284	FUNC	<unknown>	DEFAULT	2
inet_pton6	.symtab	0x80016270	640	FUNC	<unknown>	DEFAULT	2
initConnection	.symtab	0x80008fe4	322	FUNC	<unknown>	DEFAULT	2
init_rand	.symtab	0x800001f6	144	FUNC	<unknown>	DEFAULT	2
initstate	.symtab	0x8000ea0e	136	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x8000ef6a	342	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x80009b70	172	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isatty	.symtab	0x8000ca2c	52	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isspace	.symtab	0x80009fd8	40	FUNC	<unknown>	DEFAULT	2
isspace.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0x80009c8c	20	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
last_id.5482	.symtab	0x8002298c	2	OBJECT	<unknown>	DEFAULT	9
last_ns_num.5481	.symtab	0x80028bec	4	OBJECT	<unknown>	DEFAULT	10
listFork	.symtab	0x800010fc	272	FUNC	<unknown>	DEFAULT	2
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x8001822c	204	FUNC	<unknown>	DEFAULT	2
macAddress	.symtab	0x800229c8	6	OBJECT	<unknown>	DEFAULT	10
main	.symtab	0x80009126	1320	FUNC	<unknown>	DEFAULT	2
mainCommSock	.symtab	0x800229b8	4	OBJECT	<unknown>	DEFAULT	10
makeIPPacket	.symtab	0x800013a8	132	FUNC	<unknown>	DEFAULT	2
makeRandomStr	.symtab	0x80000cda	118	FUNC	<unknown>	DEFAULT	2
makevsepacket	.symtab	0x80001e5a	148	FUNC	<unknown>	DEFAULT	2
malloc	.symtab	0x8000d782	2182	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
malloc_init_state	.symtab	0x8000e008	194	FUNC	<unknown>	DEFAULT	2
malloc_trim	.symtab	0x8000e764	42	FUNC	<unknown>	DEFAULT	2
memchr	.symtab	0x800137ec	348	FUNC	<unknown>	DEFAULT	2
memchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memcpy	.symtab	0x8000c006	240	FUNC	<unknown>	DEFAULT	2
memcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memmove	.symtab	0x80013e08	288	FUNC	<unknown>	DEFAULT	2
memmove.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mempcpy	.symtab	0x80013f28	42	FUNC	<unknown>	DEFAULT	2
mempcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memrchr	.symtab	0x80013f54	358	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x8000c0f8	310	FUNC	<unknown>	DEFAULT	2
memset.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mmap	.symtab	0x80010922	70	FUNC	<unknown>	DEFAULT	2
mmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mremap	.symtab	0x800153f4	150	FUNC	<unknown>	DEFAULT	2
mremap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
munmap	.symtab	0x80010968	112	FUNC	<unknown>	DEFAULT	2
munmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mylock	.symtab	0x800228a4	24	OBJECT	<unknown>	DEFAULT	9
mylock	.symtab	0x800228bc	24	OBJECT	<unknown>	DEFAULT	9
nanosleep	.symtab	0x80010a4a	20	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
next_start.1305	.symtab	0x800289e4	4	OBJECT	<unknown>	DEFAULT	10
nprocessors_conf	.symtab	0x8000f6c0	222	FUNC	<unknown>	DEFAULT	2
nprocessors_onln	.symtab	0x8000f580	320	FUNC	<unknown>	DEFAULT	2
ntohl	.symtab	0x8000cb18	12	FUNC	<unknown>	DEFAULT	2
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0x8000cb24	22	FUNC	<unknown>	DEFAULT	2
ntop.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
numpids	.symtab	0x800229c0	8	OBJECT	<unknown>	DEFAULT	10
object.4546	.symtab	0x8002299e	24	OBJECT	<unknown>	DEFAULT	10
open	.symtab	0x80009d2c	80	FUNC	<unknown>	DEFAULT	2
open.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opendir	.symtab	0x80010e44	268	FUNC	<unknown>	DEFAULT	2
opendir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opennameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ourIP	.symtab	0x80028c0c	4	OBJECT	<unknown>	DEFAULT	10
p.4529	.symtab	0x80022638	0	OBJECT	<unknown>	DEFAULT	9
parse_config.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pids	.symtab	0x80028c10	4	OBJECT	<unknown>	DEFAULT	10
poll	.symtab	0x8001811a	28	FUNC	<unknown>	DEFAULT	2
poll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prefix.4707	.symtab	0x8001f561	12	OBJECT	<unknown>	DEFAULT	4
print	.symtab	0x80000946	692	FUNC	<unknown>	DEFAULT	2
printchar	.symtab	0x800006fa	68	FUNC	<unknown>	DEFAULT	2
printi	.symtab	0x80000814	306	FUNC	<unknown>	DEFAULT	2
prints	.symtab	0x8000073e	214	FUNC	<unknown>	DEFAULT	2
processCmd	.symtab	0x80006308	11406	FUNC	<unknown>	DEFAULT	2
program_invocation_name	.symtab	0x80022988	4	OBJECT	<unknown>	DEFAULT	9
program_invocation_short_name	.symtab	0x80022984	4	OBJECT	<unknown>	DEFAULT	9
qual_chars.4712	.symtab	0x8001f574	20	OBJECT	<unknown>	DEFAULT	4
raise	.symtab	0x80014958	28	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x8000e908	14	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand_cmwc	.symtab	0x80000286	280	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x8000e918	112	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x8002015c	40	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x8000eca8	270	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randtbl	.symtab	0x800228e8	128	OBJECT	<unknown>	DEFAULT	9
rawmemchr	.symtab	0x80015f04	270	FUNC	<unknown>	DEFAULT	2
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read	.symtab	0x80009d7c	128	FUNC	<unknown>	DEFAULT	2
read.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read_etc_hosts_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
readdir64	.symtab	0x80010ff0	330	FUNC	<unknown>	DEFAULT	2
readdir64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
realloc	.symtab	0x80014b18	1562	FUNC	<unknown>	DEFAULT	2
realloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
realrand	.symtab	0x80008f96	78	FUNC	<unknown>	DEFAULT	2
recv	.symtab	0x8000cd50	56	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recvLine	.symtab	0x80000d50	464	FUNC	<unknown>	DEFAULT	2
resolv_conf_mtime.5444	.symtab	0x80028c08	4	OBJECT	<unknown>	DEFAULT	10
rindex	.symtab	0x80014274	112	FUNC	<unknown>	DEFAULT	2
rtcp	.symtab	0x80002716	876	FUNC	<unknown>	DEFAULT	2
sbrk	.symtab	0x80010a60	106	FUNC	<unknown>	DEFAULT	2
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
select	.symtab	0x80009e90	36	FUNC	<unknown>	DEFAULT	2
select.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send	.symtab	0x8000cd88	56	FUNC	<unknown>	DEFAULT	2
send.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sendHLD	.symtab	0x80005d4c	1302	FUNC	<unknown>	DEFAULT	2
sendHTTPtwo	.symtab	0x800035d6	380	FUNC	<unknown>	DEFAULT	2
sendKILLALL	.symtab	0x80004984	636	FUNC	<unknown>	DEFAULT	2
sendPkt	.symtab	0x8000597a	346	FUNC	<unknown>	DEFAULT	2
sendTLS	.symtab	0x80005502	1144	FUNC	<unknown>	DEFAULT	2
senditbudAMP	.symtab	0x8000016c	138	FUNC	<unknown>	DEFAULT	2
sendnfo	.symtab	0x80004d10	272	FUNC	<unknown>	DEFAULT	2
sendto	.symtab	0x8000cdc0	70	FUNC	<unknown>	DEFAULT	2
sendto.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsid	.symtab	0x80009eb4	86	FUNC	<unknown>	DEFAULT	2
setsid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsockopt	.symtab	0x8000ce08	64	FUNC	<unknown>	DEFAULT	2
setsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate	.symtab	0x8000e988	134	FUNC	<unknown>	DEFAULT	2
setstate_r	.symtab	0x8000eb00	424	FUNC	<unknown>	DEFAULT	2
sigaction	.symtab	0x80014974	34	FUNC	<unknown>	DEFAULT	2
sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
signal	.symtab	0x8000ce7c	196	FUNC	<unknown>	DEFAULT	2
signal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigprocmask	.symtab	0x80010acc	162	FUNC	<unknown>	DEFAULT	2
sigprocmask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigsetops.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
skip_and_NUL_space	.symtab	0x800175c4	94	FUNC	<unknown>	DEFAULT	2
skip_nospace	.symtab	0x80017564	96	FUNC	<unknown>	DEFAULT	2
sleep	.symtab	0x8000f414	362	FUNC	<unknown>	DEFAULT	2
sleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
snprintf	.symtab	0x8000a050	52	FUNC	<unknown>	DEFAULT	2
snprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket	.symtab	0x8000ce48	50	FUNC	<unknown>	DEFAULT	2
socket.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket_connect	.symtab	0x80001d6a	240	FUNC	<unknown>	DEFAULT	2
sockprintf	.symtab	0x80000bfa	168	FUNC	<unknown>	DEFAULT	2
spec_and_mask.4711	.symtab	0x8001f588	16	OBJECT	<unknown>	DEFAULT	4
spec_base.4706	.symtab	0x8001f56d	7	OBJECT	<unknown>	DEFAULT	4
spec_chars.4708	.symtab	0x8001f5d6	21	OBJECT	<unknown>	DEFAULT	4
spec_flags.4707	.symtab	0x8001f5eb	8	OBJECT	<unknown>	DEFAULT	4
spec_or_mask.4710	.symtab	0x8001f598	16	OBJECT	<unknown>	DEFAULT	4
spec_ranges.4709	.symtab	0x8001f5a8	9	OBJECT	<unknown>	DEFAULT	4
sprintf	.symtab	0x8000a084	52	FUNC	<unknown>	DEFAULT	2
sprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
srand	.symtab	0x8000ea96	106	FUNC	<unknown>	DEFAULT	2
srandom	.symtab	0x8000ea96	106	FUNC	<unknown>	DEFAULT	2
srandom_r	.symtab	0x8000edb6	436	FUNC	<unknown>	DEFAULT	2
stat	.symtab	0x80018138	148	FUNC	<unknown>	DEFAULT	2
stat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
stderr	.symtab	0x80022754	4	OBJECT	<unknown>	DEFAULT	9
stdhexflood	.symtab	0x800024cc	272	FUNC	<unknown>	DEFAULT	2
stdin	.symtab	0x8002274c	4	OBJECT	<unknown>	DEFAULT	9
stdout	.symtab	0x80022750	4	OBJECT	<unknown>	DEFAULT	9
strcasecmp	.symtab	0x80018a2c	120	FUNC	<unknown>	DEFAULT	2
strcasecmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchr	.symtab	0x8000c230	386	FUNC	<unknown>	DEFAULT	2
strchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchrnul	.symtab	0x800140bc	352	FUNC	<unknown>	DEFAULT	2
strchrnul.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcmp	.symtab	0x8000c3b4	110	FUNC	<unknown>	DEFAULT	2
strcmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcoll	.symtab	0x8000c3b4	110	FUNC	<unknown>	DEFAULT	2
strcpy	.symtab	0x8000c424	52	FUNC	<unknown>	DEFAULT	2
strcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcspn	.symtab	0x8001421c	86	FUNC	<unknown>	DEFAULT	2
strcspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strdup	.symtab	0x800182f8	80	FUNC	<unknown>	DEFAULT	2
strdup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strerror_r	.symtab	0x8000c8c0	266	FUNC	<unknown>	DEFAULT	2
strlen	.symtab	0x8000c458	264	FUNC	<unknown>	DEFAULT	2
strlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncpy	.symtab	0x80016014	320	FUNC	<unknown>	DEFAULT	2
strncpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strnlen	.symtab	0x8000c560	342	FUNC	<unknown>	DEFAULT	2
strnlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strpbrk	.symtab	0x800143e8	86	FUNC	<unknown>	DEFAULT	2
strpbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strrchr	.symtab	0x80014274	112	FUNC	<unknown>	DEFAULT	2
strrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strspn	.symtab	0x800142e4	104	FUNC	<unknown>	DEFAULT	2
strspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strstr	.symtab	0x8000c6b8	484	FUNC	<unknown>	DEFAULT	2
strstr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok	.symtab	0x8000ca08	36	FUNC	<unknown>	DEFAULT	2
strtok.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok_r	.symtab	0x8001434c	154	FUNC	<unknown>	DEFAULT	2
strtok_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtol	.symtab	0x8000f0dc	34	FUNC	<unknown>	DEFAULT	2
strtol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sysconf	.symtab	0x8000f79e	2068	FUNC	<unknown>	DEFAULT	2
sysconf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
system	.symtab	0x80010538	464	FUNC	<unknown>	DEFAULT	2
system.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcgetattr	.symtab	0x8000ca60	182	FUNC	<unknown>	DEFAULT	2
tcgetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcpcsum	.symtab	0x800012f0	184	FUNC	<unknown>	DEFAULT	2
time	.symtab	0x80009f0c	38	FUNC	<unknown>	DEFAULT	2
time.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tolower	.symtab	0x80018bb0	64	FUNC	<unknown>	DEFAULT	2
tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
toupper	.symtab	0x8000a000	64	FUNC	<unknown>	DEFAULT	2
toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
trim	.symtab	0x8000064c	174	FUNC	<unknown>	DEFAULT	2
type_codes	.symtab	0x8001f5b2	24	OBJECT	<unknown>	DEFAULT	4
type_sizes	.symtab	0x8001f5ca	12	OBJECT	<unknown>	DEFAULT	4
uname	.symtab	0x800181cc	96	FUNC	<unknown>	DEFAULT	2
uname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
unknown.1327	.symtab	0x8001f5f3	14	OBJECT	<unknown>	DEFAULT	4
unsafe_state	.symtab	0x800228d4	20	OBJECT	<unknown>	DEFAULT	9
useragents	.symtab	0x80022644	236	OBJECT	<unknown>	DEFAULT	9
usleep	.symtab	0x8000ffb4	140	FUNC	<unknown>	DEFAULT	2
usleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
vfork	.symtab	0x80010708	38	FUNC	<unknown>	DEFAULT	2
vseattack	.symtab	0x80001eee	1238	FUNC	<unknown>	DEFAULT	2
vsnprintf	.symtab	0x8000a0b8	198	FUNC	<unknown>	DEFAULT	2
vsnprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wait4	.symtab	0x80010bf8	32	FUNC	<unknown>	DEFAULT	2
wait4.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
waitpid	.symtab	0x80009f34	34	FUNC	<unknown>	DEFAULT	2
waitpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcrtomb	.symtab	0x800116d8	100	FUNC	<unknown>	DEFAULT	2
wcrtomb.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsnrtombs	.symtab	0x80011764	206	FUNC	<unknown>	DEFAULT	2
wcsnrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsrtombs	.symtab	0x8001173c	38	FUNC	<unknown>	DEFAULT	2
wcsrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
write	.symtab	0x80009f58	128	FUNC	<unknown>	DEFAULT	2
write.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
xdigits.3400	.symtab	0x800202a5	17	OBJECT	<unknown>	DEFAULT	4
xstatconv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
xtdcustom	.symtab	0x80004f92	272	FUNC	<unknown>	DEFAULT	2

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-08T21:02:55.496251+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56324	162.215.219.170	4444	TCP
2024-10-08T21:02:57.133263+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56326	162.215.219.170	4444	TCP
2024-10-08T21:02:58.750484+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56328	162.215.219.170	4444	TCP
2024-10-08T21:03:00.307289+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56330	162.215.219.170	4444	TCP
2024-10-08T21:03:01.869068+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56332	162.215.219.170	4444	TCP
2024-10-08T21:03:03.459450+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56334	162.215.219.170	4444	TCP
2024-10-08T21:03:05.047074+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56336	162.215.219.170	4444	TCP
2024-10-08T21:03:06.609585+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56338	162.215.219.170	4444	TCP
2024-10-08T21:03:08.213150+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56340	162.215.219.170	4444	TCP
2024-10-08T21:03:09.815142+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56342	162.215.219.170	4444	TCP
2024-10-08T21:03:12.174568+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56344	162.215.219.170	4444	TCP
2024-10-08T21:03:13.744182+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56346	162.215.219.170	4444	TCP
2024-10-08T21:03:15.310811+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56348	162.215.219.170	4444	TCP
2024-10-08T21:03:16.890301+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56350	162.215.219.170	4444	TCP
2024-10-08T21:03:18.449612+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56352	162.215.219.170	4444	TCP
2024-10-08T21:03:20.027584+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56354	162.215.219.170	4444	TCP
2024-10-08T21:03:21.651811+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56356	162.215.219.170	4444	TCP
2024-10-08T21:03:23.230448+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56358	162.215.219.170	4444	TCP
2024-10-08T21:03:24.790378+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56360	162.215.219.170	4444	TCP
2024-10-08T21:03:26.394930+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56362	162.215.219.170	4444	TCP
2024-10-08T21:03:28.073034+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56364	162.215.219.170	4444	TCP
2024-10-08T21:03:29.650706+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56366	162.215.219.170	4444	TCP
2024-10-08T21:03:31.266481+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56368	162.215.219.170	4444	TCP
2024-10-08T21:03:32.822322+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56370	162.215.219.170	4444	TCP
2024-10-08T21:03:34.428274+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56372	162.215.219.170	4444	TCP
2024-10-08T21:03:36.013962+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56374	162.215.219.170	4444	TCP
2024-10-08T21:03:37.587942+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56376	162.215.219.170	4444	TCP
2024-10-08T21:03:39.170441+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56378	162.215.219.170	4444	TCP
2024-10-08T21:03:40.990596+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56380	162.215.219.170	4444	TCP
2024-10-08T21:03:42.578532+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56382	162.215.219.170	4444	TCP
2024-10-08T21:03:44.154835+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56384	162.215.219.170	4444	TCP
2024-10-08T21:03:45.715475+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56386	162.215.219.170	4444	TCP
2024-10-08T21:03:47.276276+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56388	162.215.219.170	4444	TCP
2024-10-08T21:03:48.977379+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56390	162.215.219.170	4444	TCP
2024-10-08T21:03:50.556767+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56392	162.215.219.170	4444	TCP
2024-10-08T21:03:52.123294+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56394	162.215.219.170	4444	TCP
2024-10-08T21:03:53.699098+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56396	162.215.219.170	4444	TCP
2024-10-08T21:03:55.264748+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56398	162.215.219.170	4444	TCP
2024-10-08T21:03:56.823032+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56400	162.215.219.170	4444	TCP
2024-10-08T21:03:58.390868+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56402	162.215.219.170	4444	TCP
2024-10-08T21:03:59.983286+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56404	162.215.219.170	4444	TCP
2024-10-08T21:04:01.574888+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56406	162.215.219.170	4444	TCP
2024-10-08T21:04:03.152793+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56408	162.215.219.170	4444	TCP
2024-10-08T21:04:05.032002+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56410	162.215.219.170	4444	TCP
2024-10-08T21:04:06.891876+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56412	162.215.219.170	4444	TCP
2024-10-08T21:04:08.467941+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56414	162.215.219.170	4444	TCP
2024-10-08T21:04:10.037572+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56416	162.215.219.170	4444	TCP
2024-10-08T21:04:11.621167+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56418	162.215.219.170	4444	TCP
2024-10-08T21:04:13.199113+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56420	162.215.219.170	4444	TCP
2024-10-08T21:04:14.763026+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56422	162.215.219.170	4444	TCP
2024-10-08T21:04:16.342184+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56424	162.215.219.170	4444	TCP
2024-10-08T21:04:17.907327+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56426	162.215.219.170	4444	TCP
2024-10-08T21:04:19.481167+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56428	162.215.219.170	4444	TCP
2024-10-08T21:04:21.058759+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56430	162.215.219.170	4444	TCP
2024-10-08T21:04:22.699778+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56432	162.215.219.170	4444	TCP
2024-10-08T21:04:24.443999+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56434	162.215.219.170	4444	TCP
2024-10-08T21:04:26.033678+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56436	162.215.219.170	4444	TCP
2024-10-08T21:04:27.592962+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56438	162.215.219.170	4444	TCP
2024-10-08T21:04:29.174133+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56440	162.215.219.170	4444	TCP
2024-10-08T21:04:30.749528+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56442	162.215.219.170	4444	TCP
2024-10-08T21:04:32.324648+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56444	162.215.219.170	4444	TCP
2024-10-08T21:04:33.885884+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56446	162.215.219.170	4444	TCP
2024-10-08T21:04:35.466799+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56448	162.215.219.170	4444	TCP
2024-10-08T21:04:37.086918+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56450	162.215.219.170	4444	TCP
2024-10-08T21:04:38.661671+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56452	162.215.219.170	4444	TCP
2024-10-08T21:04:40.498602+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56454	162.215.219.170	4444	TCP
2024-10-08T21:04:42.058667+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56456	162.215.219.170	4444	TCP
2024-10-08T21:04:43.620029+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56458	162.215.219.170	4444	TCP
2024-10-08T21:04:45.607139+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56460	162.215.219.170	4444	TCP
2024-10-08T21:04:47.168454+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56462	162.215.219.170	4444	TCP
2024-10-08T21:04:48.783836+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56464	162.215.219.170	4444	TCP
2024-10-08T21:04:50.354735+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56466	162.215.219.170	4444	TCP
2024-10-08T21:04:51.933731+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56468	162.215.219.170	4444	TCP
2024-10-08T21:04:53.518474+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56470	162.215.219.170	4444	TCP
2024-10-08T21:04:55.089872+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56472	162.215.219.170	4444	TCP
2024-10-08T21:04:56.874437+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56474	162.215.219.170	4444	TCP
2024-10-08T21:04:58.440397+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56476	162.215.219.170	4444	TCP
2024-10-08T21:05:00.015177+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56478	162.215.219.170	4444	TCP
2024-10-08T21:05:01.592493+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56480	162.215.219.170	4444	TCP
2024-10-08T21:05:03.189175+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56482	162.215.219.170	4444	TCP
2024-10-08T21:05:04.744880+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56484	162.215.219.170	4444	TCP
2024-10-08T21:05:06.307963+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56486	162.215.219.170	4444	TCP
2024-10-08T21:05:07.874388+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56488	162.215.219.170	4444	TCP
2024-10-08T21:05:10.172384+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56490	162.215.219.170	4444	TCP
2024-10-08T21:05:11.767581+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56492	162.215.219.170	4444	TCP
2024-10-08T21:05:13.343575+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56494	162.215.219.170	4444	TCP
2024-10-08T21:05:14.901912+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56496	162.215.219.170	4444	TCP
2024-10-08T21:05:16.464306+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56498	162.215.219.170	4444	TCP
2024-10-08T21:05:18.029861+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56500	162.215.219.170	4444	TCP
2024-10-08T21:05:19.590108+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56502	162.215.219.170	4444	TCP
2024-10-08T21:05:21.169210+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56504	162.215.219.170	4444	TCP
2024-10-08T21:05:22.732201+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56506	162.215.219.170	4444	TCP
2024-10-08T21:05:24.292634+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56508	162.215.219.170	4444	TCP
2024-10-08T21:05:25.888017+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56510	162.215.219.170	4444	TCP
2024-10-08T21:05:27.475324+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56512	162.215.219.170	4444	TCP
2024-10-08T21:05:29.030061+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56514	162.215.219.170	4444	TCP
2024-10-08T21:05:30.592685+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56516	162.215.219.170	4444	TCP
2024-10-08T21:05:32.173091+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56518	162.215.219.170	4444	TCP
2024-10-08T21:05:33.745314+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56520	162.215.219.170	4444	TCP
2024-10-08T21:05:35.325528+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56522	162.215.219.170	4444	TCP
2024-10-08T21:05:36.929133+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56524	162.215.219.170	4444	TCP
2024-10-08T21:05:38.482068+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56526	162.215.219.170	4444	TCP
2024-10-08T21:05:40.061892+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56528	162.215.219.170	4444	TCP
2024-10-08T21:05:41.621012+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56530	162.215.219.170	4444	TCP
2024-10-08T21:05:43.204572+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56532	162.215.219.170	4444	TCP
2024-10-08T21:05:44.902140+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56534	162.215.219.170	4444	TCP
2024-10-08T21:05:46.467812+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56536	162.215.219.170	4444	TCP
2024-10-08T21:05:48.044567+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56538	162.215.219.170	4444	TCP
2024-10-08T21:05:49.698287+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56540	162.215.219.170	4444	TCP
2024-10-08T21:05:51.282942+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56542	162.215.219.170	4444	TCP
2024-10-08T21:05:52.873112+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56544	162.215.219.170	4444	TCP
2024-10-08T21:05:54.435635+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56546	162.215.219.170	4444	TCP
2024-10-08T21:05:55.998121+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56548	162.215.219.170	4444	TCP
2024-10-08T21:05:57.582031+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56550	162.215.219.170	4444	TCP
2024-10-08T21:05:59.313797+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56552	162.215.219.170	4444	TCP
2024-10-08T21:06:00.903794+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56554	162.215.219.170	4444	TCP
2024-10-08T21:06:02.547280+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56556	162.215.219.170	4444	TCP
2024-10-08T21:06:04.109055+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56558	162.215.219.170	4444	TCP
2024-10-08T21:06:05.677403+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56560	162.215.219.170	4444	TCP
2024-10-08T21:06:07.262927+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56562	162.215.219.170	4444	TCP
2024-10-08T21:06:08.826727+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56564	162.215.219.170	4444	TCP
2024-10-08T21:06:10.404941+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56566	162.215.219.170	4444	TCP
2024-10-08T21:06:11.983104+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56568	162.215.219.170	4444	TCP
2024-10-08T21:06:13.544361+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56570	162.215.219.170	4444	TCP
2024-10-08T21:06:15.106366+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56572	162.215.219.170	4444	TCP
2024-10-08T21:06:16.672046+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56574	162.215.219.170	4444	TCP
2024-10-08T21:06:18.251359+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56576	162.215.219.170	4444	TCP
2024-10-08T21:06:20.110593+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56578	162.215.219.170	4444	TCP
2024-10-08T21:06:21.742804+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56580	162.215.219.170	4444	TCP
2024-10-08T21:06:23.380759+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56582	162.215.219.170	4444	TCP
2024-10-08T21:06:24.982569+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56584	162.215.219.170	4444	TCP
2024-10-08T21:06:26.543199+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56586	162.215.219.170	4444	TCP
2024-10-08T21:06:28.140657+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56588	162.215.219.170	4444	TCP
2024-10-08T21:06:29.700361+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56590	162.215.219.170	4444	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 21:02:55.290189028 CEST	56324	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:02:55.494097948 CEST	4444	56324	162.215.219.170	192.168.2.23
Oct 8, 2024 21:02:55.494193077 CEST	56324	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:02:55.496251106 CEST	56324	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:02:55.501104116 CEST	4444	56324	162.215.219.170	192.168.2.23
Oct 8, 2024 21:02:57.126862049 CEST	4444	56324	162.215.219.170	192.168.2.23
Oct 8, 2024 21:02:57.127309084 CEST	56324	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:02:57.127810001 CEST	56326	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:02:57.132427931 CEST	4444	56324	162.215.219.170	192.168.2.23
Oct 8, 2024 21:02:57.132961035 CEST	4444	56326	162.215.219.170	192.168.2.23
Oct 8, 2024 21:02:57.133011103 CEST	56326	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:02:57.133263111 CEST	56326	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:02:57.139487982 CEST	4444	56326	162.215.219.170	192.168.2.23
Oct 8, 2024 21:02:57.765827894 CEST	42836	443	192.168.2.23	91.189.91.43
Oct 8, 2024 21:02:58.533638000 CEST	42516	80	192.168.2.23	109.202.202.202
Oct 8, 2024 21:02:58.742927074 CEST	4444	56326	162.215.219.170	192.168.2.23
Oct 8, 2024 21:02:58.743474007 CEST	56326	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:02:58.745210886 CEST	56328	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:02:58.748644114 CEST	4444	56326	162.215.219.170	192.168.2.23
Oct 8, 2024 21:02:58.750286102 CEST	4444	56328	162.215.219.170	192.168.2.23
Oct 8, 2024 21:02:58.750385046 CEST	56328	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:02:58.750483990 CEST	56328	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:02:58.756081104 CEST	4444	56328	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:00.300008059 CEST	4444	56328	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:00.300575972 CEST	56328	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:00.301944017 CEST	56330	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:00.305826902 CEST	4444	56328	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:00.307168007 CEST	4444	56330	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:00.307245016 CEST	56330	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:00.307288885 CEST	56330	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:00.312740088 CEST	4444	56330	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:01.862720013 CEST	4444	56330	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:01.862968922 CEST	56330	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:01.863811970 CEST	56332	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:01.868390083 CEST	4444	56330	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:01.868895054 CEST	4444	56332	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:01.868990898 CEST	56332	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:01.869067907 CEST	56332	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:01.874243975 CEST	4444	56332	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:03.449686050 CEST	4444	56332	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:03.449919939 CEST	56332	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:03.450504065 CEST	56334	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:03.458636999 CEST	4444	56332	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:03.459307909 CEST	4444	56334	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:03.459382057 CEST	56334	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:03.459450006 CEST	56334	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:03.470457077 CEST	4444	56334	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:05.039798975 CEST	4444	56334	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:05.040368080 CEST	56334	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:05.041348934 CEST	56336	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:05.045489073 CEST	4444	56334	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:05.046853065 CEST	4444	56336	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:05.046984911 CEST	56336	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:05.047074080 CEST	56336	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:05.052464008 CEST	4444	56336	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:06.602351904 CEST	4444	56336	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:06.602684021 CEST	56336	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:06.603255033 CEST	56338	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:06.609376907 CEST	4444	56336	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:06.609412909 CEST	4444	56338	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:06.609505892 CEST	56338	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:06.609585047 CEST	56338	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:06.615957022 CEST	4444	56338	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:08.206485033 CEST	4444	56338	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:08.207099915 CEST	56338	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:08.207840919 CEST	56340	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:08.212130070 CEST	4444	56338	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:08.212968111 CEST	4444	56340	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:08.213068008 CEST	56340	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:08.213150024 CEST	56340	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:08.218358040 CEST	4444	56340	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:09.807096004 CEST	4444	56340	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:09.807504892 CEST	56340	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:09.809633970 CEST	56342	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:09.812720060 CEST	4444	56340	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:09.814798117 CEST	4444	56342	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:09.814902067 CEST	56342	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:09.815141916 CEST	56342	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:09.820328951 CEST	4444	56342	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:12.164200068 CEST	4444	56342	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:12.164757013 CEST	56342	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:12.165218115 CEST	4444	56342	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:12.165297985 CEST	56342	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:12.165453911 CEST	4444	56342	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:12.165520906 CEST	56342	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:12.165734053 CEST	56344	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:12.169806004 CEST	4444	56342	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:12.174350023 CEST	4444	56344	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:12.174447060 CEST	56344	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:12.174567938 CEST	56344	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:12.180723906 CEST	4444	56344	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:12.611860991 CEST	43928	443	192.168.2.23	91.189.91.42
Oct 8, 2024 21:03:13.737169027 CEST	4444	56344	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:13.737823963 CEST	56344	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:13.738780022 CEST	56346	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:13.742866993 CEST	4444	56344	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:13.743916988 CEST	4444	56346	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:13.744060040 CEST	56346	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:13.744182110 CEST	56346	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:13.749497890 CEST	4444	56346	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:15.303926945 CEST	4444	56346	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:15.304413080 CEST	56346	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:15.305422068 CEST	56348	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:15.309499025 CEST	4444	56346	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:15.310632944 CEST	4444	56348	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:15.310700893 CEST	56348	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:15.310811043 CEST	56348	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:15.315956116 CEST	4444	56348	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:16.883421898 CEST	4444	56348	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:16.883902073 CEST	56348	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:16.885057926 CEST	56350	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:16.888988018 CEST	4444	56348	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:16.890073061 CEST	4444	56350	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:16.890153885 CEST	56350	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:16.890300989 CEST	56350	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:16.895592928 CEST	4444	56350	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:18.442584991 CEST	4444	56350	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:18.442800999 CEST	56350	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:18.444000959 CEST	56352	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:18.447827101 CEST	4444	56350	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:18.449489117 CEST	4444	56352	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:18.449553013 CEST	56352	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:18.449611902 CEST	56352	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:18.454953909 CEST	4444	56352	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:20.020689964 CEST	4444	56352	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:20.021111965 CEST	56352	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:20.021883965 CEST	56354	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:20.026077032 CEST	4444	56352	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:20.027050018 CEST	4444	56354	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:20.027488947 CEST	56354	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:20.027584076 CEST	56354	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:20.032629967 CEST	4444	56354	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:21.643676043 CEST	4444	56354	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:21.644016027 CEST	56354	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:21.644901991 CEST	56356	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:21.651524067 CEST	4444	56354	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:21.651618004 CEST	4444	56356	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:21.651690960 CEST	56356	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:21.651810884 CEST	56356	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:21.657516003 CEST	4444	56356	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:23.224215984 CEST	4444	56356	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:23.224509001 CEST	56356	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:23.225269079 CEST	56358	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:23.229782104 CEST	4444	56356	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:23.230274916 CEST	4444	56358	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:23.230411053 CEST	56358	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:23.230448008 CEST	56358	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:23.235495090 CEST	4444	56358	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:24.784154892 CEST	4444	56358	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:24.784360886 CEST	56358	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:24.785173893 CEST	56360	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:24.789551020 CEST	4444	56358	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:24.790213108 CEST	4444	56360	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:24.790297031 CEST	56360	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:24.790378094 CEST	56360	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:24.795485973 CEST	4444	56360	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:24.898103952 CEST	42836	443	192.168.2.23	91.189.91.43
Oct 8, 2024 21:03:26.388710976 CEST	4444	56360	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:26.388883114 CEST	56360	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:26.389766932 CEST	56362	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:26.394134045 CEST	4444	56360	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:26.394814968 CEST	4444	56362	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:26.394881010 CEST	56362	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:26.394929886 CEST	56362	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:26.400002956 CEST	4444	56362	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:28.066839933 CEST	4444	56362	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:28.067122936 CEST	56362	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:28.067862034 CEST	56364	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:28.072093964 CEST	4444	56362	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:28.072824955 CEST	4444	56364	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:28.072904110 CEST	56364	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:28.073034048 CEST	56364	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:28.078227043 CEST	4444	56364	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:28.993554115 CEST	42516	80	192.168.2.23	109.202.202.202
Oct 8, 2024 21:03:29.643333912 CEST	4444	56364	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:29.643771887 CEST	56364	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:29.645307064 CEST	56366	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:29.648782969 CEST	4444	56364	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:29.650429964 CEST	4444	56366	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:29.650706053 CEST	56366	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:29.650706053 CEST	56366	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:29.655601025 CEST	4444	56366	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:31.259409904 CEST	4444	56366	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:31.260113001 CEST	56366	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:31.261253119 CEST	56368	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:31.265228987 CEST	4444	56366	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:31.266213894 CEST	4444	56368	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:31.266479969 CEST	56368	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:31.266480923 CEST	56368	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:31.272006035 CEST	4444	56368	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:32.815763950 CEST	4444	56368	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:32.816164017 CEST	56368	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:32.817044020 CEST	56370	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:32.821337938 CEST	4444	56368	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:32.822123051 CEST	4444	56370	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:32.822269917 CEST	56370	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:32.822321892 CEST	56370	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:32.827289104 CEST	4444	56370	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:34.421474934 CEST	4444	56370	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:34.421839952 CEST	56370	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:34.423042059 CEST	56372	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:34.426934958 CEST	4444	56370	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:34.428087950 CEST	4444	56372	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:34.428164959 CEST	56372	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:34.428273916 CEST	56372	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:34.434109926 CEST	4444	56372	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:36.006973982 CEST	4444	56372	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:36.007285118 CEST	56372	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:36.008254051 CEST	56374	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:36.012406111 CEST	4444	56372	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:36.013765097 CEST	4444	56374	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:36.013866901 CEST	56374	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:36.013962030 CEST	56374	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:36.019223928 CEST	4444	56374	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:37.581361055 CEST	4444	56374	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:37.581659079 CEST	56374	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:37.582604885 CEST	56376	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:37.586631060 CEST	4444	56374	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:37.587722063 CEST	4444	56376	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:37.587941885 CEST	56376	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:37.587941885 CEST	56376	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:37.592890024 CEST	4444	56376	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:39.163856983 CEST	4444	56376	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:39.164324045 CEST	56376	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:39.165159941 CEST	56378	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:39.169239044 CEST	4444	56376	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:39.170234919 CEST	4444	56378	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:39.170344114 CEST	56378	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:39.170440912 CEST	56378	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:39.175352097 CEST	4444	56378	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:40.979938030 CEST	4444	56378	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:40.980118036 CEST	56378	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:40.981276989 CEST	56380	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:40.988522053 CEST	4444	56378	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:40.988594055 CEST	56378	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:40.990365028 CEST	4444	56378	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:40.990438938 CEST	4444	56380	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:40.990562916 CEST	56380	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:40.990596056 CEST	56380	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:40.996352911 CEST	4444	56380	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:42.571521997 CEST	4444	56380	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:42.571971893 CEST	56380	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:42.573147058 CEST	56382	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:42.576838970 CEST	4444	56380	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:42.578339100 CEST	4444	56382	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:42.578448057 CEST	56382	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:42.578531981 CEST	56382	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:42.583570004 CEST	4444	56382	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:44.147831917 CEST	4444	56382	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:44.148255110 CEST	56382	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:44.149432898 CEST	56384	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:44.153585911 CEST	4444	56382	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:44.154632092 CEST	4444	56384	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:44.154711962 CEST	56384	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:44.154834986 CEST	56384	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:44.160492897 CEST	4444	56384	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:45.708931923 CEST	4444	56384	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:45.709182978 CEST	56384	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:45.710104942 CEST	56386	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:45.714440107 CEST	4444	56384	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:45.715280056 CEST	4444	56386	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:45.715367079 CEST	56386	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:45.715475082 CEST	56386	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:45.720895052 CEST	4444	56386	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:47.269011974 CEST	4444	56386	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:47.269279957 CEST	56386	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:47.270147085 CEST	56388	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:47.274167061 CEST	4444	56386	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:47.276101112 CEST	4444	56388	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:47.276184082 CEST	56388	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:47.276276112 CEST	56388	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:47.281915903 CEST	4444	56388	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:48.970891953 CEST	4444	56388	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:48.971148968 CEST	56388	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:48.971942902 CEST	56390	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:48.976406097 CEST	4444	56388	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:48.977171898 CEST	4444	56390	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:48.977250099 CEST	56390	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:48.977379084 CEST	56390	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:48.982606888 CEST	4444	56390	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:50.550220966 CEST	4444	56390	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:50.550489902 CEST	56390	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:50.551320076 CEST	56392	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:50.555484056 CEST	4444	56390	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:50.556581020 CEST	4444	56392	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:50.556668997 CEST	56392	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:50.556766987 CEST	56392	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:50.561682940 CEST	4444	56392	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:52.116935015 CEST	4444	56392	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:52.117177963 CEST	56392	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:52.118036985 CEST	56394	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:52.122118950 CEST	4444	56392	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:52.123102903 CEST	4444	56394	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:52.123173952 CEST	56394	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:52.123294115 CEST	56394	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:52.128279924 CEST	4444	56394	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:53.566082001 CEST	43928	443	192.168.2.23	91.189.91.42
Oct 8, 2024 21:03:53.692641973 CEST	4444	56394	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:53.692842007 CEST	56394	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:53.693778038 CEST	56396	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:53.698051929 CEST	4444	56394	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:53.698931932 CEST	4444	56396	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:53.698998928 CEST	56396	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:53.699098110 CEST	56396	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:53.704042912 CEST	4444	56396	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:55.257344007 CEST	4444	56396	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:55.257600069 CEST	56396	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:55.259001017 CEST	56398	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:55.262940884 CEST	4444	56396	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:55.264576912 CEST	4444	56398	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:55.264647961 CEST	56398	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:55.264748096 CEST	56398	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:55.269674063 CEST	4444	56398	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:56.815835953 CEST	4444	56398	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:56.816452980 CEST	56398	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:56.817478895 CEST	56400	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:56.822146893 CEST	4444	56398	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:56.822376013 CEST	4444	56400	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:56.822727919 CEST	56400	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:56.823031902 CEST	56400	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:56.828181028 CEST	4444	56400	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:58.384825945 CEST	4444	56400	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:58.385155916 CEST	56400	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:58.385632038 CEST	56402	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:58.390674114 CEST	4444	56400	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:58.390769958 CEST	4444	56402	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:58.390831947 CEST	56402	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:58.390867949 CEST	56402	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:58.396145105 CEST	4444	56402	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:59.976927996 CEST	4444	56402	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:59.977128983 CEST	56402	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:59.977574110 CEST	56404	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:59.982251883 CEST	4444	56402	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:59.983062029 CEST	4444	56404	162.215.219.170	192.168.2.23
Oct 8, 2024 21:03:59.983143091 CEST	56404	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:59.983285904 CEST	56404	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:03:59.988462925 CEST	4444	56404	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:01.568603992 CEST	4444	56404	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:01.568803072 CEST	56404	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:01.569591045 CEST	56406	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:01.573947906 CEST	4444	56404	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:01.574752092 CEST	4444	56406	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:01.574845076 CEST	56406	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:01.574887991 CEST	56406	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:01.582103968 CEST	4444	56406	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:03.146209955 CEST	4444	56406	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:03.146488905 CEST	56406	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:03.147432089 CEST	56408	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:03.151706934 CEST	4444	56406	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:03.152575970 CEST	4444	56408	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:03.152671099 CEST	56408	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:03.152792931 CEST	56408	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:03.157795906 CEST	4444	56408	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:05.024004936 CEST	4444	56408	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:05.024363995 CEST	56408	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:05.024759054 CEST	4444	56408	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:05.024811983 CEST	56408	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:05.026442051 CEST	56410	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:05.030114889 CEST	4444	56408	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:05.031775951 CEST	4444	56410	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:05.031888008 CEST	56410	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:05.032001972 CEST	56410	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:05.037061930 CEST	4444	56410	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:06.598408937 CEST	4444	56410	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:06.598858118 CEST	56410	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:06.599302053 CEST	56412	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:06.808247089 CEST	56410	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:06.890336990 CEST	4444	56410	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:06.890577078 CEST	56410	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:06.891587973 CEST	4444	56410	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:06.891652107 CEST	4444	56412	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:06.891695976 CEST	4444	56410	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:06.891777992 CEST	56410	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:06.891804934 CEST	56412	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:06.891875982 CEST	56412	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:06.897321939 CEST	4444	56412	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:08.460596085 CEST	4444	56412	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:08.461035013 CEST	56412	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:08.461999893 CEST	56414	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:08.466263056 CEST	4444	56412	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:08.467696905 CEST	4444	56414	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:08.467818022 CEST	56414	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:08.467941046 CEST	56414	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:08.472958088 CEST	4444	56414	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:10.030544043 CEST	4444	56414	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:10.031052113 CEST	56414	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:10.032099009 CEST	56416	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:10.037266016 CEST	4444	56414	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:10.037370920 CEST	4444	56416	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:10.037451029 CEST	56416	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:10.037571907 CEST	56416	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:10.043709993 CEST	4444	56416	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:11.613840103 CEST	4444	56416	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:11.614417076 CEST	56416	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:11.615906000 CEST	56418	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:11.619879961 CEST	4444	56416	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:11.620922089 CEST	4444	56418	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:11.621043921 CEST	56418	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:11.621166945 CEST	56418	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:11.626286983 CEST	4444	56418	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:13.192002058 CEST	4444	56418	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:13.192416906 CEST	56418	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:13.193561077 CEST	56420	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:13.197841883 CEST	4444	56418	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:13.198909998 CEST	4444	56420	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:13.198990107 CEST	56420	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:13.199112892 CEST	56420	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:13.205518007 CEST	4444	56420	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:14.754602909 CEST	4444	56420	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:14.755177975 CEST	56420	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:14.757741928 CEST	56422	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:14.760447025 CEST	4444	56420	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:14.762810946 CEST	4444	56422	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:14.762980938 CEST	56422	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:14.763025999 CEST	56422	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:14.767868996 CEST	4444	56422	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:16.336055994 CEST	4444	56422	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:16.336421013 CEST	56422	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:16.337218046 CEST	56424	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:16.341304064 CEST	4444	56422	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:16.342015028 CEST	4444	56424	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:16.342086077 CEST	56424	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:16.342184067 CEST	56424	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:16.346998930 CEST	4444	56424	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:17.899050951 CEST	4444	56424	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:17.899318933 CEST	56424	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:17.900263071 CEST	56426	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:17.904262066 CEST	4444	56424	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:17.907176971 CEST	4444	56426	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:17.907246113 CEST	56426	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:17.907326937 CEST	56426	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:17.913105011 CEST	4444	56426	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:19.473153114 CEST	4444	56426	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:19.473541021 CEST	56426	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:19.474646091 CEST	56428	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:19.479057074 CEST	4444	56426	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:19.480973005 CEST	4444	56428	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:19.481057882 CEST	56428	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:19.481167078 CEST	56428	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:19.487024069 CEST	4444	56428	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:21.052012920 CEST	4444	56428	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:21.052294970 CEST	56428	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:21.053319931 CEST	56430	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:21.057262897 CEST	4444	56428	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:21.058532953 CEST	4444	56430	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:21.058609962 CEST	56430	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:21.058758974 CEST	56430	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:21.063852072 CEST	4444	56430	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:22.689487934 CEST	4444	56430	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:22.690030098 CEST	56430	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:22.691792011 CEST	56432	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:22.695100069 CEST	4444	56430	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:22.699512005 CEST	4444	56432	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:22.699649096 CEST	56432	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:22.699778080 CEST	56432	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:22.705319881 CEST	4444	56432	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:24.437294960 CEST	4444	56432	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:24.437513113 CEST	56432	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:24.438246012 CEST	56434	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:24.443526030 CEST	4444	56432	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:24.443851948 CEST	4444	56434	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:24.443954945 CEST	56434	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:24.443999052 CEST	56434	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:24.450458050 CEST	4444	56434	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:26.027358055 CEST	4444	56434	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:26.027719021 CEST	56434	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:26.028273106 CEST	56436	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:26.032963037 CEST	4444	56434	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:26.033468962 CEST	4444	56436	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:26.033561945 CEST	56436	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:26.033678055 CEST	56436	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:26.038724899 CEST	4444	56436	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:27.585756063 CEST	4444	56436	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:27.585951090 CEST	56436	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:27.586771011 CEST	56438	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:27.592174053 CEST	4444	56436	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:27.592761993 CEST	4444	56438	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:27.592856884 CEST	56438	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:27.592962027 CEST	56438	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:27.599278927 CEST	4444	56438	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:29.166004896 CEST	4444	56438	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:29.166275024 CEST	56438	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:29.167113066 CEST	56440	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:29.171930075 CEST	4444	56438	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:29.173954010 CEST	4444	56440	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:29.174022913 CEST	56440	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:29.174133062 CEST	56440	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:29.179589987 CEST	4444	56440	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:30.743123055 CEST	4444	56440	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:30.743557930 CEST	56440	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:30.744333029 CEST	56442	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:30.749332905 CEST	4444	56440	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:30.749351025 CEST	4444	56442	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:30.749424934 CEST	56442	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:30.749527931 CEST	56442	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:30.755673885 CEST	4444	56442	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:32.318396091 CEST	4444	56442	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:32.318665981 CEST	56442	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:32.319567919 CEST	56444	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:32.323549986 CEST	4444	56442	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:32.324439049 CEST	4444	56444	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:32.324498892 CEST	56444	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:32.324647903 CEST	56444	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:32.329387903 CEST	4444	56444	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:33.879252911 CEST	4444	56444	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:33.879530907 CEST	56444	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:33.880115032 CEST	56446	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:33.884747028 CEST	4444	56444	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:33.885490894 CEST	4444	56446	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:33.885620117 CEST	56446	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:33.885884047 CEST	56446	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:33.892323017 CEST	4444	56446	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:35.460532904 CEST	4444	56446	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:35.460951090 CEST	56446	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:35.461637974 CEST	56448	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:35.466197014 CEST	4444	56446	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:35.466618061 CEST	4444	56448	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:35.466706038 CEST	56448	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:35.466799021 CEST	56448	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:35.471873045 CEST	4444	56448	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:37.079355955 CEST	4444	56448	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:37.079622984 CEST	56448	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:37.080651045 CEST	56450	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:37.086692095 CEST	4444	56448	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:37.086738110 CEST	4444	56450	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:37.086832047 CEST	56450	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:37.086918116 CEST	56450	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:37.092488050 CEST	4444	56450	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:38.654973984 CEST	4444	56450	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:38.655316114 CEST	56450	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:38.656140089 CEST	56452	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:38.660470009 CEST	4444	56450	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:38.661493063 CEST	4444	56452	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:38.661562920 CEST	56452	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:38.661670923 CEST	56452	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:38.666950941 CEST	4444	56452	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:40.491048098 CEST	4444	56452	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:40.491446972 CEST	56452	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:40.492098093 CEST	4444	56452	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:40.492155075 CEST	56452	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:40.492274046 CEST	56454	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:40.497339964 CEST	4444	56452	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:40.498389959 CEST	4444	56454	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:40.498477936 CEST	56454	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:40.498601913 CEST	56454	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:40.503597021 CEST	4444	56454	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:42.052823067 CEST	4444	56454	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:42.053006887 CEST	56454	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:42.053656101 CEST	56456	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:42.058248043 CEST	4444	56454	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:42.058553934 CEST	4444	56456	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:42.058614016 CEST	56456	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:42.058666945 CEST	56456	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:42.063613892 CEST	4444	56456	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:43.613859892 CEST	4444	56456	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:43.614151955 CEST	56456	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:43.615017891 CEST	56458	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:43.619376898 CEST	4444	56456	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:43.619870901 CEST	4444	56458	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:43.619963884 CEST	56458	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:43.620028973 CEST	56458	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:43.625046968 CEST	4444	56458	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:45.596868992 CEST	4444	56458	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:45.597261906 CEST	56458	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:45.597805977 CEST	4444	56458	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:45.597891092 CEST	56458	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:45.598005056 CEST	56460	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:45.602078915 CEST	4444	56458	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:45.606931925 CEST	4444	56460	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:45.607033014 CEST	56460	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:45.607139111 CEST	56460	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:45.612253904 CEST	4444	56460	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:47.162708998 CEST	4444	56460	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:47.162928104 CEST	56460	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:47.163451910 CEST	56462	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:47.167845011 CEST	4444	56460	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:47.168318033 CEST	4444	56462	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:47.168386936 CEST	56462	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:47.168453932 CEST	56462	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:47.173391104 CEST	4444	56462	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:48.777751923 CEST	4444	56462	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:48.778148890 CEST	56462	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:48.778620005 CEST	56464	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:48.782996893 CEST	4444	56462	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:48.783444881 CEST	4444	56464	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:48.783673048 CEST	56464	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:48.783835888 CEST	56464	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:48.788682938 CEST	4444	56464	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:50.348769903 CEST	4444	56464	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:50.349205017 CEST	56464	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:50.349720001 CEST	56466	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:50.354166031 CEST	4444	56464	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:50.354553938 CEST	4444	56466	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:50.354629993 CEST	56466	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:50.354734898 CEST	56466	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:50.360033989 CEST	4444	56466	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:51.927772999 CEST	4444	56466	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:51.928045988 CEST	56466	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:51.928435087 CEST	56468	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:51.933052063 CEST	4444	56466	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:51.933537006 CEST	4444	56468	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:51.933607101 CEST	56468	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:51.933731079 CEST	56468	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:51.938559055 CEST	4444	56468	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:53.511190891 CEST	4444	56468	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:53.511423111 CEST	56468	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:53.511976957 CEST	56470	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:53.517637014 CEST	4444	56468	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:53.518364906 CEST	4444	56470	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:53.518414974 CEST	56470	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:53.518474102 CEST	56470	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:53.523746967 CEST	4444	56470	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:55.083530903 CEST	4444	56470	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:55.083703995 CEST	56470	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:55.084191084 CEST	56472	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:55.088985920 CEST	4444	56470	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:55.089693069 CEST	4444	56472	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:55.089764118 CEST	56472	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:55.089871883 CEST	56472	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:55.095268965 CEST	4444	56472	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:56.868356943 CEST	4444	56472	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:56.868618011 CEST	56472	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:56.869313002 CEST	56474	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:56.869652987 CEST	4444	56472	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:56.869689941 CEST	56472	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:56.873620987 CEST	4444	56472	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:56.874304056 CEST	4444	56474	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:56.874351978 CEST	56474	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:56.874437094 CEST	56474	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:56.879374027 CEST	4444	56474	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:58.433799982 CEST	4444	56474	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:58.434043884 CEST	56474	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:58.434948921 CEST	56476	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:58.439111948 CEST	4444	56474	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:58.440211058 CEST	4444	56476	162.215.219.170	192.168.2.23
Oct 8, 2024 21:04:58.440273046 CEST	56476	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:58.440397024 CEST	56476	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:04:58.445343018 CEST	4444	56476	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:00.006864071 CEST	4444	56476	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:00.007148981 CEST	56476	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:00.007535934 CEST	56478	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:00.015064955 CEST	4444	56476	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:00.015080929 CEST	4444	56478	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:00.015122890 CEST	56478	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:00.015177011 CEST	56478	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:00.022196054 CEST	4444	56478	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:01.586847067 CEST	4444	56478	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:01.587013960 CEST	56478	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:01.587409973 CEST	56480	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:01.592221022 CEST	4444	56478	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:01.592339993 CEST	4444	56480	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:01.592447996 CEST	56480	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:01.592493057 CEST	56480	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:01.601368904 CEST	4444	56480	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:03.182420015 CEST	4444	56480	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:03.182676077 CEST	56480	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:03.183197021 CEST	56482	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:03.188469887 CEST	4444	56480	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:03.189023018 CEST	4444	56482	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:03.189119101 CEST	56482	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:03.189174891 CEST	56482	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:03.194652081 CEST	4444	56482	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:04.738830090 CEST	4444	56482	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:04.739022017 CEST	56482	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:04.739418983 CEST	56484	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:04.744513988 CEST	4444	56482	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:04.744751930 CEST	4444	56484	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:04.744837046 CEST	56484	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:04.744879961 CEST	56484	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:04.750232935 CEST	4444	56484	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:06.301819086 CEST	4444	56484	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:06.302037001 CEST	56484	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:06.302433014 CEST	56486	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:06.307526112 CEST	4444	56484	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:06.307854891 CEST	4444	56486	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:06.307918072 CEST	56486	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:06.307962894 CEST	56486	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:06.312987089 CEST	4444	56486	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:07.868107080 CEST	4444	56486	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:07.868484974 CEST	56486	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:07.869164944 CEST	56488	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:07.873792887 CEST	4444	56486	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:07.874214888 CEST	4444	56488	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:07.874277115 CEST	56488	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:07.874387980 CEST	56488	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:07.879527092 CEST	4444	56488	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:10.162062883 CEST	4444	56488	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:10.162235022 CEST	4444	56488	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:10.162337065 CEST	4444	56488	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:10.162348032 CEST	56488	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:10.162386894 CEST	56488	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:10.162525892 CEST	56488	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:10.163351059 CEST	56490	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:10.167634010 CEST	4444	56488	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:10.172240973 CEST	4444	56490	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:10.172323942 CEST	56490	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:10.172384024 CEST	56490	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:10.178150892 CEST	4444	56490	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:11.761094093 CEST	4444	56490	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:11.761390924 CEST	56490	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:11.762284994 CEST	56492	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:11.766388893 CEST	4444	56490	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:11.767410040 CEST	4444	56492	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:11.767482996 CEST	56492	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:11.767580986 CEST	56492	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:11.772569895 CEST	4444	56492	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:13.335268974 CEST	4444	56492	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:13.335572004 CEST	56492	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:13.336236000 CEST	56494	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:13.341419935 CEST	4444	56492	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:13.343364954 CEST	4444	56494	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:13.343461037 CEST	56494	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:13.343575001 CEST	56494	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:13.349383116 CEST	4444	56494	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:14.895855904 CEST	4444	56494	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:14.896254063 CEST	56494	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:14.896897078 CEST	56496	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:14.901206970 CEST	4444	56494	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:14.901731014 CEST	4444	56496	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:14.901813984 CEST	56496	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:14.901911974 CEST	56496	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:14.907188892 CEST	4444	56496	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:16.458425045 CEST	4444	56496	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:16.458679914 CEST	56496	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:16.459254980 CEST	56498	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:16.463643074 CEST	4444	56496	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:16.464118004 CEST	4444	56498	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:16.464202881 CEST	56498	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:16.464306116 CEST	56498	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:16.469389915 CEST	4444	56498	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:18.024275064 CEST	4444	56498	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:18.024518013 CEST	56498	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:18.024992943 CEST	56500	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:18.029464960 CEST	4444	56498	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:18.029745102 CEST	4444	56500	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:18.029797077 CEST	56500	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:18.029860973 CEST	56500	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:18.034672022 CEST	4444	56500	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:19.582576990 CEST	4444	56500	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:19.582818031 CEST	56500	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:19.583332062 CEST	56502	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:19.587800026 CEST	4444	56500	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:19.589878082 CEST	4444	56502	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:19.589971066 CEST	56502	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:19.590107918 CEST	56502	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:19.594978094 CEST	4444	56502	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:21.161546946 CEST	4444	56502	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:21.161936045 CEST	56502	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:21.162678957 CEST	56504	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:21.168003082 CEST	4444	56502	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:21.169012070 CEST	4444	56504	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:21.169209957 CEST	56504	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:21.169209957 CEST	56504	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:21.175333023 CEST	4444	56504	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:22.725939989 CEST	4444	56504	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:22.726327896 CEST	56504	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:22.727114916 CEST	56506	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:22.731427908 CEST	4444	56504	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:22.732085943 CEST	4444	56506	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:22.732155085 CEST	56506	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:22.732201099 CEST	56506	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:22.737082005 CEST	4444	56506	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:24.286643028 CEST	4444	56506	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:24.286870003 CEST	56506	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:24.287354946 CEST	56508	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:24.291959047 CEST	4444	56506	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:24.292166948 CEST	4444	56508	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:24.292376995 CEST	56508	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:24.292634010 CEST	56508	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:24.297538996 CEST	4444	56508	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:25.881947994 CEST	4444	56508	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:25.882250071 CEST	56508	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:25.882900000 CEST	56510	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:25.887234926 CEST	4444	56508	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:25.887831926 CEST	4444	56510	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:25.887904882 CEST	56510	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:25.888016939 CEST	56510	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:25.893507957 CEST	4444	56510	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:27.464452982 CEST	4444	56510	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:27.464723110 CEST	56510	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:27.465501070 CEST	56512	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:27.473934889 CEST	4444	56510	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:27.475166082 CEST	4444	56512	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:27.475256920 CEST	56512	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:27.475323915 CEST	56512	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:27.484314919 CEST	4444	56512	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:29.022964954 CEST	4444	56512	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:29.023325920 CEST	56512	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:29.024312973 CEST	56514	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:29.028750896 CEST	4444	56512	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:29.029854059 CEST	4444	56514	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:29.029958010 CEST	56514	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:29.030061007 CEST	56514	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:29.035407066 CEST	4444	56514	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:30.585444927 CEST	4444	56514	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:30.585803986 CEST	56514	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:30.586177111 CEST	56516	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:30.592214108 CEST	4444	56514	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:30.592576027 CEST	4444	56516	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:30.592636108 CEST	56516	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:30.592684984 CEST	56516	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:30.599011898 CEST	4444	56516	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:32.166964054 CEST	4444	56516	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:32.167274952 CEST	56516	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:32.167850018 CEST	56518	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:32.172168970 CEST	4444	56516	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:32.172832966 CEST	4444	56518	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:32.172975063 CEST	56518	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:32.173090935 CEST	56518	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:32.178319931 CEST	4444	56518	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:33.739692926 CEST	4444	56518	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:33.739886999 CEST	56518	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:33.740303993 CEST	56520	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:33.744746923 CEST	4444	56518	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:33.745182991 CEST	4444	56520	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:33.745268106 CEST	56520	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:33.745313883 CEST	56520	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:33.751075029 CEST	4444	56520	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:35.318715096 CEST	4444	56520	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:35.319190979 CEST	56520	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:35.319961071 CEST	56522	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:35.324847937 CEST	4444	56520	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:35.325251102 CEST	4444	56522	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:35.325319052 CEST	56522	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:35.325527906 CEST	56522	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:35.330619097 CEST	4444	56522	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:36.921660900 CEST	4444	56522	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:36.922142029 CEST	56522	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:36.922945976 CEST	56524	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:36.928401947 CEST	4444	56522	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:36.928927898 CEST	4444	56524	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:36.928998947 CEST	56524	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:36.929132938 CEST	56524	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:36.933971882 CEST	4444	56524	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:38.475668907 CEST	4444	56524	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:38.475795031 CEST	56524	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:38.477049112 CEST	56526	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:38.480873108 CEST	4444	56524	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:38.481925011 CEST	4444	56526	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:38.482016087 CEST	56526	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:38.482068062 CEST	56526	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:38.487063885 CEST	4444	56526	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:40.056046963 CEST	4444	56526	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:40.056258917 CEST	56526	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:40.056910038 CEST	56528	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:40.061089993 CEST	4444	56526	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:40.061793089 CEST	4444	56528	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:40.061851025 CEST	56528	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:40.061892033 CEST	56528	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:40.066735029 CEST	4444	56528	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:41.615180969 CEST	4444	56528	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:41.615449905 CEST	56528	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:41.616103888 CEST	56530	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:41.620439053 CEST	4444	56528	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:41.620899916 CEST	4444	56530	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:41.620971918 CEST	56530	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:41.621011972 CEST	56530	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:41.625844002 CEST	4444	56530	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:43.196311951 CEST	4444	56530	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:43.196501970 CEST	56530	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:43.197261095 CEST	56532	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:43.203237057 CEST	4444	56530	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:43.204382896 CEST	4444	56532	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:43.204447031 CEST	56532	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:43.204571962 CEST	56532	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:43.211354971 CEST	4444	56532	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:44.896533966 CEST	4444	56532	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:44.896682024 CEST	56532	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:44.897233963 CEST	56534	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:44.901604891 CEST	4444	56532	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:44.902045012 CEST	4444	56534	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:44.902093887 CEST	56534	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:44.902139902 CEST	56534	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:44.907099962 CEST	4444	56534	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:46.461019039 CEST	4444	56534	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:46.461452007 CEST	56534	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:46.462307930 CEST	56536	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:46.466763020 CEST	4444	56534	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:46.467569113 CEST	4444	56536	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:46.467669964 CEST	56536	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:46.467812061 CEST	56536	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:46.472738981 CEST	4444	56536	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:48.038444996 CEST	4444	56536	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:48.038937092 CEST	56536	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:48.039635897 CEST	56538	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:48.043812990 CEST	4444	56536	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:48.044440031 CEST	4444	56538	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:48.044492006 CEST	56538	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:48.044567108 CEST	56538	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:48.049380064 CEST	4444	56538	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:49.688139915 CEST	4444	56538	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:49.688515902 CEST	56538	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:49.689569950 CEST	56540	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:49.693517923 CEST	4444	56538	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:49.698103905 CEST	4444	56540	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:49.698170900 CEST	56540	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:49.698287010 CEST	56540	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:49.703437090 CEST	4444	56540	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:51.277029037 CEST	4444	56540	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:51.277374983 CEST	56540	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:51.277956963 CEST	56542	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:51.282210112 CEST	4444	56540	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:51.282828093 CEST	4444	56542	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:51.282872915 CEST	56542	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:51.282942057 CEST	56542	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:51.288331985 CEST	4444	56542	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:52.865911961 CEST	4444	56542	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:52.867197037 CEST	56542	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:52.867835999 CEST	56544	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:52.872061014 CEST	4444	56542	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:52.872916937 CEST	4444	56544	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:52.873073101 CEST	56544	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:52.873111963 CEST	56544	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:52.878091097 CEST	4444	56544	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:54.429233074 CEST	4444	56544	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:54.429754972 CEST	56544	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:54.430460930 CEST	56546	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:54.434581995 CEST	4444	56544	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:54.435444117 CEST	4444	56546	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:54.435548067 CEST	56546	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:54.435635090 CEST	56546	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:54.440861940 CEST	4444	56546	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:55.991024971 CEST	4444	56546	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:55.991579056 CEST	56546	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:55.992294073 CEST	56548	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:55.996665001 CEST	4444	56546	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:55.997962952 CEST	4444	56548	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:55.998024940 CEST	56548	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:55.998121023 CEST	56548	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:56.006162882 CEST	4444	56548	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:57.575653076 CEST	4444	56548	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:57.576093912 CEST	56548	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:57.576848030 CEST	56550	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:57.581640005 CEST	4444	56548	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:57.581844091 CEST	4444	56550	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:57.582031012 CEST	56550	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:57.582031012 CEST	56550	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:57.586955070 CEST	4444	56550	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:59.307141066 CEST	4444	56550	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:59.307583094 CEST	56550	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:59.308392048 CEST	56552	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:59.313119888 CEST	4444	56550	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:59.313581944 CEST	4444	56552	162.215.219.170	192.168.2.23
Oct 8, 2024 21:05:59.313688993 CEST	56552	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:59.313796997 CEST	56552	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:05:59.319302082 CEST	4444	56552	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:00.896754980 CEST	4444	56552	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:00.897205114 CEST	56552	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:00.898264885 CEST	56554	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:00.902113914 CEST	4444	56552	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:00.903606892 CEST	4444	56554	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:00.903702021 CEST	56554	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:00.903794050 CEST	56554	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:00.908859015 CEST	4444	56554	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:02.541014910 CEST	4444	56554	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:02.541363955 CEST	56554	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:02.542222023 CEST	56556	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:02.546725035 CEST	4444	56554	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:02.547095060 CEST	4444	56556	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:02.547182083 CEST	56556	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:02.547280073 CEST	56556	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:02.552834034 CEST	4444	56556	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:04.100112915 CEST	4444	56556	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:04.100622892 CEST	56556	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:04.101835966 CEST	56558	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:04.105617046 CEST	4444	56556	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:04.107168913 CEST	4444	56558	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:04.107481003 CEST	56558	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:04.109055042 CEST	56558	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:04.113961935 CEST	4444	56558	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:05.670073032 CEST	4444	56558	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:05.670677900 CEST	56558	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:05.671710014 CEST	56560	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:05.676286936 CEST	4444	56558	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:05.677222013 CEST	4444	56560	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:05.677294016 CEST	56560	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:05.677402973 CEST	56560	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:05.685303926 CEST	4444	56560	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:07.256489992 CEST	4444	56560	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:07.256747007 CEST	56560	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:07.257754087 CEST	56562	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:07.261564970 CEST	4444	56560	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:07.262726068 CEST	4444	56562	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:07.262800932 CEST	56562	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:07.262927055 CEST	56562	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:07.268116951 CEST	4444	56562	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:08.820394039 CEST	4444	56562	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:08.820641994 CEST	56562	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:08.821347952 CEST	56564	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:08.825803995 CEST	4444	56562	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:08.826554060 CEST	4444	56564	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:08.826617956 CEST	56564	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:08.826726913 CEST	56564	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:08.831940889 CEST	4444	56564	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:10.398169041 CEST	4444	56564	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:10.398571968 CEST	56564	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:10.399605036 CEST	56566	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:10.404700994 CEST	4444	56564	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:10.404766083 CEST	4444	56566	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:10.404834032 CEST	56566	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:10.404941082 CEST	56566	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:10.409986019 CEST	4444	56566	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:11.976726055 CEST	4444	56566	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:11.977214098 CEST	56566	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:11.978085041 CEST	56568	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:11.982211113 CEST	4444	56566	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:11.982943058 CEST	4444	56568	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:11.982995987 CEST	56568	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:11.983103991 CEST	56568	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:11.988074064 CEST	4444	56568	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:13.537755013 CEST	4444	56568	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:13.538188934 CEST	56568	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:13.539212942 CEST	56570	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:13.543827057 CEST	4444	56568	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:13.544176102 CEST	4444	56570	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:13.544238091 CEST	56570	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:13.544361115 CEST	56570	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:13.549734116 CEST	4444	56570	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:15.099730015 CEST	4444	56570	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:15.100153923 CEST	56570	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:15.101011992 CEST	56572	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:15.105041981 CEST	4444	56570	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:15.106175900 CEST	4444	56572	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:15.106235027 CEST	56572	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:15.106365919 CEST	56572	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:15.111644983 CEST	4444	56572	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:16.665896893 CEST	4444	56572	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:16.666172981 CEST	56572	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:16.666960001 CEST	56574	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:16.671108961 CEST	4444	56572	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:16.671876907 CEST	4444	56574	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:16.671951056 CEST	56574	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:16.672045946 CEST	56574	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:16.677103043 CEST	4444	56574	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:18.244982958 CEST	4444	56574	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:18.245419979 CEST	56574	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:18.246232986 CEST	56576	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:18.250304937 CEST	4444	56574	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:18.251147032 CEST	4444	56576	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:18.251233101 CEST	56576	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:18.251358986 CEST	56576	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:18.257133961 CEST	4444	56576	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:20.101986885 CEST	4444	56576	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:20.102251053 CEST	56576	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:20.103339911 CEST	56578	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:20.110063076 CEST	4444	56576	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:20.110409021 CEST	4444	56578	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:20.110481024 CEST	56578	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:20.110593081 CEST	56578	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:20.115748882 CEST	4444	56578	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:21.735903978 CEST	4444	56578	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:21.736140013 CEST	56578	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:21.736866951 CEST	56580	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:21.741877079 CEST	4444	56578	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:21.742615938 CEST	4444	56580	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:21.742711067 CEST	56580	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:21.742804050 CEST	56580	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:21.748869896 CEST	4444	56580	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:23.374413013 CEST	4444	56580	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:23.374609947 CEST	56580	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:23.375174046 CEST	56582	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:23.379623890 CEST	4444	56580	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:23.380629063 CEST	4444	56582	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:23.380702019 CEST	56582	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:23.380759001 CEST	56582	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:23.385755062 CEST	4444	56582	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:24.975558996 CEST	4444	56582	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:24.975883007 CEST	56582	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:24.977312088 CEST	56584	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:24.981657982 CEST	4444	56582	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:24.982383966 CEST	4444	56584	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:24.982466936 CEST	56584	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:24.982568979 CEST	56584	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:24.988099098 CEST	4444	56584	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:26.537026882 CEST	4444	56584	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:26.537285089 CEST	56584	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:26.538073063 CEST	56586	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:26.542182922 CEST	4444	56584	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:26.542989016 CEST	4444	56586	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:26.543082952 CEST	56586	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:26.543199062 CEST	56586	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:26.549094915 CEST	4444	56586	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:28.133359909 CEST	4444	56586	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:28.133807898 CEST	56586	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:28.134851933 CEST	56588	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:28.140024900 CEST	4444	56586	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:28.140433073 CEST	4444	56588	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:28.140537977 CEST	56588	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:28.140656948 CEST	56588	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:28.145793915 CEST	4444	56588	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:29.694015026 CEST	4444	56588	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:29.694317102 CEST	56588	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:29.695138931 CEST	56590	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:29.699322939 CEST	4444	56588	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:29.700158119 CEST	4444	56590	162.215.219.170	192.168.2.23
Oct 8, 2024 21:06:29.700253010 CEST	56590	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:29.700361013 CEST	56590	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:06:29.705163002 CEST	4444	56590	162.215.219.170	192.168.2.23

System Behavior

Analysis Process: Hy0AyRD058.elf PID: 6216, Parent PID: 6131

General

Start time (UTC):	19:02:54
Start date (UTC):	08/10/2024
Path:	/tmp/Hy0AyRD058.elf
Arguments:	/tmp/Hy0AyRD058.elf
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: Hy0AyRD058.elf PID: 6218, Parent PID: 6216

General

Start time (UTC):	19:02:54
Start date (UTC):	08/10/2024
Path:	/tmp/Hy0AyRD058.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: Hy0AyRD058.elf PID: 6220, Parent PID: 6218

General

Start time (UTC):	19:02:54
Start date (UTC):	08/10/2024
Path:	/tmp/Hy0AyRD058.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping or `net view` using Net .
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report Hy0AyRD058.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Threatname: Gafgyt

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.Wy7dRd (deleted)

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: Hy0AyRD058.elf PID: 6216, Parent PID: 6131

General

Chronological Activities

Analysis Process: Hy0AyRD058.elf PID: 6218, Parent PID: 6216

General

Chronological Activities

Analysis Process: Hy0AyRD058.elf PID: 6220, Parent PID: 6218

General

Chronological Activities

Linux Analysis Report
Hy0AyRD058.elf