Edit tour

Linux Analysis Report
j3wIEvE5Sj.elf

Overview

General Information

Sample name:	j3wIEvE5Sj.elf renamed because original name is a hash value
Original sample name:	ddae85e0bc68d7f404786af4df45af91.elf
Analysis ID:	1529318
MD5:	ddae85e0bc68d7f404786af4df45af91
SHA1:	906816cef8098f737edcc3dc2fe64bf2261fcd85
SHA256:	360f444b0d1a6295ddaa674e66d6e98b5ee4db2bc649e76e6961d41f9834ddb7
Tags:	32armelfgafgyt
Infos:

Detection

Gafgyt, Mirai

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Gafgyt

Yara detected Mirai

Opens /proc/net/* files useful for finding connected devices and routers

Detected TCP or UDP traffic on non-standard ports

Executes the "rm" command used to delete files or directories

Sample and/or dropped files contains symbols with suspicious names

Sample contains strings that are user agent strings indicative of HTTP manipulation

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1529318
Start date and time:	2024-10-08 21:02:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	j3wIEvE5Sj.elf renamed because original name is a hash value
Original Sample Name:	ddae85e0bc68d7f404786af4df45af91.elf
Detection:	MAL
Classification:	mal100.spre.troj.linELF@0/0@2/0

Warnings

VT rate limit hit for: j3wIEvE5Sj.elf

Runtime Messages

Command:	/tmp/j3wIEvE5Sj.elf
PID:	5498
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

dash New Fork (PID: 5485, Parent: 3636)

rm (PID: 5485, Parent: 3636, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.VPcrEpfrQW /tmp/tmp.jJFrqEYoep /tmp/tmp.V1PhRH8nNb

dash New Fork (PID: 5486, Parent: 3636)

rm (PID: 5486, Parent: 3636, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.VPcrEpfrQW /tmp/tmp.jJFrqEYoep /tmp/tmp.V1PhRH8nNb

j3wIEvE5Sj.elf (PID: 5498, Parent: 5422, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/j3wIEvE5Sj.elf

j3wIEvE5Sj.elf New Fork (PID: 5500, Parent: 5498)

j3wIEvE5Sj.elf New Fork (PID: 5502, Parent: 5500)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
j3wIEvE5Sj.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
j3wIEvE5Sj.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
j3wIEvE5Sj.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1cf10:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cf24:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cf38:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cf4c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cf60:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cf74:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cf88:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cf9c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cfb0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cfc4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cfd8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cfec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1d000:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1d014:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1d028:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1d03c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1d050:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1d064:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1d078:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1d08c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1d0a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
j3wIEvE5Sj.elf	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x1f478:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x214b4:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64

Memory Dumps

Source	Rule	Description	Author	Strings
5498.1.00007f4140017000.00007f414003b000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
5498.1.00007f4140017000.00007f414003b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5498.1.00007f4140017000.00007f414003b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1cf10:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cf24:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cf38:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cf4c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cf60:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cf74:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cf88:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cf9c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cfb0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cfc4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cfd8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cfec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1d000:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1d014:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1d028:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1d03c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1d050:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1d064:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1d078:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1d08c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1d0a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5498.1.00007f4140017000.00007f414003b000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x1f478:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x214b4:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
5500.1.00007f4140017000.00007f414003b000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
5500.1.00007f4140017000.00007f414003b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5500.1.00007f4140017000.00007f414003b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1cf10:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cf24:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cf38:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cf4c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cf60:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cf74:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cf88:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cf9c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cfb0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cfc4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cfd8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cfec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1d000:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1d014:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1d028:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1d03c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1d050:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1d064:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1d078:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1d08c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1d0a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5500.1.00007f4140017000.00007f414003b000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x1f478:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x214b4:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: j3wIEvE5Sj.elf PID: 5498	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: j3wIEvE5Sj.elf PID: 5498	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x33da:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x33ee:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3402:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3416:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x342a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x343e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3452:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3466:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x347a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x348e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x34a2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x34b6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x34ca:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x34de:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x34f2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3506:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x351a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x352e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3542:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3556:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x356a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: j3wIEvE5Sj.elf PID: 5498	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x6882:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x6aef:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x971c:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: j3wIEvE5Sj.elf PID: 5500	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: j3wIEvE5Sj.elf PID: 5500	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x2d5f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2d73:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2d87:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2d9b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2daf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2dc3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2dd7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2deb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2dff:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e13:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e27:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e3b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e4f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e63:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e77:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e8b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e9f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2eb3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2ec7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2edb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2eef:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: j3wIEvE5Sj.elf PID: 5500	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x6207:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x6474:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x90a1:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Click to see the 9 entries

Suricata Signatures

ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T21:03:01.257924+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34002	162.215.219.170	4444	TCP
2024-10-08T21:03:02.805892+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34004	162.215.219.170	4444	TCP
2024-10-08T21:03:04.370007+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34006	162.215.219.170	4444	TCP
2024-10-08T21:03:05.935027+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34008	162.215.219.170	4444	TCP
2024-10-08T21:03:07.496523+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34010	162.215.219.170	4444	TCP
2024-10-08T21:03:09.059845+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34012	162.215.219.170	4444	TCP
2024-10-08T21:03:10.641121+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34014	162.215.219.170	4444	TCP
2024-10-08T21:03:12.198466+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34016	162.215.219.170	4444	TCP
2024-10-08T21:03:13.762163+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34018	162.215.219.170	4444	TCP
2024-10-08T21:03:15.325990+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34020	162.215.219.170	4444	TCP
2024-10-08T21:03:16.901639+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34022	162.215.219.170	4444	TCP
2024-10-08T21:03:18.464562+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34024	162.215.219.170	4444	TCP
2024-10-08T21:03:20.028846+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34026	162.215.219.170	4444	TCP
2024-10-08T21:03:21.611613+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34028	162.215.219.170	4444	TCP
2024-10-08T21:03:23.196518+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34030	162.215.219.170	4444	TCP
2024-10-08T21:03:24.780684+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34032	162.215.219.170	4444	TCP
2024-10-08T21:03:26.391122+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34034	162.215.219.170	4444	TCP
2024-10-08T21:03:28.076919+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34036	162.215.219.170	4444	TCP
2024-10-08T21:03:29.650504+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34038	162.215.219.170	4444	TCP
2024-10-08T21:03:31.229265+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34040	162.215.219.170	4444	TCP
2024-10-08T21:03:32.795217+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34042	162.215.219.170	4444	TCP
2024-10-08T21:03:34.375678+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34044	162.215.219.170	4444	TCP
2024-10-08T21:03:35.999654+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34046	162.215.219.170	4444	TCP
2024-10-08T21:03:37.607681+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34048	162.215.219.170	4444	TCP
2024-10-08T21:03:39.167479+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34050	162.215.219.170	4444	TCP
2024-10-08T21:03:40.990543+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34052	162.215.219.170	4444	TCP
2024-10-08T21:03:42.573403+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34054	162.215.219.170	4444	TCP
2024-10-08T21:03:44.153784+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34056	162.215.219.170	4444	TCP
2024-10-08T21:03:45.714570+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34058	162.215.219.170	4444	TCP
2024-10-08T21:03:47.276663+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34060	162.215.219.170	4444	TCP
2024-10-08T21:03:48.977724+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34062	162.215.219.170	4444	TCP
2024-10-08T21:03:50.542954+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34064	162.215.219.170	4444	TCP
2024-10-08T21:03:52.105749+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34066	162.215.219.170	4444	TCP
2024-10-08T21:03:53.671788+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34068	162.215.219.170	4444	TCP
2024-10-08T21:03:55.247948+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34070	162.215.219.170	4444	TCP
2024-10-08T21:03:56.808921+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34072	162.215.219.170	4444	TCP
2024-10-08T21:03:58.376598+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34074	162.215.219.170	4444	TCP
2024-10-08T21:03:59.969482+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34076	162.215.219.170	4444	TCP
2024-10-08T21:04:01.560411+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34078	162.215.219.170	4444	TCP
2024-10-08T21:04:03.141171+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34080	162.215.219.170	4444	TCP
2024-10-08T21:04:05.031953+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34082	162.215.219.170	4444	TCP
2024-10-08T21:04:06.896913+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34084	162.215.219.170	4444	TCP
2024-10-08T21:04:08.463899+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34086	162.215.219.170	4444	TCP
2024-10-08T21:04:10.037715+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34088	162.215.219.170	4444	TCP
2024-10-08T21:04:11.654450+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34090	162.215.219.170	4444	TCP
2024-10-08T21:04:13.219027+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34092	162.215.219.170	4444	TCP
2024-10-08T21:04:14.797960+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34094	162.215.219.170	4444	TCP
2024-10-08T21:04:16.374448+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34096	162.215.219.170	4444	TCP
2024-10-08T21:04:17.935062+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34098	162.215.219.170	4444	TCP
2024-10-08T21:04:19.517198+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34100	162.215.219.170	4444	TCP
2024-10-08T21:04:21.093332+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34102	162.215.219.170	4444	TCP
2024-10-08T21:04:22.696144+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34104	162.215.219.170	4444	TCP
2024-10-08T21:04:24.444037+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34106	162.215.219.170	4444	TCP
2024-10-08T21:04:26.033611+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34108	162.215.219.170	4444	TCP
2024-10-08T21:04:27.631607+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34110	162.215.219.170	4444	TCP
2024-10-08T21:04:29.231455+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34112	162.215.219.170	4444	TCP
2024-10-08T21:04:30.809525+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34114	162.215.219.170	4444	TCP
2024-10-08T21:04:32.369739+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34116	162.215.219.170	4444	TCP
2024-10-08T21:04:33.963229+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34118	162.215.219.170	4444	TCP
2024-10-08T21:04:35.549314+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34120	162.215.219.170	4444	TCP
2024-10-08T21:04:37.122311+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34122	162.215.219.170	4444	TCP
2024-10-08T21:04:38.684326+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34124	162.215.219.170	4444	TCP
2024-10-08T21:04:40.498610+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34126	162.215.219.170	4444	TCP
2024-10-08T21:04:42.061404+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34128	162.215.219.170	4444	TCP
2024-10-08T21:04:43.619888+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34130	162.215.219.170	4444	TCP
2024-10-08T21:04:45.606994+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34132	162.215.219.170	4444	TCP
2024-10-08T21:04:47.168483+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34134	162.215.219.170	4444	TCP
2024-10-08T21:04:48.783710+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34136	162.215.219.170	4444	TCP
2024-10-08T21:04:50.358891+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34138	162.215.219.170	4444	TCP
2024-10-08T21:04:51.933143+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34140	162.215.219.170	4444	TCP
2024-10-08T21:04:53.520583+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34142	162.215.219.170	4444	TCP
2024-10-08T21:04:55.090701+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34144	162.215.219.170	4444	TCP
2024-10-08T21:04:56.874363+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34146	162.215.219.170	4444	TCP
2024-10-08T21:04:58.435181+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34148	162.215.219.170	4444	TCP
2024-10-08T21:05:00.021573+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34150	162.215.219.170	4444	TCP
2024-10-08T21:05:01.590686+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34152	162.215.219.170	4444	TCP
2024-10-08T21:05:03.170471+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34154	162.215.219.170	4444	TCP
2024-10-08T21:05:04.732370+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34156	162.215.219.170	4444	TCP
2024-10-08T21:05:06.314802+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34158	162.215.219.170	4444	TCP
2024-10-08T21:05:07.903729+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34160	162.215.219.170	4444	TCP
2024-10-08T21:05:10.172407+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34162	162.215.219.170	4444	TCP
2024-10-08T21:05:11.745816+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34164	162.215.219.170	4444	TCP
2024-10-08T21:05:13.326639+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34166	162.215.219.170	4444	TCP
2024-10-08T21:05:14.889637+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34168	162.215.219.170	4444	TCP
2024-10-08T21:05:16.447927+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34170	162.215.219.170	4444	TCP
2024-10-08T21:05:18.011897+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34172	162.215.219.170	4444	TCP
2024-10-08T21:05:19.577524+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34174	162.215.219.170	4444	TCP
2024-10-08T21:05:21.136364+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34176	162.215.219.170	4444	TCP
2024-10-08T21:05:22.700277+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34178	162.215.219.170	4444	TCP
2024-10-08T21:05:24.263688+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34180	162.215.219.170	4444	TCP
2024-10-08T21:05:25.871454+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34182	162.215.219.170	4444	TCP
2024-10-08T21:05:27.459461+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34184	162.215.219.170	4444	TCP
2024-10-08T21:05:29.044295+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34186	162.215.219.170	4444	TCP
2024-10-08T21:05:30.624779+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34188	162.215.219.170	4444	TCP
2024-10-08T21:05:32.183376+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34190	162.215.219.170	4444	TCP
2024-10-08T21:05:33.729910+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34192	162.215.219.170	4444	TCP
2024-10-08T21:05:35.313999+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34194	162.215.219.170	4444	TCP
2024-10-08T21:05:36.929972+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34196	162.215.219.170	4444	TCP
2024-10-08T21:05:38.481063+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34198	162.215.219.170	4444	TCP
2024-10-08T21:05:40.060394+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34200	162.215.219.170	4444	TCP
2024-10-08T21:05:41.659882+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34202	162.215.219.170	4444	TCP
2024-10-08T21:05:43.219216+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34204	162.215.219.170	4444	TCP
2024-10-08T21:05:44.902241+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34206	162.215.219.170	4444	TCP
2024-10-08T21:05:46.455069+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34208	162.215.219.170	4444	TCP
2024-10-08T21:05:48.043520+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34210	162.215.219.170	4444	TCP
2024-10-08T21:05:49.694173+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34212	162.215.219.170	4444	TCP
2024-10-08T21:05:51.280686+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34214	162.215.219.170	4444	TCP
2024-10-08T21:05:52.857079+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34216	162.215.219.170	4444	TCP
2024-10-08T21:05:54.419768+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34218	162.215.219.170	4444	TCP
2024-10-08T21:05:55.987659+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34220	162.215.219.170	4444	TCP
2024-10-08T21:05:57.581773+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34222	162.215.219.170	4444	TCP
2024-10-08T21:05:59.313894+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34224	162.215.219.170	4444	TCP
2024-10-08T21:06:00.980896+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34226	162.215.219.170	4444	TCP
2024-10-08T21:06:02.580510+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34228	162.215.219.170	4444	TCP
2024-10-08T21:06:04.156868+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34230	162.215.219.170	4444	TCP
2024-10-08T21:06:05.731906+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34232	162.215.219.170	4444	TCP
2024-10-08T21:06:07.292840+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34234	162.215.219.170	4444	TCP
2024-10-08T21:06:08.856768+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34236	162.215.219.170	4444	TCP
2024-10-08T21:06:10.437995+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34238	162.215.219.170	4444	TCP
2024-10-08T21:06:12.015978+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34240	162.215.219.170	4444	TCP
2024-10-08T21:06:13.596474+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34242	162.215.219.170	4444	TCP
2024-10-08T21:06:15.174541+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34244	162.215.219.170	4444	TCP
2024-10-08T21:06:16.732513+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34246	162.215.219.170	4444	TCP
2024-10-08T21:06:18.531817+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34248	162.215.219.170	4444	TCP
2024-10-08T21:06:20.325079+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34250	162.215.219.170	4444	TCP
2024-10-08T21:06:21.984990+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34252	162.215.219.170	4444	TCP
2024-10-08T21:06:23.590372+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34254	162.215.219.170	4444	TCP
2024-10-08T21:06:25.167892+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34256	162.215.219.170	4444	TCP
2024-10-08T21:06:26.733516+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34258	162.215.219.170	4444	TCP
2024-10-08T21:06:28.560992+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34260	162.215.219.170	4444	TCP
2024-10-08T21:06:30.123693+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34262	162.215.219.170	4444	TCP
2024-10-08T21:06:31.717111+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34264	162.215.219.170	4444	TCP
2024-10-08T21:06:33.317568+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34266	162.215.219.170	4444	TCP
2024-10-08T21:06:34.972028+0200	2846526	1	A Network Trojan was detected	192.168.2.14	34268	162.215.219.170	4444	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: j3wIEvE5Sj.elf

Avira: detected

Found malware configuration

Source: j3wIEvE5Sj.elf

Malware Configuration Extractor: Gafgyt {"C2 url": "162.215.219.170:4444"}

Multi AV Scanner detection for submitted file

Source: j3wIEvE5Sj.elf

ReversingLabs: Detection: 55%

Spreading

Opens /proc/net/* files useful for finding connected devices and routers

Source: /tmp/j3wIEvE5Sj.elf (PID: 5498)

Opens: /proc/net/route

Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34018 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34006 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34066 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34014 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34096 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34028 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34022 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34042 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34030 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34120 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34052 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34058 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34024 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34020 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34132 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34056 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34008 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34046 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34034 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34122 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34004 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34148 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34098 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34048 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34032 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34106 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34200 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34038 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34012 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34236 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34216 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34086 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34040 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34260 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34070 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34044 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34228 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34064 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34242 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34124 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34102 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34192 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34114 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34126 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34110 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34154 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34138 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34084 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34230 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34146 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34100 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34026 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34104 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34168 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34062 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34116 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34226 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34202 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34150 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34090 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34210 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34190 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34166 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34170 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34244 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34212 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34232 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34198 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34002 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34156 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34050 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34080 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34158 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34162 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34112 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34172 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34220 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34094 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34060 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34036 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34068 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34174 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34074 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34184 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34144 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34178 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34266 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34204 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34118 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34240 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34254 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34218 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34208 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34222 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34160 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34234 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34256 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34182 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34108 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34164 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34246 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34072 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34188 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34088 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34076 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34082 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34194 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34264 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34010 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34176 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34196 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34140 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34078 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34268 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34142 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34206 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34258 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34128 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34016 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34130 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34262 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34180 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34248 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34092 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34134 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34214 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34252 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34224 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34186 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34250 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34136 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34152 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34238 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:34054 -> 162.215.219.170:4444

Source: global traffic

TCP traffic: 192.168.2.14:34002 -> 162.215.219.170:4444

Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

Source: j3wIEvE5Sj.elf	String found in binary or memory: http://fast.no/support/crawler.asp)
Source: j3wIEvE5Sj.elf	String found in binary or memory: http://feedback.redkolibri.com/
Source: j3wIEvE5Sj.elf	String found in binary or memory: http://www.baidu.com/search/spider.htm)
Source: j3wIEvE5Sj.elf	String found in binary or memory: http://www.baidu.com/search/spider.html)
Source: j3wIEvE5Sj.elf	String found in binary or memory: http://www.billybobbot.com/crawler/)

System Summary

Malicious sample detected (through community Yara rule)

Source: j3wIEvE5Sj.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: j3wIEvE5Sj.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5498.1.00007f4140017000.00007f414003b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5498.1.00007f4140017000.00007f414003b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5500.1.00007f4140017000.00007f414003b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5500.1.00007f4140017000.00007f414003b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: j3wIEvE5Sj.elf PID: 5498, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: j3wIEvE5Sj.elf PID: 5498, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: j3wIEvE5Sj.elf PID: 5500, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: j3wIEvE5Sj.elf PID: 5500, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown

Source: j3wIEvE5Sj.elf

ELF static info symbol of initial sample: __gnu_unwind_execute

Source: j3wIEvE5Sj.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: j3wIEvE5Sj.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5498.1.00007f4140017000.00007f414003b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5498.1.00007f4140017000.00007f414003b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5500.1.00007f4140017000.00007f414003b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5500.1.00007f4140017000.00007f414003b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: j3wIEvE5Sj.elf PID: 5498, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: j3wIEvE5Sj.elf PID: 5498, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: j3wIEvE5Sj.elf PID: 5500, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: j3wIEvE5Sj.elf PID: 5500, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.spre.troj.linELF@0/0@2/0

Source: /usr/bin/dash (PID: 5485)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.VPcrEpfrQW /tmp/tmp.jJFrqEYoep /tmp/tmp.V1PhRH8nNb			Jump to behavior
Source: /usr/bin/dash (PID: 5486)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.VPcrEpfrQW /tmp/tmp.jJFrqEYoep /tmp/tmp.V1PhRH8nNb			Jump to behavior

Source: /tmp/j3wIEvE5Sj.elf (PID: 5498)

Queries kernel information via 'uname':

Jump to behavior

Source: j3wIEvE5Sj.elf, 5498.1.00007ffd412cd000.00007ffd412ee000.rw-.sdmp, j3wIEvE5Sj.elf, 5500.1.00007ffd412cd000.00007ffd412ee000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/j3wIEvE5Sj.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/j3wIEvE5Sj.elf
Source: j3wIEvE5Sj.elf, 5498.1.000055a4f0ab5000.000055a4f0be3000.rw-.sdmp, j3wIEvE5Sj.elf, 5500.1.000055a4f0ab5000.000055a4f0be3000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: j3wIEvE5Sj.elf, 5498.1.000055a4f0ab5000.000055a4f0be3000.rw-.sdmp, j3wIEvE5Sj.elf, 5500.1.000055a4f0ab5000.000055a4f0be3000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: j3wIEvE5Sj.elf, 5498.1.00007ffd412cd000.00007ffd412ee000.rw-.sdmp, j3wIEvE5Sj.elf, 5500.1.00007ffd412cd000.00007ffd412ee000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match	File source: j3wIEvE5Sj.elf, type: SAMPLE
Source: Yara match	File source: 5498.1.00007f4140017000.00007f414003b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5500.1.00007f4140017000.00007f414003b000.r-x.sdmp, type: MEMORY

Yara detected Mirai

Source: Yara match	File source: j3wIEvE5Sj.elf, type: SAMPLE
Source: Yara match	File source: 5498.1.00007f4140017000.00007f414003b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5500.1.00007f4140017000.00007f414003b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: j3wIEvE5Sj.elf PID: 5498, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: j3wIEvE5Sj.elf PID: 5500, type: MEMORYSTR

Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36
Source: Initial sample	User agent string found: Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; rv:2.2) Gecko/20110201
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.2; U; ru) Presto/2.5.22 Version/10.51
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko
Source: Initial sample	User agent string found: Mozilla/5.0 (Android; Linux armv7l; rv:9.0) Gecko/20111216 Firefox/9.0 Fennec/9.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60
Source: Initial sample	User agent string found: Mozilla/5.0 (iPad; U; CPU OS 5_1 like Mac OS X) AppleWebKit/531.21.10 (KHTML, like Gecko) Version/4.0.4 Mobile/7B367 Safari/531.21.10 UCBrowser/3.4.3.532
Source: Initial sample	User agent string found: Mozilla/5.0 (Nintendo WiiU) AppleWebKit/536.30 (KHTML, like Gecko) NX/3.0.4.2.12 NintendoBrowser/4.3.1.11264.US
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:25.0) Gecko/20100101 Firefox/25.0
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; pl) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; en) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; ja) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; cn) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; fr) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20100101 Firefox/12.0
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; U; Linux x86_64; de; rv:1.9.2.8) Gecko/20100723 Ubuntu/10.04 (lucid) Firefox/3.6.8
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; rv:13.0) Gecko/20100101 Firefox/13.0.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:11.0) Gecko/20100101 Firefox/11.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:13.0) Gecko/20100101 Firefox/13.0.1
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.289 Version/12.01
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.02
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.0) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.112 Safari/535.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en; rv:1.8.1.11) Gecko/20071128 Camino/1.5.4
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; cs; rv:1.9.2.6) Gecko/20100628 myibrow/4alpha2
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Win 9x 4.90; SG; rv:1.9.2.4) Gecko/20101104 Netscape/9.1.0285
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.2.0 Lightning/4.0.2
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10; rv:33.0) Gecko/20100101 Firefox/33.0

Remote Access Functionality

Yara detected Gafgyt

Source: Yara match	File source: j3wIEvE5Sj.elf, type: SAMPLE
Source: Yara match	File source: 5498.1.00007f4140017000.00007f414003b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5500.1.00007f4140017000.00007f414003b000.r-x.sdmp, type: MEMORY

Yara detected Mirai

Source: Yara match	File source: j3wIEvE5Sj.elf, type: SAMPLE
Source: Yara match	File source: 5498.1.00007f4140017000.00007f414003b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5500.1.00007f4140017000.00007f414003b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: j3wIEvE5Sj.elf PID: 5498, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: j3wIEvE5Sj.elf PID: 5500, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 File Deletion	LSASS Memory	1 Remote System Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

Threatname: Gafgyt

{"C2 url": "162.215.219.170:4444"}

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
j3wIEvE5Sj.elf	55%	ReversingLabs	Linux.Trojan.Gafgyt
j3wIEvE5Sj.elf	100%	Avira	LINUX/Gafgyt.opnd

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.24	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
162.215.219.170:4444	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://www.baidu.com/search/spider.html)	j3wIEvE5Sj.elf	false	unknown
http://www.billybobbot.com/crawler/)	j3wIEvE5Sj.elf	false	unknown
http://fast.no/support/crawler.asp)	j3wIEvE5Sj.elf	false	unknown
http://feedback.redkolibri.com/	j3wIEvE5Sj.elf	false	unknown
http://www.baidu.com/search/spider.htm)	j3wIEvE5Sj.elf	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
162.215.219.170	unknown	United States		46606	UNIFIEDLAYER-AS-1US	true

Joe Sandbox View / Context

IPs

⊘No context

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	GfPpov52Oc.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	5skkMenK5x.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	ssk7Ah3h5D.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	4Vw4aRxxGu.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	5FteLLQ1oY.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	gMYQFxufu0.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	k49syyxi7V.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	4LbWi40g57.elf	Get hash	malicious	Unknown	Browse	162.213.35.24

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
UNIFIEDLAYER-AS-1US	https://phisher-parts-production-us-east-1.s3.amazonaws.com/da08a569-c476-4c06-9e6f-9e3c8ae51232/2024-10-08/dm05v41jqt45dhgffdnn8f9og9hsqbgjjjhn2jo1/7abc4121254d93d61494ed63a8489e54fc18f49b8fee3f2e42bc06d8de3bd8f4?response-content-disposition=attachment%3B%20filename%3D%22Trailhead%20Media%2024-090.pdf%22%3B%20filename%2A%3DUTF-8%27%27Trailhead%2520Media%252024-090.pdf&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=ASIA37KREM2QGGSCSFZ4%2F20241008%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20241008T163442Z&X-Amz-Expires=13860&X-Amz-Security-Token=IQoJb3JpZ2luX2VjEO%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaCXVzLWVhc3QtMSJHMEUCIDgEEKEw%2BhLGwBtqA9K8lbT2NL7hbWhvf2%2BPjyD670ZwAiEAjxudbMDljL%2FUqXOnRGbBuWM4gt9lBw1st5sI4FM7vZ8q%2FwMIRxAAGgw4MjMxOTMyNjU4MjQiDFL6sO98KdRGT%2FyB6ircA40orR%2Bw3i4U%2B9phl56wCil07vS%2BjAp0tNBfyQAkuYLNSI62vBzUSfUh8AtFx4keNf0RgCCwE%2F5gCyMz9dJzZLyDD2IAKWq0%2BZVLBi%2F7b8rVNUO1YeOio8ujPMfp7PNvhweEfhhY8gWxNds6w8BqlSQW47gyG6lKcp0A7mT5WgKaRXw1WeqCAEMdJCJlPtEma%2BQC5iWhRM0pLWgiBkR6hefhuzg2Tz54kHG3UNQwcDWAaKnjqYhM7zFoyV4AQaheZ%2FfeYnY1yedYoX4pPvs1ESF9JlWKqYxq45XmyrelrdgZHdinsHB9NygBDgLYdQlVcA8q8aEDwM5yaKxZUCkRDUT%2BJb0%2BCtt9rbu6zRC%2FVmZKIGqbIpVGNy4amYEf%2BnSXLUdz7lVpXGsb3kLoOghblbHcyVEfagdESdqIrQuvWG9mqEGbD0OQjdCwVx4Q4jbP%2F64E0vyYOxW5KEhabAoO8CQ4rv8pn47DEAsuKYtGkCRN%2FxqSxHV6ean9UbkBuNzcfqn%2FVpGx3A2uxr7Lyff7MJArWEMXsvfWi5LKjU8A8WeqnHljxyB6lsfFsi3p6KnjmkR9k7rwdRb2wdfEKvrkoq5%2B9cMWCTkzI1xSuI12GZdP74XfakNrsOJTGxzpMOaBlbgGOqUB6EOKQuRv4stEwpQj1THsV61McwaeBhcQW1ZeiHMR%2FPMuUFHOTfzikGnzEF0dw579Pv6WD2vyvq7i7uJv%2BRQQTqPgYSf6GCpXd%2Bpo4bQXTs9GoUG1Dv0s2Tos1ZBR6T7%2BCdAb%2F%2BMYiPDy86%2FFbh1RI6E5jnVh%2ByCIGL%2Bg53Mj67qwCe%2F7aw%2B6TyAnJVcGnug9ml35ow0E3Vc4ob87u3B9PwqgKEDQ&X-Amz-SignedHeaders=host&X-Amz-Signature=e4981c31034331c2fd0b62d9cfd5b86f4ce28daacc9bf862502fbb9c444389d2	Get hash	malicious	HTMLPhisher	Browse	162.214.125.2
	https://hnt.zkg.mybluehost.me/CA/LET	Get hash	malicious	HTMLPhisher	Browse	50.6.153.248
	paymentremittanceinformationCQDM.html	Get hash	malicious	Unknown	Browse	69.49.245.172
	https://ipfs.io/ipfs/QmNRP5R9QkxB8MVgk2kWzrmB6GoTVL3gcLheGnJuUDPaXv?filename=forme.html#jstubblefield@securustechnologies.com	Get hash	malicious	HTMLPhisher	Browse	162.241.27.10
	NIJIMUN6pQ.exe	Get hash	malicious	AgentTesla	Browse	192.254.225.166
	5FRWRDOqk7.exe	Get hash	malicious	FormBook	Browse	162.240.81.18
	enkJ6J7dAn.exe	Get hash	malicious	FormBook	Browse	162.241.244.106
	Remittance_Raveis.htm	Get hash	malicious	Unknown	Browse	69.49.245.172
	vD6qU34v9S.exe	Get hash	malicious	AgentTesla	Browse	192.254.225.136
	na.elf	Get hash	malicious	Unknown	Browse	50.6.126.101

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	6.171925859996181
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	j3wIEvE5Sj.elf
File size:	210'270 bytes
MD5:	ddae85e0bc68d7f404786af4df45af91
SHA1:	906816cef8098f737edcc3dc2fe64bf2261fcd85
SHA256:	360f444b0d1a6295ddaa674e66d6e98b5ee4db2bc649e76e6961d41f9834ddb7
SHA512:	3c6ab48af50932939b4dc77f70c32d603269821df646db5339491a4dfbb1ebaf2ff04bffcfb89931f8cccdf595f2c421dc073f118577426cca84ff6a34483b56
SSDEEP:	6144:O08SAaiiwXVsXCtE+A5hhq6e6xV7/Iom0wfB5RyAn:O08SAaiiwXVssg5hhbzLm0mB5RyAn
TLSH:	66245C24E5404B57C2E323F9B68E824E3B3347E563D7330A5A345BB43FC2B9A1D66925
File Content Preview:	.ELF..............(.........4...........4. ...(........p.6.......... ... ............................7...7...............7...7...7......,u...............8...8...8..................Q.td..................................-...L..................G.F.G.F.G.F.G.

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x81d0
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	5
Section Header Offset:	173224
Section Header Size:	40
Number of Section Headers:	29
Header String Table Index:	26

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80d4	0xd4	0x10	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80f0	0xf0	0x1b7bc	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x238ac	0x1b8ac	0x10	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x238c0	0x1b8c0	0x7e04	0x0	0x2	A	0	0	8
.ARM.extab	PROGBITS	0x2b6c4	0x236c4	0x18	0x0	0x2	A	0	0	4
.ARM.exidx	ARM_EXIDX	0x2b6dc	0x236dc	0x120	0x0	0x82	AL	2	0	4
.eh_frame	PROGBITS	0x337fc	0x237fc	0x4	0x0	0x3	WA	0	0	4
.tbss	NOBITS	0x33800	0x23800	0x8	0x0	0x403	WAT	0	0	4
.init_array	INIT_ARRAY	0x33800	0x23800	0x4	0x0	0x3	WA	0	0	4
.fini_array	FINI_ARRAY	0x33804	0x23804	0x4	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x33808	0x23808	0x4	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x3380c	0x2380c	0xb0	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x338bc	0x238bc	0x310	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x33bd0	0x23bcc	0x7158	0x0	0x3	WA	0	0	8
.comment	PROGBITS	0x0	0x23bcc	0xc52	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x24820	0x140	0x0	0x0		0	0	8
.debug_pubnames	PROGBITS	0x0	0x24960	0x213	0x0	0x0		0	0	1
.debug_info	PROGBITS	0x0	0x24b73	0x2043	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x26bb6	0x6e2	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x27298	0xe76	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x28110	0x2b8	0x0	0x0		0	0	4
.debug_str	PROGBITS	0x0	0x283c8	0x8ca	0x1	0x30	MS	0	0	1
.debug_loc	PROGBITS	0x0	0x28c92	0x118f	0x0	0x0		0	0	1
.debug_ranges	PROGBITS	0x0	0x29e21	0x558	0x0	0x0		0	0	1
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x2a379	0x16	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x2a38f	0x117	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x2a930	0x5d00	0x10	0x0		28	843	4
.strtab	STRTAB	0x0	0x30630	0x2f2e	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
EXIDX	0x236dc	0x2b6dc	0x2b6dc	0x120	0x120	4.4932	0x4	R	0x4	.ARM.exidx
LOAD	0x0	0x8000	0x8000	0x237fc	0x237fc	6.3502	0x5	R E	0x8000	.init .text .fini .rodata .ARM.extab .ARM.exidx
LOAD	0x237fc	0x337fc	0x337fc	0x3d0	0x752c	4.4037	0x6	RW	0x8000	.eh_frame .tbss .init_array .fini_array .jcr .got .data .bss
TLS	0x23800	0x33800	0x33800	0x0	0x8	0.0000	0x4	R	0x4	.tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x80d4	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80f0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x238ac	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x238c0	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x2b6c4	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x2b6dc	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x337fc	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x33800	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x33800	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x33804	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x33808	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x3380c	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x338bc	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x33bd0	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	19
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	20
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	21
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	22
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	23
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	24
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	25
$a	.symtab	0x80d4	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x238ac	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80e0	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x238b8	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x812c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8170	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x81d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x820c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x82dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x83b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x84f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x855c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x88ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x91f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x93e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x96bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9ad8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa91c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xaa88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xacd8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb34c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb48c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb5dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb740	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc88c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc9dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcba8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcd74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcf04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd094	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd75c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe4e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe6b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe818	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe97c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xee5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xefac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf0fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf2d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf424	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfa88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xff50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1010c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x103a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10954	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10a28	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11aa0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13a68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14098	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x148a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x149b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14af8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14b0c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14ba4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14c98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14d00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14d40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14d78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14da4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14ddc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14ebc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14ef4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14f38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14fbc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14ffc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1502c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x150a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x150d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15100	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15120	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15150	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15184	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15254	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15a20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15ac0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15b04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15cb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15d08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16278	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x162b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16370	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16380	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16390	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x163a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16440	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16460	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x164c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x165b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x165d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x166a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1679c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x167b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x168c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x168f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16950	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x169f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16a20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16a3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16aac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16af0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16b64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16ba8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16bf0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16c34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16ca4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16ce8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16d58	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16da4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16e2c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16e74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16eb8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16f7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16fe8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17998	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17e38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17e78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17fa0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17fb8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1805c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18114	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x181d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18278	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18308	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x183e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x184d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x185c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x185e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18600	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x187d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1889c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x189e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1900c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1905c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19428	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x194c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19524	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x196ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x196f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x197e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19914	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1996c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19974	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x199a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x199fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19a04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19a34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19a8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19a94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19ac4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19b1c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19b24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19b50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19bd8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19cb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19d74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19dc8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19e20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a20c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a360	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a8ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a930	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a9ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a9d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1aa60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1aa68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1aa74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1aa80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1aa90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1aad0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ab10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ab24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ab38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ab4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ab74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1abb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1abc8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ac08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ac48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1aca8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ad14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ada0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1add8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1aee8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1afb8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b07c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b12c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b218	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b5bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b610	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b634	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b6f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ba20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ba40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bea0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bfe0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c060	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c1c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c2a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c2d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c344	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c370	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c4cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ccc0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ce04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cf20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d1d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d57c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d6a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d750	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dbe0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dcd0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ddb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1de9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dee0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1df30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1df7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dff4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e034	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e058	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e0d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e1cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e4a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e5e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e9a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ea18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ea80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ecd4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ece0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ed18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ed70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1edc8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1edd4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ee38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ee7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1eff4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f13c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f160	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f320	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f378	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f454	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f51c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f54c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f5f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f62c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f650	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f700	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f7bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1fab4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1fc04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1fea0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ff98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x207a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x207fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20854	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20cb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20d48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20d94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x210d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21118	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x2119c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x211dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21250	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x212b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x212f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21370	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21380	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x213b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x214a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21554	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x215b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x215e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x217fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21868	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21914	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21d30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x221cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x2230c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22360	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x223ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x223f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22400	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22404	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22430	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x2243c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22448	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22668	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x227b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x227d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22834	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x228a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22958	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22978	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22abc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x23004	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x2300c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x23014	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x2301c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x230d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x2311c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x23830	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x23878	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8164	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x33804	0	NOTYPE	<unknown>	DEFAULT	10
$d	.symtab	0x81bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x33800	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x338c0	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x8200	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x338c4	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x82c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x83ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x84ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8558	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x88d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x91f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x93e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x96b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9ad0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa900	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x26214	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0xaa84	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xacd4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb348	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb488	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb5d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb73c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc870	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc9d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xcb94	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xcd60	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xcef8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd088	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd728	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe0d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe6ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe814	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe978	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xee58	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xefa8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf0f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf2cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf420	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xfa74	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xff4c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10104	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1039c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10950	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10a10	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11a44	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13a38	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1408c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14884	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x20	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x26	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x2c	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x4c	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x53	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x14b9c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14c88	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14cf8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14d3c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14d74	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14dd8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14eac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14ef0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14f34	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14fb4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14ff8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x150a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x150c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x150f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x339c0	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x29fc0	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x339c8	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x2a2c0	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1511c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1524c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x159fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2a5e8	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x15cb0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15cfc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16248	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x339d0	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x2a5f0	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x16368	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x165a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16698	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x168b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2a674	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x168e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x169f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16a9c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16ae8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16b5c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16ba0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16be8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16c2c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16c9c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16ce0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16d50	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16d9c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16e24	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16e6c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16eb0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16f70	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17974	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x339d4	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x17e1c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17e70	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17f8c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x339ec	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x18040	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x180f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x181b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1825c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x33a04	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x33a9c	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x18304	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x183d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x184c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x185b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2b1e0	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x187c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1887c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x33ab0	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x189c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18fe0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19058	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19400	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1951c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1969c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x197d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19904	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19910	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x199a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19a30	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19ac0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19cac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19d60	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19dc0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19e14	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a1c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x33ac8	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1a348	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a868	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a924	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a9a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a9d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1aa54	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1aacc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ab0c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ab6c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1abb0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ac04	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ac44	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1aca0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ad0c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ad9c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1add4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1aecc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1afb0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b070	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b124	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2b288	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1b204	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b5b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b6ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ba10	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1be6c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c050	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c1a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x33ad8	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x33ad4	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1c29c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1cca0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2b2e8	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1d1b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d564	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d6a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1dcc8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1dda8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1de94	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e0d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e1c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e48c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e5c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e980	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ea00	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ea70	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ecac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ed0c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x33bbc	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1edbc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ee34	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ee78	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f134	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f31c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f450	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f518	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f5ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f6f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1faa4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1fc00	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1fe8c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20760	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x33bc0	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x207f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2084c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20c68	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x33bc2	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x2b3a4	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x20d30	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x210c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x21198	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x211d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x21248	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x212b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x212f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x21360	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x215dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x217ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x21860	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x33bc4	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x2b3c4	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x2264c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x22ff4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x58	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	23
$d	.symtab	0x23c	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0xe39	0	NOTYPE	<unknown>	DEFAULT	23
$t	.symtab	0x80f0	0	NOTYPE	<unknown>	DEFAULT	2
C.108.5669	.symtab	0x26214	48	OBJECT	<unknown>	DEFAULT	4
C.11.5548	.symtab	0x2b250	12	OBJECT	<unknown>	DEFAULT	4
C.141.5976	.symtab	0x26688	24	OBJECT	<unknown>	DEFAULT	4
C.196.6576	.symtab	0x26ce4	12	OBJECT	<unknown>	DEFAULT	4
C.197.6577	.symtab	0x26c74	92	OBJECT	<unknown>	DEFAULT	4
C.199.6682	.symtab	0x276ac	1144	OBJECT	<unknown>	DEFAULT	4
C.202.6719	.symtab	0x29270	24	OBJECT	<unknown>	DEFAULT	4
C.205.6750	.symtab	0x29490	24	OBJECT	<unknown>	DEFAULT	4
C.216.6888	.symtab	0x296e8	1128	OBJECT	<unknown>	DEFAULT	4
C.257.7184	.symtab	0x29c54	96	OBJECT	<unknown>	DEFAULT	4
C.261.7232	.symtab	0x29de8	36	OBJECT	<unknown>	DEFAULT	4
C.5.5083	.symtab	0x2b288	24	OBJECT	<unknown>	DEFAULT	4
C.7.5370	.symtab	0x2b25c	12	OBJECT	<unknown>	DEFAULT	4
C.7.6078	.symtab	0x2a5c0	12	OBJECT	<unknown>	DEFAULT	4
C.7.6109	.symtab	0x2b2c4	12	OBJECT	<unknown>	DEFAULT	4
C.7.6182	.symtab	0x2b2a0	12	OBJECT	<unknown>	DEFAULT	4
C.8.6110	.symtab	0x2b2b8	12	OBJECT	<unknown>	DEFAULT	4
C.9.6119	.symtab	0x2b2ac	12	OBJECT	<unknown>	DEFAULT	4
DNSw	.symtab	0x1010c	664	FUNC	<unknown>	DEFAULT	2
HIPER_OVH	.symtab	0xe4e0	468	FUNC	<unknown>	DEFAULT	2
Laligned	.symtab	0x16488	0	NOTYPE	<unknown>	DEFAULT	2
Llastword	.symtab	0x164a4	0	NOTYPE	<unknown>	DEFAULT	2
Q	.symtab	0x33c08	16384	OBJECT	<unknown>	DEFAULT	14
Randhex	.symtab	0xf0fc	472	FUNC	<unknown>	DEFAULT	2
SendCloudflare	.symtab	0xcd74	400	FUNC	<unknown>	DEFAULT	2
SendDOMINATE	.symtab	0xf424	1636	FUNC	<unknown>	DEFAULT	2
SendHOME1	.symtab	0xe6b4	356	FUNC	<unknown>	DEFAULT	2
SendHOME2	.symtab	0xe818	356	FUNC	<unknown>	DEFAULT	2
SendHTTPCloudflare	.symtab	0xcf04	400	FUNC	<unknown>	DEFAULT	2
SendHTTPHex	.symtab	0xc9dc	460	FUNC	<unknown>	DEFAULT	2
SendOVH_STORM	.symtab	0xd75c	3460	FUNC	<unknown>	DEFAULT	2
SendSTD	.symtab	0xb34c	320	FUNC	<unknown>	DEFAULT	2
SendSTDHEX	.symtab	0xa91c	364	FUNC	<unknown>	DEFAULT	2
SendSTD_HEX	.symtab	0xb5dc	356	FUNC	<unknown>	DEFAULT	2
SendUDP	.symtab	0x9e00	1116	FUNC	<unknown>	DEFAULT	2
UDPRAW	.symtab	0xee5c	336	FUNC	<unknown>	DEFAULT	2
_Exit	.symtab	0x14c98	104	FUNC	<unknown>	DEFAULT	2
_GLOBAL_OFFSET_TABLE_	.symtab	0x3380c	0	OBJECT	<unknown>	HIDDEN	12
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_Unwind_Complete	.symtab	0x22400	4	FUNC	<unknown>	HIDDEN	2
_Unwind_DeleteException	.symtab	0x22404	44	FUNC	<unknown>	HIDDEN	2
_Unwind_ForcedUnwind	.symtab	0x230b4	36	FUNC	<unknown>	HIDDEN	2
_Unwind_GetCFA	.symtab	0x223f8	8	FUNC	<unknown>	HIDDEN	2
_Unwind_GetDataRelBase	.symtab	0x2243c	12	FUNC	<unknown>	HIDDEN	2
_Unwind_GetLanguageSpecificData	.symtab	0x230d8	68	FUNC	<unknown>	HIDDEN	2
_Unwind_GetRegionStart	.symtab	0x23878	52	FUNC	<unknown>	HIDDEN	2
_Unwind_GetTextRelBase	.symtab	0x22430	12	FUNC	<unknown>	HIDDEN	2
_Unwind_RaiseException	.symtab	0x23048	36	FUNC	<unknown>	HIDDEN	2
_Unwind_Resume	.symtab	0x2306c	36	FUNC	<unknown>	HIDDEN	2
_Unwind_Resume_or_Rethrow	.symtab	0x23090	36	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Get	.symtab	0x22360	76	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Pop	.symtab	0x22978	324	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Set	.symtab	0x223ac	76	FUNC	<unknown>	HIDDEN	2
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b	.symtab	0x339c0	4	OBJECT	<unknown>	DEFAULT	13
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x29fc0	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x33bc4	4	OBJECT	<unknown>	DEFAULT	13
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x2b3c4	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x339c8	4	OBJECT	<unknown>	DEFAULT	13
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x2a2c0	768	OBJECT	<unknown>	DEFAULT	4
__EH_FRAME_BEGIN__	.symtab	0x337fc	0	OBJECT	<unknown>	DEFAULT	7
__FRAME_END__	.symtab	0x337fc	0	OBJECT	<unknown>	DEFAULT	7
__GI___C_ctype_b	.symtab	0x339c0	4	OBJECT	<unknown>	HIDDEN	13
__GI___C_ctype_tolower	.symtab	0x33bc4	4	OBJECT	<unknown>	HIDDEN	13
__GI___C_ctype_toupper	.symtab	0x339c8	4	OBJECT	<unknown>	HIDDEN	13
__GI___close	.symtab	0x19930	100	FUNC	<unknown>	HIDDEN	2
__GI___close_nocancel	.symtab	0x19914	24	FUNC	<unknown>	HIDDEN	2
__GI___ctype_b	.symtab	0x339c4	4	OBJECT	<unknown>	HIDDEN	13
__GI___ctype_tolower	.symtab	0x33bc8	4	OBJECT	<unknown>	HIDDEN	13
__GI___ctype_toupper	.symtab	0x339cc	4	OBJECT	<unknown>	HIDDEN	13
__GI___errno_location	.symtab	0x15100	32	FUNC	<unknown>	HIDDEN	2
__GI___fcntl_nocancel	.symtab	0x14b0c	152	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x1d57c	300	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x1679c	24	FUNC	<unknown>	HIDDEN	2
__GI___libc_close	.symtab	0x19930	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x14ba4	244	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x199c0	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_read	.symtab	0x19ae0	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_write	.symtab	0x19a50	100	FUNC	<unknown>	HIDDEN	2
__GI___open	.symtab	0x199c0	100	FUNC	<unknown>	HIDDEN	2
__GI___open_nocancel	.symtab	0x199a4	24	FUNC	<unknown>	HIDDEN	2
__GI___read	.symtab	0x19ae0	100	FUNC	<unknown>	HIDDEN	2
__GI___read_nocancel	.symtab	0x19ac4	24	FUNC	<unknown>	HIDDEN	2
__GI___register_atfork	.symtab	0x19524	392	FUNC	<unknown>	HIDDEN	2
__GI___sigaddset	.symtab	0x16fa0	36	FUNC	<unknown>	HIDDEN	2
__GI___sigdelset	.symtab	0x16fc4	36	FUNC	<unknown>	HIDDEN	2
__GI___sigismember	.symtab	0x16f7c	36	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x19cf8	124	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x19dc8	88	FUNC	<unknown>	HIDDEN	2
__GI___write	.symtab	0x19a50	100	FUNC	<unknown>	HIDDEN	2
__GI___write_nocancel	.symtab	0x19a34	24	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x167b4	268	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x14c98	104	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x17e78	296	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x185c4	32	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x1ed70	88	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0x14d40	56	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x19930	100	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0x1add8	272	FUNC	<unknown>	HIDDEN	2
__GI_config_close	.symtab	0x1b540	52	FUNC	<unknown>	HIDDEN	2
__GI_config_open	.symtab	0x1b574	72	FUNC	<unknown>	HIDDEN	2
__GI_config_read	.symtab	0x1b218	808	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x16af0	116	FUNC	<unknown>	HIDDEN	2
__GI_execve	.symtab	0x1aad0	64	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x187d8	196	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x1b6f0	816	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x14ba4	244	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x1d1d0	940	FUNC	<unknown>	HIDDEN	2
__GI_fgetc	.symtab	0x1ccc0	324	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x1d57c	300	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x1ce04	284	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x1d6a8	160	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x1ba20	32	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x1905c	972	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x16278	56	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x1f13c	36	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x1f160	448	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x1edd4	100	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x162b0	188	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x1d57c	300	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x14d78	44	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x1ab10	20	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x1ab24	20	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x1ab38	20	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname	.symtab	0x16a20	28	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2	.symtab	0x16a3c	112	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2_r	.symtab	0x1e1cc	724	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x20d94	836	FUNC	<unknown>	HIDDEN	2
__GI_gethostname	.symtab	0x21118	132	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x1ab4c	40	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x196ac	72	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x14da4	56	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x16b64	68	FUNC	<unknown>	HIDDEN	2
__GI_gettimeofday	.symtab	0x1ab74	64	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x1abb4	20	FUNC	<unknown>	HIDDEN	2
__GI_htonl	.symtab	0x16900	32	FUNC	<unknown>	HIDDEN	2
__GI_htons	.symtab	0x168f0	16	FUNC	<unknown>	HIDDEN	2
__GI_inet_addr	.symtab	0x169f8	40	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x1e0d4	248	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa	.symtab	0x169dc	28	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa_r	.symtab	0x16950	140	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x1fc04	668	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x1f88c	552	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x183e0	248	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x14ddc	224	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x1e034	36	FUNC	<unknown>	HIDDEN	2
__GI_isspace	.symtab	0x150a8	40	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x14ebc	56	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x212f4	112	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x1dbe0	240	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x16390	4	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x21370	4	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x1f62c	36	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x1dcd0	224	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x163a0	156	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x1a930	124	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x1ee38	68	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x1abc8	64	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x1ac48	96	FUNC	<unknown>	HIDDEN	2
__GI_ntohl	.symtab	0x16930	32	FUNC	<unknown>	HIDDEN	2
__GI_ntohs	.symtab	0x16920	16	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x199c0	100	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0x1afb8	196	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x211dc	116	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x196f4	240	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x17fb8	164	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x18278	144	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x1f650	176	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x19ae0	100	FUNC	<unknown>	HIDDEN	2
__GI_readdir64	.symtab	0x1b12c	236	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x16c34	112	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x1aca8	108	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x14f38	132	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x16ce8	112	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x16da4	136	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x14fbc	64	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x16e2c	72	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x184d8	236	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x1a9d8	136	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x16eb8	196	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x1ad14	140	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x197e4	300	FUNC	<unknown>	HIDDEN	2
__GI_snprintf	.symtab	0x15120	48	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x16e74	68	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x15150	52	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x18308	216	FUNC	<unknown>	HIDDEN	2
__GI_stat	.symtab	0x21250	100	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x217fc	108	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x164c0	240	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul	.symtab	0x1ddb0	236	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x16440	28	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x16440	28	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x165b0	36	FUNC	<unknown>	HIDDEN	2
__GI_strcspn	.symtab	0x1de9c	68	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x21380	52	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x16460	96	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x1f700	188	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x165d4	204	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x1dff4	64	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x1dee0	80	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x1df30	76	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x166a0	252	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x168c0	48	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x1df7c	120	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x185e4	28	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x189e8	1572	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x1e058	124	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x14ffc	48	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x150d0	48	FUNC	<unknown>	HIDDEN	2
__GI_uname	.symtab	0x212b4	64	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x15184	208	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x1ada0	56	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x1502c	124	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x1b5bc	84	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x1b634	188	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x1b610	36	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x19a50	100	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x33808	0	OBJECT	<unknown>	DEFAULT	11
__JCR_LIST__	.symtab	0x33808	0	OBJECT	<unknown>	DEFAULT	11
___Unwind_ForcedUnwind	.symtab	0x230b4	36	FUNC	<unknown>	HIDDEN	2
___Unwind_RaiseException	.symtab	0x23048	36	FUNC	<unknown>	HIDDEN	2
___Unwind_Resume	.symtab	0x2306c	36	FUNC	<unknown>	HIDDEN	2
___Unwind_Resume_or_Rethrow	.symtab	0x23090	36	FUNC	<unknown>	HIDDEN	2
__adddf3	.symtab	0x21920	784	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmpeq	.symtab	0x2227c	24	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmple	.symtab	0x2227c	24	FUNC	<unknown>	HIDDEN	2
__aeabi_cdrcmple	.symtab	0x22260	52	FUNC	<unknown>	HIDDEN	2
__aeabi_d2uiz	.symtab	0x2230c	84	FUNC	<unknown>	HIDDEN	2
__aeabi_dadd	.symtab	0x21920	784	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpeq	.symtab	0x22294	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpge	.symtab	0x222dc	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpgt	.symtab	0x222f4	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmple	.symtab	0x222c4	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmplt	.symtab	0x222ac	24	FUNC	<unknown>	HIDDEN	2
__aeabi_ddiv	.symtab	0x21fc0	524	FUNC	<unknown>	HIDDEN	2
__aeabi_dmul	.symtab	0x21d30	656	FUNC	<unknown>	HIDDEN	2
__aeabi_drsub	.symtab	0x21914	0	FUNC	<unknown>	HIDDEN	2
__aeabi_dsub	.symtab	0x2191c	788	FUNC	<unknown>	HIDDEN	2
__aeabi_f2d	.symtab	0x21c7c	64	FUNC	<unknown>	HIDDEN	2
__aeabi_i2d	.symtab	0x21c54	40	FUNC	<unknown>	HIDDEN	2
__aeabi_idiv	.symtab	0x149b4	0	FUNC	<unknown>	HIDDEN	2
__aeabi_idivmod	.symtab	0x14ae0	24	FUNC	<unknown>	HIDDEN	2
__aeabi_l2d	.symtab	0x21cd0	96	FUNC	<unknown>	HIDDEN	2
__aeabi_read_tp	.symtab	0x1aa80	8	FUNC	<unknown>	DEFAULT	2
__aeabi_ui2d	.symtab	0x21c30	36	FUNC	<unknown>	HIDDEN	2
__aeabi_uidiv	.symtab	0x148a0	0	FUNC	<unknown>	HIDDEN	2
__aeabi_uidivmod	.symtab	0x1499c	24	FUNC	<unknown>	HIDDEN	2
__aeabi_ul2d	.symtab	0x21cbc	116	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr0	.symtab	0x23014	8	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr1	.symtab	0x2300c	8	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr2	.symtab	0x23004	8	FUNC	<unknown>	HIDDEN	2
__app_fini	.symtab	0x38350	4	OBJECT	<unknown>	HIDDEN	14
__atexit_lock	.symtab	0x33ab0	24	OBJECT	<unknown>	DEFAULT	13
__bss_end__	.symtab	0x3ad28	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start	.symtab	0x33bcc	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start__	.symtab	0x33bcc	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x19d74	84	FUNC	<unknown>	DEFAULT	2
__close	.symtab	0x19930	100	FUNC	<unknown>	DEFAULT	2
__close_nameservers	.symtab	0x20cb0	152	FUNC	<unknown>	HIDDEN	2
__close_nocancel	.symtab	0x19914	24	FUNC	<unknown>	DEFAULT	2
__cmpdf2	.symtab	0x221dc	132	FUNC	<unknown>	HIDDEN	2
__ctype_b	.symtab	0x339c4	4	OBJECT	<unknown>	DEFAULT	13
__ctype_tolower	.symtab	0x33bc8	4	OBJECT	<unknown>	DEFAULT	13
__ctype_toupper	.symtab	0x339cc	4	OBJECT	<unknown>	DEFAULT	13
__curbrk	.symtab	0x3a8e4	4	OBJECT	<unknown>	HIDDEN	14
__cxa_begin_cleanup	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__cxa_call_unexpected	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__cxa_type_match	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__data_start	.symtab	0x338bc	0	NOTYPE	<unknown>	DEFAULT	13
__decode_dotted	.symtab	0x1fea0	248	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x214a0	180	FUNC	<unknown>	HIDDEN	2
__default_rt_sa_restorer	.symtab	0x1aa78	0	FUNC	<unknown>	DEFAULT	2
__default_sa_restorer	.symtab	0x1aa6c	0	FUNC	<unknown>	DEFAULT	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__div0	.symtab	0x14af8	20	FUNC	<unknown>	HIDDEN	2
__divdf3	.symtab	0x21fc0	524	FUNC	<unknown>	HIDDEN	2
__divsi3	.symtab	0x149b4	300	FUNC	<unknown>	HIDDEN	2
__dns_lookup	.symtab	0x1ff98	2064	FUNC	<unknown>	HIDDEN	2
__do_global_dtors_aux	.symtab	0x812c	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux_fini_array_entry	.symtab	0x33804	0	OBJECT	<unknown>	DEFAULT	10
__dso_handle	.symtab	0x338bc	0	OBJECT	<unknown>	HIDDEN	13
__encode_dotted	.symtab	0x21868	172	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x213b4	236	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x21554	96	FUNC	<unknown>	HIDDEN	2
__end__	.symtab	0x3ad28	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__environ	.symtab	0x38348	4	OBJECT	<unknown>	DEFAULT	14
__eqdf2	.symtab	0x221dc	132	FUNC	<unknown>	HIDDEN	2
__errno_location	.symtab	0x15100	32	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exidx_end	.symtab	0x2b7fc	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exidx_start	.symtab	0x2b6dc	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x37df8	4	OBJECT	<unknown>	HIDDEN	14
__extendsfdf2	.symtab	0x21c7c	64	FUNC	<unknown>	HIDDEN	2
__fcntl_nocancel	.symtab	0x14b0c	152	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x1d57c	300	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x33808	0	NOTYPE	<unknown>	HIDDEN	10
__fini_array_start	.symtab	0x33804	0	NOTYPE	<unknown>	HIDDEN	10
__fixunsdfsi	.symtab	0x2230c	84	FUNC	<unknown>	HIDDEN	2
__floatdidf	.symtab	0x21cd0	96	FUNC	<unknown>	HIDDEN	2
__floatsidf	.symtab	0x21c54	40	FUNC	<unknown>	HIDDEN	2
__floatundidf	.symtab	0x21cbc	116	FUNC	<unknown>	HIDDEN	2
__floatunsidf	.symtab	0x21c30	36	FUNC	<unknown>	HIDDEN	2
__fork	.symtab	0x1905c	972	FUNC	<unknown>	DEFAULT	2
__fork_generation_pointer	.symtab	0x3ace0	4	OBJECT	<unknown>	HIDDEN	14
__fork_handlers	.symtab	0x3ace4	4	OBJECT	<unknown>	HIDDEN	14
__fork_lock	.symtab	0x37dfc	4	OBJECT	<unknown>	HIDDEN	14
__frame_dummy_init_array_entry	.symtab	0x33800	0	OBJECT	<unknown>	DEFAULT	9
__gedf2	.symtab	0x221cc	148	FUNC	<unknown>	HIDDEN	2
__get_hosts_byname_r	.symtab	0x20d48	76	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x1eff4	328	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x1ab4c	40	FUNC	<unknown>	DEFAULT	2
__getpid	.symtab	0x196ac	72	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x1679c	24	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__gnu_Unwind_Find_exidx	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__gnu_Unwind_ForcedUnwind	.symtab	0x227b8	28	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_RaiseException	.symtab	0x228a0	184	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Restore_VFP	.symtab	0x23038	0	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Resume	.symtab	0x22834	108	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Resume_or_Rethrow	.symtab	0x22958	32	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Save_VFP	.symtab	0x23040	0	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_execute	.symtab	0x2311c	1812	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_frame	.symtab	0x23830	72	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_pr_common	.symtab	0x22abc	1352	FUNC	<unknown>	DEFAULT	2
__gtdf2	.symtab	0x221cc	148	FUNC	<unknown>	HIDDEN	2
__h_errno_location	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__init_array_end	.symtab	0x33804	0	NOTYPE	<unknown>	HIDDEN	9
__init_array_start	.symtab	0x33800	0	NOTYPE	<unknown>	HIDDEN	9
__ledf2	.symtab	0x221d4	140	FUNC	<unknown>	HIDDEN	2
__libc_close	.symtab	0x19930	100	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x16af0	116	FUNC	<unknown>	DEFAULT	2
__libc_disable_asynccancel	.symtab	0x19b50	136	FUNC	<unknown>	HIDDEN	2
__libc_enable_asynccancel	.symtab	0x19bd8	220	FUNC	<unknown>	HIDDEN	2
__libc_errno	.symtab	0x0	4	TLS	<unknown>	HIDDEN	8
__libc_fcntl	.symtab	0x14ba4	244	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x1905c	972	FUNC	<unknown>	DEFAULT	2
__libc_h_errno	.symtab	0x4	4	TLS	<unknown>	HIDDEN	8
__libc_multiple_threads	.symtab	0x3ace8	4	OBJECT	<unknown>	HIDDEN	14
__libc_nanosleep	.symtab	0x1ac48	96	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x199c0	100	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x19ae0	100	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x16c34	112	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x14f38	132	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x16ce8	112	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x16da4	136	FUNC	<unknown>	DEFAULT	2
__libc_setup_tls	.symtab	0x1eaa4	560	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x1a9d8	136	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x38344	4	OBJECT	<unknown>	DEFAULT	14
__libc_system	.symtab	0x1a8ac	132	FUNC	<unknown>	DEFAULT	2
__libc_waitpid	.symtab	0x1502c	124	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x19a50	100	FUNC	<unknown>	DEFAULT	2
__linkin_atfork	.symtab	0x194c0	100	FUNC	<unknown>	HIDDEN	2
__lll_lock_wait_private	.symtab	0x19428	152	FUNC	<unknown>	HIDDEN	2
__local_nameserver	.symtab	0x2b3a4	16	OBJECT	<unknown>	HIDDEN	4
__ltdf2	.symtab	0x221d4	140	FUNC	<unknown>	HIDDEN	2
__malloc_consolidate	.symtab	0x17a48	436	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x16fe8	120	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x339d4	24	OBJECT	<unknown>	DEFAULT	13
__malloc_state	.symtab	0x3a968	888	OBJECT	<unknown>	DEFAULT	14
__malloc_trim	.symtab	0x17998	176	FUNC	<unknown>	DEFAULT	2
__muldf3	.symtab	0x21d30	656	FUNC	<unknown>	HIDDEN	2
__nameserver	.symtab	0x3ad1c	4	OBJECT	<unknown>	HIDDEN	14
__nameservers	.symtab	0x3ad20	4	OBJECT	<unknown>	HIDDEN	14
__nedf2	.symtab	0x221dc	132	FUNC	<unknown>	HIDDEN	2
__nptl_deallocate_tsd	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__nptl_nthreads	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__open	.symtab	0x199c0	100	FUNC	<unknown>	DEFAULT	2
__open_etc_hosts	.symtab	0x215b4	48	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x20854	1116	FUNC	<unknown>	HIDDEN	2
__open_nocancel	.symtab	0x199a4	24	FUNC	<unknown>	DEFAULT	2
__pagesize	.symtab	0x3834c	4	OBJECT	<unknown>	DEFAULT	14
__preinit_array_end	.symtab	0x33800	0	NOTYPE	<unknown>	HIDDEN	8
__preinit_array_start	.symtab	0x33800	0	NOTYPE	<unknown>	HIDDEN	8
__progname	.symtab	0x33acc	4	OBJECT	<unknown>	DEFAULT	13
__progname_full	.symtab	0x33ad0	4	OBJECT	<unknown>	DEFAULT	13
__pthread_initialize_minimal	.symtab	0x1ecd4	12	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_init	.symtab	0x19cbc	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x19cb4	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x19cb4	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x19cb4	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x19cb4	8	FUNC	<unknown>	DEFAULT	2
__pthread_unwind	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__read	.symtab	0x19ae0	100	FUNC	<unknown>	DEFAULT	2
__read_etc_hosts_r	.symtab	0x215e4	536	FUNC	<unknown>	HIDDEN	2
__read_nocancel	.symtab	0x19ac4	24	FUNC	<unknown>	DEFAULT	2
__register_atfork	.symtab	0x19524	392	FUNC	<unknown>	DEFAULT	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__res_sync	.symtab	0x3ad14	4	OBJECT	<unknown>	HIDDEN	14
__resolv_attempts	.symtab	0x33bc3	1	OBJECT	<unknown>	HIDDEN	13
__resolv_lock	.symtab	0x3a8ec	24	OBJECT	<unknown>	DEFAULT	14
__resolv_timeout	.symtab	0x33bc2	1	OBJECT	<unknown>	HIDDEN	13
__restore_core_regs	.symtab	0x2301c	28	FUNC	<unknown>	HIDDEN	2
__rtld_fini	.symtab	0x38354	4	OBJECT	<unknown>	HIDDEN	14
__searchdomain	.symtab	0x3ad18	4	OBJECT	<unknown>	HIDDEN	14
__searchdomains	.symtab	0x3ad24	4	OBJECT	<unknown>	HIDDEN	14
__sigaddset	.symtab	0x16fa0	36	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x16fc4	36	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x16f7c	36	FUNC	<unknown>	DEFAULT	2
__sigjmp_save	.symtab	0x210d8	64	FUNC	<unknown>	HIDDEN	2
__sigsetjmp	.symtab	0x1edc8	12	FUNC	<unknown>	DEFAULT	2
__stdin	.symtab	0x33ae4	4	OBJECT	<unknown>	DEFAULT	13
__stdio_READ	.symtab	0x1f320	88	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x1f378	220	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x1f454	200	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x1bea0	320	FUNC	<unknown>	HIDDEN	2
__stdio_rfill	.symtab	0x1f51c	48	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x1f5f0	60	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x1f54c	164	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x1c1c4	220	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x1c2a0	48	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x33ae8	4	OBJECT	<unknown>	DEFAULT	13
__subdf3	.symtab	0x2191c	788	FUNC	<unknown>	HIDDEN	2
__sys_connect	.symtab	0x16aac	68	FUNC	<unknown>	DEFAULT	2
__sys_recv	.symtab	0x16bf0	68	FUNC	<unknown>	DEFAULT	2
__sys_send	.symtab	0x16ca4	68	FUNC	<unknown>	DEFAULT	2
__sys_sendto	.symtab	0x16d58	76	FUNC	<unknown>	DEFAULT	2
__syscall_error	.symtab	0x1a9ac	44	FUNC	<unknown>	HIDDEN	2
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_nanosleep	.symtab	0x1ac08	64	FUNC	<unknown>	DEFAULT	2
__syscall_poll	.symtab	0x2119c	64	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction	.symtab	0x1aa90	64	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_select	.symtab	0x14ef4	68	FUNC	<unknown>	DEFAULT	2
__tls_get_addr	.symtab	0x1ea80	36	FUNC	<unknown>	DEFAULT	2
__uClibc_fini	.symtab	0x19cf8	124	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x19dc8	88	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x19e20	1004	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x33ac8	4	OBJECT	<unknown>	HIDDEN	13
__udivsi3	.symtab	0x148a0	252	FUNC	<unknown>	HIDDEN	2
__write	.symtab	0x19a50	100	FUNC	<unknown>	DEFAULT	2
__write_nocancel	.symtab	0x19a34	24	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r	.symtab	0x167b4	268	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__xstat32_conv	.symtab	0x1ef48	172	FUNC	<unknown>	HIDDEN	2
__xstat64_conv	.symtab	0x1ee7c	204	FUNC	<unknown>	HIDDEN	2
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_bss_custom_printf_spec	.symtab	0x37c08	10	OBJECT	<unknown>	DEFAULT	14
_bss_end__	.symtab	0x3ad28	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_call_via_fp	.symtab	0x811d	4	FUNC	<unknown>	HIDDEN	2
_call_via_ip	.symtab	0x8121	4	FUNC	<unknown>	HIDDEN	2
_call_via_lr	.symtab	0x8129	4	FUNC	<unknown>	HIDDEN	2
_call_via_r0	.symtab	0x80f1	4	FUNC	<unknown>	HIDDEN	2
_call_via_r1	.symtab	0x80f5	4	FUNC	<unknown>	HIDDEN	2
_call_via_r2	.symtab	0x80f9	4	FUNC	<unknown>	HIDDEN	2
_call_via_r3	.symtab	0x80fd	4	FUNC	<unknown>	HIDDEN	2
_call_via_r4	.symtab	0x8101	4	FUNC	<unknown>	HIDDEN	2
_call_via_r5	.symtab	0x8105	4	FUNC	<unknown>	HIDDEN	2
_call_via_r6	.symtab	0x8109	4	FUNC	<unknown>	HIDDEN	2
_call_via_r7	.symtab	0x810d	4	FUNC	<unknown>	HIDDEN	2
_call_via_r8	.symtab	0x8111	4	FUNC	<unknown>	HIDDEN	2
_call_via_r9	.symtab	0x8115	4	FUNC	<unknown>	HIDDEN	2
_call_via_sl	.symtab	0x8119	4	FUNC	<unknown>	HIDDEN	2
_call_via_sp	.symtab	0x8125	4	FUNC	<unknown>	HIDDEN	2
_charpad	.symtab	0x15254	84	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_custom_printf_arginfo	.symtab	0x3a910	40	OBJECT	<unknown>	HIDDEN	14
_custom_printf_handler	.symtab	0x3a938	40	OBJECT	<unknown>	HIDDEN	14
_custom_printf_spec	.symtab	0x339d0	4	OBJECT	<unknown>	HIDDEN	13
_dl_aux_init	.symtab	0x1ece0	56	FUNC	<unknown>	DEFAULT	2
_dl_init_static_tls	.symtab	0x33bbc	4	OBJECT	<unknown>	DEFAULT	13
_dl_nothread_init_static_tls	.symtab	0x1ed18	88	FUNC	<unknown>	HIDDEN	2

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-08T21:03:01.257924+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34002	162.215.219.170	4444	TCP
2024-10-08T21:03:02.805892+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34004	162.215.219.170	4444	TCP
2024-10-08T21:03:04.370007+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34006	162.215.219.170	4444	TCP
2024-10-08T21:03:05.935027+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34008	162.215.219.170	4444	TCP
2024-10-08T21:03:07.496523+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34010	162.215.219.170	4444	TCP
2024-10-08T21:03:09.059845+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34012	162.215.219.170	4444	TCP
2024-10-08T21:03:10.641121+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34014	162.215.219.170	4444	TCP
2024-10-08T21:03:12.198466+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34016	162.215.219.170	4444	TCP
2024-10-08T21:03:13.762163+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34018	162.215.219.170	4444	TCP
2024-10-08T21:03:15.325990+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34020	162.215.219.170	4444	TCP
2024-10-08T21:03:16.901639+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34022	162.215.219.170	4444	TCP
2024-10-08T21:03:18.464562+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34024	162.215.219.170	4444	TCP
2024-10-08T21:03:20.028846+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34026	162.215.219.170	4444	TCP
2024-10-08T21:03:21.611613+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34028	162.215.219.170	4444	TCP
2024-10-08T21:03:23.196518+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34030	162.215.219.170	4444	TCP
2024-10-08T21:03:24.780684+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34032	162.215.219.170	4444	TCP
2024-10-08T21:03:26.391122+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34034	162.215.219.170	4444	TCP
2024-10-08T21:03:28.076919+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34036	162.215.219.170	4444	TCP
2024-10-08T21:03:29.650504+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34038	162.215.219.170	4444	TCP
2024-10-08T21:03:31.229265+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34040	162.215.219.170	4444	TCP
2024-10-08T21:03:32.795217+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34042	162.215.219.170	4444	TCP
2024-10-08T21:03:34.375678+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34044	162.215.219.170	4444	TCP
2024-10-08T21:03:35.999654+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34046	162.215.219.170	4444	TCP
2024-10-08T21:03:37.607681+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34048	162.215.219.170	4444	TCP
2024-10-08T21:03:39.167479+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34050	162.215.219.170	4444	TCP
2024-10-08T21:03:40.990543+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34052	162.215.219.170	4444	TCP
2024-10-08T21:03:42.573403+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34054	162.215.219.170	4444	TCP
2024-10-08T21:03:44.153784+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34056	162.215.219.170	4444	TCP
2024-10-08T21:03:45.714570+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34058	162.215.219.170	4444	TCP
2024-10-08T21:03:47.276663+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34060	162.215.219.170	4444	TCP
2024-10-08T21:03:48.977724+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34062	162.215.219.170	4444	TCP
2024-10-08T21:03:50.542954+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34064	162.215.219.170	4444	TCP
2024-10-08T21:03:52.105749+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34066	162.215.219.170	4444	TCP
2024-10-08T21:03:53.671788+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34068	162.215.219.170	4444	TCP
2024-10-08T21:03:55.247948+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34070	162.215.219.170	4444	TCP
2024-10-08T21:03:56.808921+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34072	162.215.219.170	4444	TCP
2024-10-08T21:03:58.376598+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34074	162.215.219.170	4444	TCP
2024-10-08T21:03:59.969482+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34076	162.215.219.170	4444	TCP
2024-10-08T21:04:01.560411+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34078	162.215.219.170	4444	TCP
2024-10-08T21:04:03.141171+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34080	162.215.219.170	4444	TCP
2024-10-08T21:04:05.031953+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34082	162.215.219.170	4444	TCP
2024-10-08T21:04:06.896913+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34084	162.215.219.170	4444	TCP
2024-10-08T21:04:08.463899+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34086	162.215.219.170	4444	TCP
2024-10-08T21:04:10.037715+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34088	162.215.219.170	4444	TCP
2024-10-08T21:04:11.654450+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34090	162.215.219.170	4444	TCP
2024-10-08T21:04:13.219027+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34092	162.215.219.170	4444	TCP
2024-10-08T21:04:14.797960+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34094	162.215.219.170	4444	TCP
2024-10-08T21:04:16.374448+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34096	162.215.219.170	4444	TCP
2024-10-08T21:04:17.935062+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34098	162.215.219.170	4444	TCP
2024-10-08T21:04:19.517198+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34100	162.215.219.170	4444	TCP
2024-10-08T21:04:21.093332+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34102	162.215.219.170	4444	TCP
2024-10-08T21:04:22.696144+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34104	162.215.219.170	4444	TCP
2024-10-08T21:04:24.444037+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34106	162.215.219.170	4444	TCP
2024-10-08T21:04:26.033611+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34108	162.215.219.170	4444	TCP
2024-10-08T21:04:27.631607+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34110	162.215.219.170	4444	TCP
2024-10-08T21:04:29.231455+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34112	162.215.219.170	4444	TCP
2024-10-08T21:04:30.809525+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34114	162.215.219.170	4444	TCP
2024-10-08T21:04:32.369739+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34116	162.215.219.170	4444	TCP
2024-10-08T21:04:33.963229+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34118	162.215.219.170	4444	TCP
2024-10-08T21:04:35.549314+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34120	162.215.219.170	4444	TCP
2024-10-08T21:04:37.122311+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34122	162.215.219.170	4444	TCP
2024-10-08T21:04:38.684326+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34124	162.215.219.170	4444	TCP
2024-10-08T21:04:40.498610+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34126	162.215.219.170	4444	TCP
2024-10-08T21:04:42.061404+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34128	162.215.219.170	4444	TCP
2024-10-08T21:04:43.619888+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34130	162.215.219.170	4444	TCP
2024-10-08T21:04:45.606994+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34132	162.215.219.170	4444	TCP
2024-10-08T21:04:47.168483+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34134	162.215.219.170	4444	TCP
2024-10-08T21:04:48.783710+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34136	162.215.219.170	4444	TCP
2024-10-08T21:04:50.358891+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34138	162.215.219.170	4444	TCP
2024-10-08T21:04:51.933143+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34140	162.215.219.170	4444	TCP
2024-10-08T21:04:53.520583+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34142	162.215.219.170	4444	TCP
2024-10-08T21:04:55.090701+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34144	162.215.219.170	4444	TCP
2024-10-08T21:04:56.874363+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34146	162.215.219.170	4444	TCP
2024-10-08T21:04:58.435181+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34148	162.215.219.170	4444	TCP
2024-10-08T21:05:00.021573+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34150	162.215.219.170	4444	TCP
2024-10-08T21:05:01.590686+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34152	162.215.219.170	4444	TCP
2024-10-08T21:05:03.170471+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34154	162.215.219.170	4444	TCP
2024-10-08T21:05:04.732370+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34156	162.215.219.170	4444	TCP
2024-10-08T21:05:06.314802+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34158	162.215.219.170	4444	TCP
2024-10-08T21:05:07.903729+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34160	162.215.219.170	4444	TCP
2024-10-08T21:05:10.172407+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34162	162.215.219.170	4444	TCP
2024-10-08T21:05:11.745816+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34164	162.215.219.170	4444	TCP
2024-10-08T21:05:13.326639+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34166	162.215.219.170	4444	TCP
2024-10-08T21:05:14.889637+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34168	162.215.219.170	4444	TCP
2024-10-08T21:05:16.447927+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34170	162.215.219.170	4444	TCP
2024-10-08T21:05:18.011897+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34172	162.215.219.170	4444	TCP
2024-10-08T21:05:19.577524+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34174	162.215.219.170	4444	TCP
2024-10-08T21:05:21.136364+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34176	162.215.219.170	4444	TCP
2024-10-08T21:05:22.700277+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34178	162.215.219.170	4444	TCP
2024-10-08T21:05:24.263688+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34180	162.215.219.170	4444	TCP
2024-10-08T21:05:25.871454+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34182	162.215.219.170	4444	TCP
2024-10-08T21:05:27.459461+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34184	162.215.219.170	4444	TCP
2024-10-08T21:05:29.044295+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34186	162.215.219.170	4444	TCP
2024-10-08T21:05:30.624779+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34188	162.215.219.170	4444	TCP
2024-10-08T21:05:32.183376+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34190	162.215.219.170	4444	TCP
2024-10-08T21:05:33.729910+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34192	162.215.219.170	4444	TCP
2024-10-08T21:05:35.313999+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34194	162.215.219.170	4444	TCP
2024-10-08T21:05:36.929972+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34196	162.215.219.170	4444	TCP
2024-10-08T21:05:38.481063+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34198	162.215.219.170	4444	TCP
2024-10-08T21:05:40.060394+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34200	162.215.219.170	4444	TCP
2024-10-08T21:05:41.659882+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34202	162.215.219.170	4444	TCP
2024-10-08T21:05:43.219216+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34204	162.215.219.170	4444	TCP
2024-10-08T21:05:44.902241+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34206	162.215.219.170	4444	TCP
2024-10-08T21:05:46.455069+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34208	162.215.219.170	4444	TCP
2024-10-08T21:05:48.043520+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34210	162.215.219.170	4444	TCP
2024-10-08T21:05:49.694173+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34212	162.215.219.170	4444	TCP
2024-10-08T21:05:51.280686+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34214	162.215.219.170	4444	TCP
2024-10-08T21:05:52.857079+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34216	162.215.219.170	4444	TCP
2024-10-08T21:05:54.419768+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34218	162.215.219.170	4444	TCP
2024-10-08T21:05:55.987659+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34220	162.215.219.170	4444	TCP
2024-10-08T21:05:57.581773+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34222	162.215.219.170	4444	TCP
2024-10-08T21:05:59.313894+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34224	162.215.219.170	4444	TCP
2024-10-08T21:06:00.980896+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34226	162.215.219.170	4444	TCP
2024-10-08T21:06:02.580510+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34228	162.215.219.170	4444	TCP
2024-10-08T21:06:04.156868+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34230	162.215.219.170	4444	TCP
2024-10-08T21:06:05.731906+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34232	162.215.219.170	4444	TCP
2024-10-08T21:06:07.292840+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34234	162.215.219.170	4444	TCP
2024-10-08T21:06:08.856768+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34236	162.215.219.170	4444	TCP
2024-10-08T21:06:10.437995+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34238	162.215.219.170	4444	TCP
2024-10-08T21:06:12.015978+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34240	162.215.219.170	4444	TCP
2024-10-08T21:06:13.596474+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34242	162.215.219.170	4444	TCP
2024-10-08T21:06:15.174541+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34244	162.215.219.170	4444	TCP
2024-10-08T21:06:16.732513+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34246	162.215.219.170	4444	TCP
2024-10-08T21:06:18.531817+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34248	162.215.219.170	4444	TCP
2024-10-08T21:06:20.325079+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34250	162.215.219.170	4444	TCP
2024-10-08T21:06:21.984990+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34252	162.215.219.170	4444	TCP
2024-10-08T21:06:23.590372+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34254	162.215.219.170	4444	TCP
2024-10-08T21:06:25.167892+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34256	162.215.219.170	4444	TCP
2024-10-08T21:06:26.733516+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34258	162.215.219.170	4444	TCP
2024-10-08T21:06:28.560992+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34260	162.215.219.170	4444	TCP
2024-10-08T21:06:30.123693+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34262	162.215.219.170	4444	TCP
2024-10-08T21:06:31.717111+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34264	162.215.219.170	4444	TCP
2024-10-08T21:06:33.317568+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34266	162.215.219.170	4444	TCP
2024-10-08T21:06:34.972028+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	34268	162.215.219.170	4444	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 21:03:01.081532001 CEST	34002	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:01.256047010 CEST	4444	34002	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:01.256129026 CEST	34002	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:01.257924080 CEST	34002	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:01.263148069 CEST	4444	34002	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:02.799539089 CEST	4444	34002	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:02.800019026 CEST	34002	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:02.800704002 CEST	34004	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:02.804944992 CEST	4444	34002	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:02.805675983 CEST	4444	34004	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:02.805716038 CEST	34004	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:02.805891991 CEST	34004	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:02.811013937 CEST	4444	34004	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:04.362255096 CEST	4444	34004	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:04.362834930 CEST	34004	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:04.363636971 CEST	34006	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:04.368335009 CEST	4444	34004	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:04.369868040 CEST	4444	34006	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:04.369931936 CEST	34006	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:04.370007038 CEST	34006	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:04.375102043 CEST	4444	34006	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:05.928554058 CEST	4444	34006	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:05.928863049 CEST	34006	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:05.929622889 CEST	34008	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:05.934149027 CEST	4444	34006	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:05.934887886 CEST	4444	34008	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:05.934976101 CEST	34008	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:05.935026884 CEST	34008	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:05.940064907 CEST	4444	34008	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:07.490144968 CEST	4444	34008	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:07.490427017 CEST	34008	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:07.491369009 CEST	34010	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:07.495598078 CEST	4444	34008	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:07.496381998 CEST	4444	34010	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:07.496450901 CEST	34010	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:07.496522903 CEST	34010	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:07.501921892 CEST	4444	34010	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:09.053102016 CEST	4444	34010	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:09.053426981 CEST	34010	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:09.054192066 CEST	34012	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:09.059614897 CEST	4444	34010	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:09.059660912 CEST	4444	34012	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:09.059794903 CEST	34012	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:09.059844971 CEST	34012	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:09.065222025 CEST	4444	34012	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:10.634388924 CEST	4444	34012	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:10.634795904 CEST	34012	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:10.635724068 CEST	34014	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:10.639904022 CEST	4444	34012	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:10.640917063 CEST	4444	34014	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:10.641004086 CEST	34014	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:10.641120911 CEST	34014	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:10.646092892 CEST	4444	34014	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:12.191310883 CEST	4444	34014	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:12.191796064 CEST	34014	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:12.192702055 CEST	34016	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:12.196983099 CEST	4444	34014	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:12.198360920 CEST	4444	34016	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:12.198415041 CEST	34016	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:12.198466063 CEST	34016	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:12.204754114 CEST	4444	34016	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:13.754975080 CEST	4444	34016	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:13.755332947 CEST	34016	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:13.756205082 CEST	34018	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:13.760351896 CEST	4444	34016	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:13.762018919 CEST	4444	34018	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:13.762089968 CEST	34018	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:13.762162924 CEST	34018	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:13.767330885 CEST	4444	34018	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:15.319215059 CEST	4444	34018	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:15.319781065 CEST	34018	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:15.320646048 CEST	34020	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:15.325062990 CEST	4444	34018	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:15.325735092 CEST	4444	34020	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:15.325872898 CEST	34020	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:15.325989962 CEST	34020	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:15.331037045 CEST	4444	34020	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:16.894730091 CEST	4444	34020	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:16.895193100 CEST	34020	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:16.896400928 CEST	34022	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:16.900279999 CEST	4444	34020	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:16.901424885 CEST	4444	34022	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:16.901525974 CEST	34022	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:16.901638985 CEST	34022	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:16.906974077 CEST	4444	34022	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:18.457516909 CEST	4444	34022	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:18.457878113 CEST	34022	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:18.458857059 CEST	34024	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:18.464349985 CEST	4444	34022	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:18.464371920 CEST	4444	34024	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:18.464454889 CEST	34024	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:18.464561939 CEST	34024	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:18.469439983 CEST	4444	34024	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:20.022299051 CEST	4444	34024	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:20.022775888 CEST	34024	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:20.022775888 CEST	34024	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:20.023747921 CEST	34026	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:20.027679920 CEST	4444	34024	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:20.028676033 CEST	4444	34026	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:20.028846025 CEST	34026	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:20.028846025 CEST	34026	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:20.033981085 CEST	4444	34026	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:21.603497982 CEST	4444	34026	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:21.603972912 CEST	34026	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:21.604762077 CEST	34028	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:21.611433983 CEST	4444	34026	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:21.611485004 CEST	4444	34028	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:21.611546040 CEST	34028	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:21.611613035 CEST	34028	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:21.617312908 CEST	4444	34028	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:23.189842939 CEST	4444	34028	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:23.190308094 CEST	34028	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:23.191183090 CEST	34030	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:23.196106911 CEST	4444	34028	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:23.196177006 CEST	4444	34030	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:23.196404934 CEST	34030	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:23.196517944 CEST	34030	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:23.201725960 CEST	4444	34030	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:24.774216890 CEST	4444	34030	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:24.774571896 CEST	34030	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:24.775461912 CEST	34032	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:24.779700994 CEST	4444	34030	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:24.780554056 CEST	4444	34032	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:24.780626059 CEST	34032	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:24.780683994 CEST	34032	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:24.785572052 CEST	4444	34032	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:26.384052992 CEST	4444	34032	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:26.384254932 CEST	34032	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:26.384984016 CEST	34034	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:26.390381098 CEST	4444	34032	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:26.391011000 CEST	4444	34034	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:26.391077995 CEST	34034	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:26.391122103 CEST	34034	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:26.396111012 CEST	4444	34034	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:28.070570946 CEST	4444	34034	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:28.070951939 CEST	34034	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:28.071758986 CEST	34036	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:28.075900078 CEST	4444	34034	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:28.076704025 CEST	4444	34036	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:28.076833010 CEST	34036	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:28.076919079 CEST	34036	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:28.081815958 CEST	4444	34036	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:29.643282890 CEST	4444	34036	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:29.643620014 CEST	34036	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:29.645241022 CEST	34038	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:29.648627043 CEST	4444	34036	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:29.650116920 CEST	4444	34038	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:29.650199890 CEST	34038	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:29.650504112 CEST	34038	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:29.655534029 CEST	4444	34038	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:31.222634077 CEST	4444	34038	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:31.223123074 CEST	34038	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:31.223934889 CEST	34040	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:31.228322029 CEST	4444	34038	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:31.229036093 CEST	4444	34040	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:31.229264021 CEST	34040	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:31.229264975 CEST	34040	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:31.234829903 CEST	4444	34040	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:32.788240910 CEST	4444	34040	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:32.788597107 CEST	34040	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:32.789861917 CEST	34042	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:32.793596983 CEST	4444	34040	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:32.795021057 CEST	4444	34042	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:32.795101881 CEST	34042	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:32.795217037 CEST	34042	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:32.800055981 CEST	4444	34042	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:34.367680073 CEST	4444	34042	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:34.368211031 CEST	34042	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:34.369291067 CEST	34044	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:34.374180079 CEST	4444	34042	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:34.375431061 CEST	4444	34044	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:34.375530005 CEST	34044	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:34.375678062 CEST	34044	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:34.380954981 CEST	4444	34044	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:35.993469954 CEST	4444	34044	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:35.993683100 CEST	34044	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:35.994740963 CEST	34046	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:35.998637915 CEST	4444	34044	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:35.999537945 CEST	4444	34046	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:35.999594927 CEST	34046	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:35.999654055 CEST	34046	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:36.005198002 CEST	4444	34046	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:37.601398945 CEST	4444	34046	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:37.601754904 CEST	34046	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:37.602615118 CEST	34048	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:37.606812000 CEST	4444	34046	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:37.607561111 CEST	4444	34048	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:37.607624054 CEST	34048	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:37.607681036 CEST	34048	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:37.612548113 CEST	4444	34048	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:39.160639048 CEST	4444	34048	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:39.160938978 CEST	34048	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:39.162096977 CEST	34050	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:39.165878057 CEST	4444	34048	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:39.167279959 CEST	4444	34050	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:39.167359114 CEST	34050	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:39.167479038 CEST	34050	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:39.172559977 CEST	4444	34050	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:40.980194092 CEST	4444	34050	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:40.980480909 CEST	34050	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:40.981148958 CEST	34052	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:40.988535881 CEST	4444	34050	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:40.988627911 CEST	34050	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:40.990394115 CEST	4444	34050	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:40.990408897 CEST	4444	34052	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:40.990489006 CEST	34052	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:40.990542889 CEST	34052	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:40.996309042 CEST	4444	34052	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:42.566637993 CEST	4444	34052	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:42.566869974 CEST	34052	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:42.567714930 CEST	34054	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:42.571903944 CEST	4444	34052	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:42.573281050 CEST	4444	34054	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:42.573334932 CEST	34054	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:42.573402882 CEST	34054	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:42.579421997 CEST	4444	34054	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:44.146359921 CEST	4444	34054	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:44.146650076 CEST	34054	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:44.148142099 CEST	34056	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:44.151971102 CEST	4444	34054	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:44.153537989 CEST	4444	34056	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:44.153609991 CEST	34056	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:44.153784037 CEST	34056	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:44.159778118 CEST	4444	34056	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:45.707314014 CEST	4444	34056	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:45.707870007 CEST	34056	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:45.708806992 CEST	34058	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:45.713016987 CEST	4444	34056	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:45.714339972 CEST	4444	34058	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:45.714462042 CEST	34058	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:45.714570045 CEST	34058	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:45.719547987 CEST	4444	34058	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:47.270411015 CEST	4444	34058	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:47.270896912 CEST	34058	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:47.271600008 CEST	34060	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:47.276309967 CEST	4444	34058	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:47.276453972 CEST	4444	34060	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:47.276556969 CEST	34060	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:47.276663065 CEST	34060	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:47.282257080 CEST	4444	34060	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:48.970841885 CEST	4444	34060	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:48.971277952 CEST	34060	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:48.972275019 CEST	34062	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:48.976465940 CEST	4444	34060	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:48.977585077 CEST	4444	34062	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:48.977657080 CEST	34062	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:48.977724075 CEST	34062	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:48.983227968 CEST	4444	34062	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:50.536180973 CEST	4444	34062	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:50.536770105 CEST	34062	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:50.537591934 CEST	34064	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:50.541739941 CEST	4444	34062	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:50.542776108 CEST	4444	34064	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:50.542851925 CEST	34064	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:50.542953968 CEST	34064	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:50.547889948 CEST	4444	34064	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:52.099139929 CEST	4444	34064	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:52.099524021 CEST	34064	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:52.100394011 CEST	34066	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:52.105108976 CEST	4444	34064	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:52.105572939 CEST	4444	34066	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:52.105645895 CEST	34066	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:52.105748892 CEST	34066	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:52.110688925 CEST	4444	34066	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:53.665342093 CEST	4444	34066	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:53.665702105 CEST	34066	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:53.666316032 CEST	34068	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:53.671099901 CEST	4444	34066	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:53.671679020 CEST	4444	34068	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:53.671742916 CEST	34068	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:53.671787977 CEST	34068	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:53.676702976 CEST	4444	34068	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:55.241544962 CEST	4444	34068	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:55.241803885 CEST	34068	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:55.242639065 CEST	34070	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:55.246836901 CEST	4444	34068	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:55.247811079 CEST	4444	34070	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:55.247898102 CEST	34070	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:55.247947931 CEST	34070	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:55.252953053 CEST	4444	34070	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:56.800885916 CEST	4444	34070	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:56.801409960 CEST	34070	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:56.803373098 CEST	34072	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:56.806629896 CEST	4444	34070	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:56.808732033 CEST	4444	34072	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:56.808921099 CEST	34072	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:56.808921099 CEST	34072	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:56.814003944 CEST	4444	34072	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:58.367070913 CEST	4444	34072	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:58.367690086 CEST	34072	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:58.369082928 CEST	34074	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:58.375068903 CEST	4444	34072	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:58.376332045 CEST	4444	34074	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:58.376597881 CEST	34074	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:58.376597881 CEST	34074	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:58.382256031 CEST	4444	34074	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:59.962687016 CEST	4444	34074	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:59.962970972 CEST	34074	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:59.963685036 CEST	34076	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:59.967999935 CEST	4444	34074	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:59.969337940 CEST	4444	34076	162.215.219.170	192.168.2.14
Oct 8, 2024 21:03:59.969409943 CEST	34076	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:59.969481945 CEST	34076	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:03:59.974694967 CEST	4444	34076	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:01.553708076 CEST	4444	34076	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:01.553941965 CEST	34076	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:01.555083036 CEST	34078	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:01.558907986 CEST	4444	34076	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:01.560254097 CEST	4444	34078	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:01.560369968 CEST	34078	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:01.560410976 CEST	34078	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:01.565414906 CEST	4444	34078	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:03.134654999 CEST	4444	34078	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:03.134982109 CEST	34078	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:03.135898113 CEST	34080	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:03.140058041 CEST	4444	34078	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:03.141009092 CEST	4444	34080	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:03.141098976 CEST	34080	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:03.141170979 CEST	34080	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:03.146819115 CEST	4444	34080	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:05.023969889 CEST	4444	34080	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:05.024487019 CEST	34080	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:05.024679899 CEST	4444	34080	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:05.024866104 CEST	34080	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:05.026029110 CEST	34082	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:05.030145884 CEST	4444	34080	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:05.031739950 CEST	4444	34082	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:05.031847954 CEST	34082	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:05.031953096 CEST	34082	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:05.037030935 CEST	4444	34082	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:06.890235901 CEST	4444	34082	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:06.890434980 CEST	4444	34082	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:06.890655041 CEST	34082	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:06.890655041 CEST	34082	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:06.891618967 CEST	34084	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:06.895935059 CEST	4444	34082	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:06.896718025 CEST	4444	34084	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:06.896795988 CEST	34084	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:06.896913052 CEST	34084	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:06.901911974 CEST	4444	34084	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:08.457268000 CEST	4444	34084	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:08.457587004 CEST	34084	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:08.458673954 CEST	34086	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:08.462678909 CEST	4444	34084	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:08.463676929 CEST	4444	34086	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:08.463766098 CEST	34086	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:08.463898897 CEST	34086	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:08.468947887 CEST	4444	34086	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:10.031018019 CEST	4444	34086	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:10.031317949 CEST	34086	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:10.032303095 CEST	34088	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:10.037296057 CEST	4444	34086	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:10.037540913 CEST	4444	34088	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:10.037655115 CEST	34088	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:10.037714958 CEST	34088	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:10.043869972 CEST	4444	34088	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:11.647432089 CEST	4444	34088	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:11.647898912 CEST	34088	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:11.649142027 CEST	34090	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:11.653032064 CEST	4444	34088	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:11.654227972 CEST	4444	34090	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:11.654325008 CEST	34090	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:11.654449940 CEST	34090	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:11.659626007 CEST	4444	34090	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:13.209882975 CEST	4444	34090	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:13.210058928 CEST	34090	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:13.211203098 CEST	34092	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:13.217255116 CEST	4444	34090	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:13.218911886 CEST	4444	34092	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:13.218976021 CEST	34092	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:13.219027042 CEST	34092	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:13.225851059 CEST	4444	34092	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:14.789581060 CEST	4444	34092	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:14.789998055 CEST	34092	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:14.791359901 CEST	34094	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:14.795913935 CEST	4444	34092	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:14.797763109 CEST	4444	34094	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:14.797848940 CEST	34094	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:14.797960043 CEST	34094	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:14.802947998 CEST	4444	34094	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:16.367250919 CEST	4444	34094	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:16.367578030 CEST	34094	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:16.368366003 CEST	34096	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:16.373346090 CEST	4444	34094	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:16.374273062 CEST	4444	34096	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:16.374350071 CEST	34096	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:16.374448061 CEST	34096	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:16.379618883 CEST	4444	34096	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:17.927222013 CEST	4444	34096	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:17.927704096 CEST	34096	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:17.928756952 CEST	34098	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:17.934092999 CEST	4444	34096	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:17.934693098 CEST	4444	34098	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:17.934788942 CEST	34098	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:17.935061932 CEST	34098	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:17.941854000 CEST	4444	34098	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:19.507584095 CEST	4444	34098	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:19.508001089 CEST	34098	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:19.508897066 CEST	34100	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:19.515798092 CEST	4444	34098	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:19.516988039 CEST	4444	34100	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:19.517090082 CEST	34100	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:19.517198086 CEST	34100	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:19.524900913 CEST	4444	34100	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:21.086719036 CEST	4444	34100	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:21.086937904 CEST	34100	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:21.088146925 CEST	34102	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:21.092152119 CEST	4444	34100	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:21.093095064 CEST	4444	34102	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:21.093220949 CEST	34102	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:21.093332052 CEST	34102	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:21.098220110 CEST	4444	34102	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:22.689502954 CEST	4444	34102	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:22.689877033 CEST	34102	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:22.690825939 CEST	34104	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:22.694941044 CEST	4444	34102	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:22.695911884 CEST	4444	34104	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:22.696053982 CEST	34104	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:22.696144104 CEST	34104	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:22.701093912 CEST	4444	34104	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:24.437169075 CEST	4444	34104	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:24.437576056 CEST	34104	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:24.438385010 CEST	34106	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:24.443555117 CEST	4444	34104	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:24.443881989 CEST	4444	34106	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:24.443969011 CEST	34106	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:24.444036961 CEST	34106	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:24.450485945 CEST	4444	34106	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:26.026623964 CEST	4444	34106	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:26.027069092 CEST	34106	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:26.028090000 CEST	34108	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:26.032250881 CEST	4444	34106	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:26.033395052 CEST	4444	34108	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:26.033494949 CEST	34108	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:26.033611059 CEST	34108	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:26.038611889 CEST	4444	34108	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:27.623629093 CEST	4444	34108	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:27.624027967 CEST	34108	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:27.624764919 CEST	34110	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:27.630851984 CEST	4444	34108	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:27.631417036 CEST	4444	34110	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:27.631500959 CEST	34110	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:27.631607056 CEST	34110	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:27.639096022 CEST	4444	34110	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:29.224037886 CEST	4444	34110	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:29.224231958 CEST	34110	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:29.225048065 CEST	34112	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:29.229429007 CEST	4444	34110	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:29.231322050 CEST	4444	34112	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:29.231389046 CEST	34112	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:29.231455088 CEST	34112	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:29.236721992 CEST	4444	34112	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:30.802241087 CEST	4444	34112	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:30.802680969 CEST	34112	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:30.804004908 CEST	34114	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:30.807878017 CEST	4444	34112	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:30.809071064 CEST	4444	34114	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:30.809360027 CEST	34114	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:30.809525013 CEST	34114	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:30.814560890 CEST	4444	34114	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:32.363418102 CEST	4444	34114	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:32.363713026 CEST	34114	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:32.364526033 CEST	34116	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:32.368613005 CEST	4444	34114	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:32.369549036 CEST	4444	34116	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:32.369632959 CEST	34116	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:32.369739056 CEST	34116	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:32.374644995 CEST	4444	34116	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:33.955888987 CEST	4444	34116	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:33.956460953 CEST	34116	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:33.957142115 CEST	34118	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:33.961687088 CEST	4444	34116	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:33.963083029 CEST	4444	34118	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:33.963165998 CEST	34118	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:33.963228941 CEST	34118	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:33.968123913 CEST	4444	34118	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:35.541655064 CEST	4444	34118	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:35.541858912 CEST	34118	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:35.542763948 CEST	34120	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:35.547694921 CEST	4444	34118	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:35.549165964 CEST	4444	34120	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:35.549237013 CEST	34120	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:35.549314022 CEST	34120	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:35.555771112 CEST	4444	34120	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:37.115972042 CEST	4444	34120	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:37.116302013 CEST	34120	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:37.116957903 CEST	34122	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:37.121630907 CEST	4444	34120	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:37.122181892 CEST	4444	34122	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:37.122256041 CEST	34122	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:37.122311115 CEST	34122	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:37.127341986 CEST	4444	34122	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:38.678359985 CEST	4444	34122	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:38.678623915 CEST	34122	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:38.679270983 CEST	34124	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:38.683645010 CEST	4444	34122	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:38.684179068 CEST	4444	34124	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:38.684257030 CEST	34124	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:38.684325933 CEST	34124	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:38.689796925 CEST	4444	34124	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:40.491082907 CEST	4444	34124	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:40.491328955 CEST	34124	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:40.492129087 CEST	4444	34124	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:40.492222071 CEST	34124	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:40.492525101 CEST	34126	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:40.497328043 CEST	4444	34124	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:40.498507023 CEST	4444	34126	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:40.498565912 CEST	34126	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:40.498610020 CEST	34126	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:40.503611088 CEST	4444	34126	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:42.055205107 CEST	4444	34126	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:42.055444956 CEST	34126	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:42.056272030 CEST	34128	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:42.060429096 CEST	4444	34126	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:42.061264038 CEST	4444	34128	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:42.061330080 CEST	34128	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:42.061403990 CEST	34128	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:42.066838980 CEST	4444	34128	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:43.613663912 CEST	4444	34128	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:43.614037991 CEST	34128	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:43.614815950 CEST	34130	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:43.619159937 CEST	4444	34128	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:43.619687080 CEST	4444	34130	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:43.619774103 CEST	34130	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:43.619888067 CEST	34130	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:43.624846935 CEST	4444	34130	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:45.596851110 CEST	4444	34130	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:45.597058058 CEST	34130	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:45.597784996 CEST	4444	34130	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:45.597789049 CEST	34132	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:45.597879887 CEST	34130	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:45.601852894 CEST	4444	34130	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:45.606858969 CEST	4444	34132	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:45.606950998 CEST	34132	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:45.606993914 CEST	34132	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:45.612112999 CEST	4444	34132	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:47.162384987 CEST	4444	34132	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:47.162640095 CEST	34132	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:47.163567066 CEST	34134	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:47.167783022 CEST	4444	34132	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:47.168353081 CEST	4444	34134	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:47.168431997 CEST	34134	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:47.168483019 CEST	34134	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:47.173404932 CEST	4444	34134	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:48.777717113 CEST	4444	34134	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:48.777919054 CEST	34134	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:48.778740883 CEST	34136	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:48.782825947 CEST	4444	34134	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:48.783524036 CEST	4444	34136	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:48.783610106 CEST	34136	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:48.783710003 CEST	34136	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:48.788665056 CEST	4444	34136	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:50.352582932 CEST	4444	34136	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:50.352771044 CEST	34136	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:50.353528976 CEST	34138	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:50.358603954 CEST	4444	34136	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:50.358642101 CEST	4444	34138	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:50.358737946 CEST	34138	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:50.358891010 CEST	34138	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:50.363924980 CEST	4444	34138	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:51.927257061 CEST	4444	34138	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:51.927429914 CEST	34138	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:51.927987099 CEST	34140	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:51.933015108 CEST	4444	34138	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:51.933031082 CEST	4444	34140	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:51.933096886 CEST	34140	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:51.933142900 CEST	34140	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:51.938144922 CEST	4444	34140	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:53.514388084 CEST	4444	34140	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:53.514624119 CEST	34140	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:53.515206099 CEST	34142	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:53.520423889 CEST	4444	34140	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:53.520442963 CEST	4444	34142	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:53.520523071 CEST	34142	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:53.520582914 CEST	34142	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:53.525791883 CEST	4444	34142	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:55.084112883 CEST	4444	34142	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:55.084306002 CEST	34142	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:55.085113049 CEST	34144	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:55.089755058 CEST	4444	34142	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:55.090538979 CEST	4444	34144	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:55.090609074 CEST	34144	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:55.090701103 CEST	34144	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:55.096223116 CEST	4444	34144	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:56.868338108 CEST	4444	34144	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:56.868679047 CEST	34144	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:56.869153023 CEST	34146	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:56.869664907 CEST	4444	34144	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:56.869735956 CEST	34144	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:56.873663902 CEST	4444	34144	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:56.874169111 CEST	4444	34146	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:56.874262094 CEST	34146	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:56.874362946 CEST	34146	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:56.879268885 CEST	4444	34146	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:58.428750038 CEST	4444	34146	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:58.429060936 CEST	34146	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:58.430074930 CEST	34148	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:58.434103012 CEST	4444	34146	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:58.435010910 CEST	4444	34148	162.215.219.170	192.168.2.14
Oct 8, 2024 21:04:58.435080051 CEST	34148	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:58.435180902 CEST	34148	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:04:58.440599918 CEST	4444	34148	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:00.011382103 CEST	4444	34148	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:00.011631966 CEST	34148	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:00.012244940 CEST	34150	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:00.018721104 CEST	4444	34148	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:00.021466017 CEST	4444	34150	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:00.021526098 CEST	34150	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:00.021573067 CEST	34150	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:00.029170990 CEST	4444	34150	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:01.584589958 CEST	4444	34150	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:01.584803104 CEST	34150	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:01.585691929 CEST	34152	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:01.589709044 CEST	4444	34150	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:01.590560913 CEST	4444	34152	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:01.590615988 CEST	34152	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:01.590686083 CEST	34152	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:01.601360083 CEST	4444	34152	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:03.163989067 CEST	4444	34152	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:03.164279938 CEST	34152	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:03.164946079 CEST	34154	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:03.169600964 CEST	4444	34152	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:03.170314074 CEST	4444	34154	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:03.170430899 CEST	34154	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:03.170470953 CEST	34154	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:03.175967932 CEST	4444	34154	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:04.725716114 CEST	4444	34154	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:04.726140976 CEST	34154	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:04.727103949 CEST	34156	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:04.731262922 CEST	4444	34154	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:04.732182026 CEST	4444	34156	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:04.732259035 CEST	34156	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:04.732369900 CEST	34156	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:04.737652063 CEST	4444	34156	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:06.307821989 CEST	4444	34156	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:06.308139086 CEST	34156	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:06.308880091 CEST	34158	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:06.313391924 CEST	4444	34156	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:06.314594984 CEST	4444	34158	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:06.314718008 CEST	34158	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:06.314801931 CEST	34158	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:06.319937944 CEST	4444	34158	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:07.897432089 CEST	4444	34158	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:07.897718906 CEST	34158	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:07.898521900 CEST	34160	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:07.902587891 CEST	4444	34158	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:07.903573990 CEST	4444	34160	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:07.903660059 CEST	34160	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:07.903728962 CEST	34160	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:07.908885002 CEST	4444	34160	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:10.162125111 CEST	4444	34160	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:10.162249088 CEST	4444	34160	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:10.162266970 CEST	34160	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:10.162308931 CEST	34160	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:10.162350893 CEST	4444	34160	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:10.162419081 CEST	34160	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:10.163080931 CEST	34162	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:10.167406082 CEST	4444	34160	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:10.172228098 CEST	4444	34162	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:10.172300100 CEST	34162	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:10.172406912 CEST	34162	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:10.178167105 CEST	4444	34162	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:11.739172935 CEST	4444	34162	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:11.739681959 CEST	34162	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:11.740474939 CEST	34164	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:11.745071888 CEST	4444	34162	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:11.745613098 CEST	4444	34164	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:11.745712042 CEST	34164	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:11.745815992 CEST	34164	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:11.750833035 CEST	4444	34164	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:13.319336891 CEST	4444	34164	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:13.319684982 CEST	34164	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:13.321018934 CEST	34166	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:13.324944019 CEST	4444	34164	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:13.326095104 CEST	4444	34166	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:13.326638937 CEST	34166	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:13.326638937 CEST	34166	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:13.331919909 CEST	4444	34166	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:14.883589983 CEST	4444	34166	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:14.884068012 CEST	34166	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:14.884644985 CEST	34168	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:14.888931036 CEST	4444	34166	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:14.889518023 CEST	4444	34168	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:14.889591932 CEST	34168	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:14.889636993 CEST	34168	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:14.894696951 CEST	4444	34168	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:16.441749096 CEST	4444	34168	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:16.442172050 CEST	34168	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:16.442842007 CEST	34170	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:16.447077036 CEST	4444	34168	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:16.447721004 CEST	4444	34170	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:16.447803974 CEST	34170	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:16.447926998 CEST	34170	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:16.452940941 CEST	4444	34170	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:18.005645037 CEST	4444	34170	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:18.006104946 CEST	34170	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:18.006920099 CEST	34172	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:18.011064053 CEST	4444	34170	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:18.011706114 CEST	4444	34172	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:18.011789083 CEST	34172	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:18.011897087 CEST	34172	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:18.016690016 CEST	4444	34172	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:19.568850994 CEST	4444	34172	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:19.569041967 CEST	34172	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:19.571649075 CEST	34174	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:19.575201035 CEST	4444	34172	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:19.577318907 CEST	4444	34174	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:19.577404022 CEST	34174	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:19.577523947 CEST	34174	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:19.583492041 CEST	4444	34174	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:21.129625082 CEST	4444	34174	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:21.129874945 CEST	34174	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:21.130553007 CEST	34176	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:21.135593891 CEST	4444	34174	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:21.136236906 CEST	4444	34176	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:21.136307955 CEST	34176	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:21.136363983 CEST	34176	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:21.141457081 CEST	4444	34176	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:22.693170071 CEST	4444	34176	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:22.693701029 CEST	34176	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:22.694355965 CEST	34178	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:22.700086117 CEST	4444	34176	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:22.700093985 CEST	4444	34178	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:22.700179100 CEST	34178	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:22.700277090 CEST	34178	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:22.706655979 CEST	4444	34178	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:24.255913019 CEST	4444	34178	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:24.256911039 CEST	34178	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:24.257776976 CEST	34180	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:24.261975050 CEST	4444	34178	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:24.263571024 CEST	4444	34180	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:24.263627052 CEST	34180	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:24.263688087 CEST	34180	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:24.268552065 CEST	4444	34180	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:25.864980936 CEST	4444	34180	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:25.865354061 CEST	34180	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:25.866405964 CEST	34182	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:25.870233059 CEST	4444	34180	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:25.871335983 CEST	4444	34182	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:25.871412992 CEST	34182	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:25.871454000 CEST	34182	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:25.876328945 CEST	4444	34182	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:27.453171968 CEST	4444	34182	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:27.453533888 CEST	34182	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:27.454236984 CEST	34184	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:27.459137917 CEST	4444	34182	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:27.459271908 CEST	4444	34184	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:27.459350109 CEST	34184	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:27.459460974 CEST	34184	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:27.468065977 CEST	4444	34184	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:29.037708998 CEST	4444	34184	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:29.038058996 CEST	34184	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:29.038983107 CEST	34186	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:29.044087887 CEST	4444	34184	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:29.044104099 CEST	4444	34186	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:29.044189930 CEST	34186	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:29.044295073 CEST	34186	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:29.049190998 CEST	4444	34186	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:30.616112947 CEST	4444	34186	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:30.616399050 CEST	34186	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:30.617157936 CEST	34188	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:30.622733116 CEST	4444	34186	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:30.624643087 CEST	4444	34188	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:30.624711990 CEST	34188	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:30.624778986 CEST	34188	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:30.629892111 CEST	4444	34188	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:32.177093983 CEST	4444	34188	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:32.177272081 CEST	34188	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:32.178128004 CEST	34190	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:32.182141066 CEST	4444	34188	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:32.183166027 CEST	4444	34190	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:32.183327913 CEST	34190	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:32.183376074 CEST	34190	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:32.188369989 CEST	4444	34190	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:33.723814011 CEST	4444	34190	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:33.724222898 CEST	34190	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:33.724946976 CEST	34192	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:33.729266882 CEST	4444	34190	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:33.729804039 CEST	4444	34192	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:33.729854107 CEST	34192	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:33.729909897 CEST	34192	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:33.734818935 CEST	4444	34192	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:35.307634115 CEST	4444	34192	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:35.308041096 CEST	34192	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:35.308825970 CEST	34194	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:35.313009024 CEST	4444	34192	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:35.313800097 CEST	4444	34194	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:35.313891888 CEST	34194	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:35.313998938 CEST	34194	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:35.318970919 CEST	4444	34194	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:36.921792030 CEST	4444	34194	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:36.922198057 CEST	34194	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:36.923201084 CEST	34196	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:36.928428888 CEST	4444	34194	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:36.929559946 CEST	4444	34196	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:36.929856062 CEST	34196	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:36.929971933 CEST	34196	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:36.935540915 CEST	4444	34196	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:38.474805117 CEST	4444	34196	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:38.475011110 CEST	34196	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:38.475944996 CEST	34198	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:38.479989052 CEST	4444	34196	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:38.480882883 CEST	4444	34198	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:38.480947971 CEST	34198	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:38.481062889 CEST	34198	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:38.486169100 CEST	4444	34198	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:40.053826094 CEST	4444	34198	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:40.054030895 CEST	34198	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:40.055118084 CEST	34200	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:40.059004068 CEST	4444	34198	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:40.060198069 CEST	4444	34200	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:40.060291052 CEST	34200	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:40.060394049 CEST	34200	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:40.065277100 CEST	4444	34200	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:41.653640032 CEST	4444	34200	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:41.653855085 CEST	34200	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:41.654830933 CEST	34202	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:41.658699989 CEST	4444	34200	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:41.659692049 CEST	4444	34202	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:41.659778118 CEST	34202	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:41.659882069 CEST	34202	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:41.664803028 CEST	4444	34202	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:43.211868048 CEST	4444	34202	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:43.212042093 CEST	34202	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:43.212775946 CEST	34204	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:43.218657017 CEST	4444	34202	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:43.219083071 CEST	4444	34204	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:43.219176054 CEST	34204	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:43.219216108 CEST	34204	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:43.225935936 CEST	4444	34204	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:44.896517992 CEST	4444	34204	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:44.896640062 CEST	34204	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:44.897396088 CEST	34206	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:44.901576042 CEST	4444	34204	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:44.902116060 CEST	4444	34206	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:44.902170897 CEST	34206	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:44.902240992 CEST	34206	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:44.907114983 CEST	4444	34206	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:46.448762894 CEST	4444	34206	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:46.448893070 CEST	34206	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:46.449448109 CEST	34208	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:46.453927994 CEST	4444	34206	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:46.454965115 CEST	4444	34208	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:46.455032110 CEST	34208	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:46.455069065 CEST	34208	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:46.459960938 CEST	4444	34208	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:48.037457943 CEST	4444	34208	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:48.037658930 CEST	34208	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:48.038552046 CEST	34210	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:48.042546034 CEST	4444	34208	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:48.043378115 CEST	4444	34210	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:48.043447018 CEST	34210	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:48.043519974 CEST	34210	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:48.048299074 CEST	4444	34210	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:49.688107967 CEST	4444	34210	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:49.688358068 CEST	34210	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:49.689049006 CEST	34212	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:49.693445921 CEST	4444	34210	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:49.694062948 CEST	4444	34212	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:49.694123030 CEST	34212	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:49.694173098 CEST	34212	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:49.698971033 CEST	4444	34212	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:51.274770021 CEST	4444	34212	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:51.275187016 CEST	34212	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:51.275727987 CEST	34214	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:51.279983044 CEST	4444	34212	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:51.280566931 CEST	4444	34214	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:51.280637980 CEST	34214	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:51.280685902 CEST	34214	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:51.288192987 CEST	4444	34214	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:52.847846985 CEST	4444	34214	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:52.850651026 CEST	34214	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:52.851171017 CEST	34216	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:52.856637001 CEST	4444	34214	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:52.856971979 CEST	4444	34216	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:52.857028961 CEST	34216	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:52.857079029 CEST	34216	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:52.863497019 CEST	4444	34216	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:54.413933992 CEST	4444	34216	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:54.414278984 CEST	34216	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:54.414750099 CEST	34218	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:54.419302940 CEST	4444	34216	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:54.419644117 CEST	4444	34218	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:54.419768095 CEST	34218	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:54.419768095 CEST	34218	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:54.424813986 CEST	4444	34218	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:55.980628014 CEST	4444	34218	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:55.980938911 CEST	34218	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:55.981553078 CEST	34220	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:55.987392902 CEST	4444	34218	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:55.987402916 CEST	4444	34220	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:55.987512112 CEST	34220	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:55.987658978 CEST	34220	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:55.992918968 CEST	4444	34220	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:57.575450897 CEST	4444	34220	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:57.575678110 CEST	34220	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:57.576370955 CEST	34222	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:57.580792904 CEST	4444	34220	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:57.581650972 CEST	4444	34222	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:57.581715107 CEST	34222	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:57.581773043 CEST	34222	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:57.586704016 CEST	4444	34222	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:59.307245016 CEST	4444	34222	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:59.307523012 CEST	34222	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:59.308362961 CEST	34224	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:59.313100100 CEST	4444	34222	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:59.313674927 CEST	4444	34224	162.215.219.170	192.168.2.14
Oct 8, 2024 21:05:59.313766003 CEST	34224	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:59.313894033 CEST	34224	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:05:59.319387913 CEST	4444	34224	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:00.974109888 CEST	4444	34224	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:00.974564075 CEST	34224	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:00.975260019 CEST	34226	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:00.979407072 CEST	4444	34224	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:00.980635881 CEST	4444	34226	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:00.980726957 CEST	34226	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:00.980895996 CEST	34226	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:00.986584902 CEST	4444	34226	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:02.573829889 CEST	4444	34226	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:02.574081898 CEST	34226	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:02.575203896 CEST	34228	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:02.579256058 CEST	4444	34226	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:02.580368042 CEST	4444	34228	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:02.580466986 CEST	34228	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:02.580509901 CEST	34228	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:02.585481882 CEST	4444	34228	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:04.150417089 CEST	4444	34228	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:04.151015997 CEST	34228	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:04.151621103 CEST	34230	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:04.156325102 CEST	4444	34228	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:04.156668901 CEST	4444	34230	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:04.156754017 CEST	34230	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:04.156867981 CEST	34230	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:04.161731958 CEST	4444	34230	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:05.725281954 CEST	4444	34230	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:05.725565910 CEST	34230	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:05.726555109 CEST	34232	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:05.730485916 CEST	4444	34230	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:05.731692076 CEST	4444	34232	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:05.731791973 CEST	34232	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:05.731905937 CEST	34232	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:05.736898899 CEST	4444	34232	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:07.286926985 CEST	4444	34232	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:07.287163019 CEST	34232	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:07.287753105 CEST	34234	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:07.292028904 CEST	4444	34232	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:07.292694092 CEST	4444	34234	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:07.292767048 CEST	34234	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:07.292840004 CEST	34234	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:07.297813892 CEST	4444	34234	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:08.850354910 CEST	4444	34234	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:08.850630045 CEST	34234	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:08.851407051 CEST	34236	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:08.856281042 CEST	4444	34234	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:08.856581926 CEST	4444	34236	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:08.856650114 CEST	34236	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:08.856767893 CEST	34236	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:08.861609936 CEST	4444	34236	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:10.431802034 CEST	4444	34236	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:10.432025909 CEST	34236	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:10.432920933 CEST	34238	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:10.437042952 CEST	4444	34236	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:10.437802076 CEST	4444	34238	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:10.437911987 CEST	34238	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:10.437994957 CEST	34238	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:10.442944050 CEST	4444	34238	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:12.009578943 CEST	4444	34238	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:12.009874105 CEST	34238	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:12.010725021 CEST	34240	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:12.014821053 CEST	4444	34238	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:12.015677929 CEST	4444	34240	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:12.015749931 CEST	34240	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:12.015978098 CEST	34240	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:12.020848036 CEST	4444	34240	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:13.590100050 CEST	4444	34240	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:13.590396881 CEST	34240	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:13.591337919 CEST	34242	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:13.595455885 CEST	4444	34240	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:13.596307039 CEST	4444	34242	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:13.596420050 CEST	34242	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:13.596473932 CEST	34242	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:13.601382017 CEST	4444	34242	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:15.168301105 CEST	4444	34242	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:15.168663979 CEST	34242	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:15.169471025 CEST	34244	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:15.173899889 CEST	4444	34242	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:15.174346924 CEST	4444	34244	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:15.174412012 CEST	34244	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:15.174540997 CEST	34244	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:15.179687023 CEST	4444	34244	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:16.726434946 CEST	4444	34244	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:16.726809025 CEST	34244	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:16.727438927 CEST	34246	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:16.731925011 CEST	4444	34244	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:16.732336044 CEST	4444	34246	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:16.732405901 CEST	34246	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:16.732512951 CEST	34246	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:16.737454891 CEST	4444	34246	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:18.525345087 CEST	4444	34246	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:18.525837898 CEST	34246	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:18.526614904 CEST	34248	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:18.527318954 CEST	4444	34246	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:18.527380943 CEST	34246	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:18.530781984 CEST	4444	34246	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:18.531651020 CEST	4444	34248	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:18.531732082 CEST	34248	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:18.531816959 CEST	34248	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:18.536825895 CEST	4444	34248	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:20.318744898 CEST	4444	34248	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:20.319103003 CEST	34248	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:20.319703102 CEST	34250	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:20.323970079 CEST	4444	34248	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:20.324899912 CEST	4444	34250	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:20.324992895 CEST	34250	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:20.325078964 CEST	34250	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:20.330193043 CEST	4444	34250	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:21.978064060 CEST	4444	34250	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:21.978553057 CEST	34250	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:21.979208946 CEST	34252	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:21.983705997 CEST	4444	34250	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:21.984842062 CEST	4444	34252	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:21.984951019 CEST	34252	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:21.984989882 CEST	34252	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:21.990111113 CEST	4444	34252	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:23.584458113 CEST	4444	34252	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:23.584651947 CEST	34252	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:23.585391045 CEST	34254	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:23.589911938 CEST	4444	34252	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:23.590253115 CEST	4444	34254	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:23.590318918 CEST	34254	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:23.590372086 CEST	34254	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:23.595565081 CEST	4444	34254	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:25.160783052 CEST	4444	34254	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:25.161286116 CEST	34254	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:25.162523031 CEST	34256	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:25.166560888 CEST	4444	34254	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:25.167678118 CEST	4444	34256	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:25.167752981 CEST	34256	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:25.167891979 CEST	34256	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:25.173450947 CEST	4444	34256	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:26.727035999 CEST	4444	34256	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:26.727437973 CEST	34256	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:26.728240013 CEST	34258	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:26.732563972 CEST	4444	34256	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:26.733278036 CEST	4444	34258	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:26.733407021 CEST	34258	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:26.733515978 CEST	34258	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:26.740231991 CEST	4444	34258	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:28.553930998 CEST	4444	34258	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:28.554271936 CEST	34258	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:28.555284023 CEST	34260	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:28.556073904 CEST	4444	34258	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:28.556138992 CEST	34258	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:28.559439898 CEST	4444	34258	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:28.560760021 CEST	4444	34260	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:28.560889006 CEST	34260	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:28.560992002 CEST	34260	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:28.565853119 CEST	4444	34260	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:30.117454052 CEST	4444	34260	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:30.117713928 CEST	34260	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:30.118580103 CEST	34262	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:30.122922897 CEST	4444	34260	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:30.123497009 CEST	4444	34262	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:30.123583078 CEST	34262	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:30.123692989 CEST	34262	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:30.128686905 CEST	4444	34262	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:31.710294008 CEST	4444	34262	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:31.710762024 CEST	34262	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:31.711858034 CEST	34264	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:31.716069937 CEST	4444	34262	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:31.716934919 CEST	4444	34264	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:31.716995001 CEST	34264	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:31.717111111 CEST	34264	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:31.721894026 CEST	4444	34264	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:33.311181068 CEST	4444	34264	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:33.311413050 CEST	34264	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:33.312266111 CEST	34266	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:33.316597939 CEST	4444	34264	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:33.317354918 CEST	4444	34266	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:33.317451000 CEST	34266	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:33.317568064 CEST	34266	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:33.323100090 CEST	4444	34266	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:34.965368986 CEST	4444	34266	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:34.965759993 CEST	34266	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:34.966906071 CEST	34268	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:34.970707893 CEST	4444	34266	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:34.971823931 CEST	4444	34268	162.215.219.170	192.168.2.14
Oct 8, 2024 21:06:34.971921921 CEST	34268	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:34.972028017 CEST	34268	4444	192.168.2.14	162.215.219.170
Oct 8, 2024 21:06:34.976886034 CEST	4444	34268	162.215.219.170	192.168.2.14

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 21:05:44.689483881 CEST	36608	53	192.168.2.14	8.8.8.8
Oct 8, 2024 21:05:44.689529896 CEST	53968	53	192.168.2.14	8.8.8.8
Oct 8, 2024 21:05:44.898610115 CEST	53	53968	8.8.8.8	192.168.2.14
Oct 8, 2024 21:05:44.898730993 CEST	53	36608	8.8.8.8	192.168.2.14

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 8, 2024 21:05:44.689483881 CEST	192.168.2.14	8.8.8.8	0x9a39	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Oct 8, 2024 21:05:44.689529896 CEST	192.168.2.14	8.8.8.8	0xc8fc	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 8, 2024 21:05:44.898730993 CEST	8.8.8.8	192.168.2.14	0x9a39	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false
Oct 8, 2024 21:05:44.898730993 CEST	8.8.8.8	192.168.2.14	0x9a39	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: dash PID: 5485, Parent PID: 3636

General

Start time (UTC):	19:02:50
Start date (UTC):	08/10/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rm PID: 5485, Parent PID: 3636

General

Start time (UTC):	19:02:50
Start date (UTC):	08/10/2024
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.VPcrEpfrQW /tmp/tmp.jJFrqEYoep /tmp/tmp.V1PhRH8nNb
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Chronological Activities

Analysis Process: dash PID: 5486, Parent PID: 3636

General

Start time (UTC):	19:02:50
Start date (UTC):	08/10/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rm PID: 5486, Parent PID: 3636

General

Start time (UTC):	19:02:50
Start date (UTC):	08/10/2024
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.VPcrEpfrQW /tmp/tmp.jJFrqEYoep /tmp/tmp.V1PhRH8nNb
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Chronological Activities

Analysis Process: j3wIEvE5Sj.elf PID: 5498, Parent PID: 5422

General

Start time (UTC):	19:03:00
Start date (UTC):	08/10/2024
Path:	/tmp/j3wIEvE5Sj.elf
Arguments:	/tmp/j3wIEvE5Sj.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: j3wIEvE5Sj.elf PID: 5500, Parent PID: 5498

General

Start time (UTC):	19:03:00
Start date (UTC):	08/10/2024
Path:	/tmp/j3wIEvE5Sj.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: j3wIEvE5Sj.elf PID: 5502, Parent PID: 5500

General

Start time (UTC):	19:03:00
Start date (UTC):	08/10/2024
Path:	/tmp/j3wIEvE5Sj.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping or `net view` using Net .
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report j3wIEvE5Sj.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Threatname: Gafgyt

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: dash PID: 5485, Parent PID: 3636

General

Chronological Activities

Analysis Process: rm PID: 5485, Parent PID: 3636

General

Chronological Activities

Analysis Process: dash PID: 5486, Parent PID: 3636

General

Chronological Activities

Analysis Process: rm PID: 5486, Parent PID: 3636

General

Chronological Activities

Linux Analysis Report
j3wIEvE5Sj.elf