Edit tour

Linux Analysis Report
SYoMGYCkDG.elf

Overview

General Information

Sample name:	SYoMGYCkDG.elf renamed because original name is a hash value
Original sample name:	7b5efc69d9d1010e7afe290236ace207.elf
Analysis ID:	1529319
MD5:	7b5efc69d9d1010e7afe290236ace207
SHA1:	8caaf963a63f5983cbfeae5db54cfd21628ba53d
SHA256:	41d996b9f378244771954f478f5790e72009dfce3e4aad7d1035793bd08d2ac2
Tags:	32elfpowerpc
Infos:

Detection

Gafgyt, Mirai

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Gafgyt

Yara detected Mirai

Contains symbols with names commonly found in malware

Opens /proc/net/* files useful for finding connected devices and routers

Detected TCP or UDP traffic on non-standard ports

Executes the "rm" command used to delete files or directories

Sample contains strings that are user agent strings indicative of HTTP manipulation

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1529319
Start date and time:	2024-10-08 21:02:14 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	SYoMGYCkDG.elf renamed because original name is a hash value
Original Sample Name:	7b5efc69d9d1010e7afe290236ace207.elf
Detection:	MAL
Classification:	mal100.spre.troj.linELF@0/1@2/0

Warnings

VT rate limit hit for: SYoMGYCkDG.elf

Runtime Messages

Command:	/tmp/SYoMGYCkDG.elf
PID:	5522
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

SYoMGYCkDG.elf (PID: 5522, Parent: 5441, MD5: ae65271c943d3451b7f026d1fadccea6) Arguments: /tmp/SYoMGYCkDG.elf

SYoMGYCkDG.elf New Fork (PID: 5524, Parent: 5522)

SYoMGYCkDG.elf New Fork (PID: 5526, Parent: 5524)

dash New Fork (PID: 5556, Parent: 3671)

rm (PID: 5556, Parent: 3671, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.SRW62QzKFs /tmp/tmp.PYYO00TAbo /tmp/tmp.kVqVH3y4Dp

dash New Fork (PID: 5557, Parent: 3671)

rm (PID: 5557, Parent: 3671, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.SRW62QzKFs /tmp/tmp.PYYO00TAbo /tmp/tmp.kVqVH3y4Dp

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
SYoMGYCkDG.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
SYoMGYCkDG.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
SYoMGYCkDG.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x19b68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19b7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19b90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19ba4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19bb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19bcc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19be0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19bf4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19c08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19c1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19c30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19c44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19c58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19c6c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19c80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19c94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19ca8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19cbc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19cd0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19ce4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19cf8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
SYoMGYCkDG.elf	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x1c0d0:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x1e10c:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64

Memory Dumps

Source	Rule	Description	Author	Strings
5524.1.00007fb258001000.00007fb258022000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
5524.1.00007fb258001000.00007fb258022000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5524.1.00007fb258001000.00007fb258022000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x19b68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19b7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19b90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19ba4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19bb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19bcc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19be0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19bf4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19c08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19c1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19c30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19c44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19c58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19c6c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19c80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19c94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19ca8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19cbc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19cd0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19ce4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19cf8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5524.1.00007fb258001000.00007fb258022000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x1c0d0:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x1e10c:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
5522.1.00007fb258001000.00007fb258022000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
5522.1.00007fb258001000.00007fb258022000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5522.1.00007fb258001000.00007fb258022000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x19b68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19b7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19b90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19ba4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19bb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19bcc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19be0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19bf4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19c08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19c1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19c30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19c44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19c58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19c6c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19c80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19c94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19ca8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19cbc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19cd0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19ce4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19cf8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5522.1.00007fb258001000.00007fb258022000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x1c0d0:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x1e10c:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: SYoMGYCkDG.elf PID: 5522	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: SYoMGYCkDG.elf PID: 5522	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x724b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x725f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7273:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7287:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x729b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x72af:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x72c3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x72d7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x72eb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x72ff:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7313:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7327:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x733b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x734f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7363:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7377:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x738b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x739f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x73b3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x73c7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x73db:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: SYoMGYCkDG.elf PID: 5522	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xa6ef:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0xa95c:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0xd587:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: SYoMGYCkDG.elf PID: 5524	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: SYoMGYCkDG.elf PID: 5524	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x13b77:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13b8b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13b9f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13bb3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13bc7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13bdb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13bef:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13c03:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13c17:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13c2b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13c3f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13c53:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13c67:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13c7b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13c8f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13ca3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13cb7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13ccb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13cdf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13cf3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13d07:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: SYoMGYCkDG.elf PID: 5524	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x1701b:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x17288:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x19eb3:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Click to see the 9 entries

Suricata Signatures

ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T21:03:01.597578+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33108	162.215.219.170	4444	TCP
2024-10-08T21:03:03.168331+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33110	162.215.219.170	4444	TCP
2024-10-08T21:03:04.766745+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33112	162.215.219.170	4444	TCP
2024-10-08T21:03:06.354764+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33114	162.215.219.170	4444	TCP
2024-10-08T21:03:07.963918+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33116	162.215.219.170	4444	TCP
2024-10-08T21:03:09.591684+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33118	162.215.219.170	4444	TCP
2024-10-08T21:03:12.170745+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33120	162.215.219.170	4444	TCP
2024-10-08T21:03:13.727740+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33122	162.215.219.170	4444	TCP
2024-10-08T21:03:15.291944+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33124	162.215.219.170	4444	TCP
2024-10-08T21:03:16.875064+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33126	162.215.219.170	4444	TCP
2024-10-08T21:03:18.431515+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33128	162.215.219.170	4444	TCP
2024-10-08T21:03:20.030859+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33130	162.215.219.170	4444	TCP
2024-10-08T21:03:21.588677+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33132	162.215.219.170	4444	TCP
2024-10-08T21:03:23.150315+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33134	162.215.219.170	4444	TCP
2024-10-08T21:03:24.714016+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33136	162.215.219.170	4444	TCP
2024-10-08T21:03:26.292807+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33138	162.215.219.170	4444	TCP
2024-10-08T21:03:27.866798+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33140	162.215.219.170	4444	TCP
2024-10-08T21:03:29.469052+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33142	162.215.219.170	4444	TCP
2024-10-08T21:03:31.058879+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33144	162.215.219.170	4444	TCP
2024-10-08T21:03:32.649595+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33146	162.215.219.170	4444	TCP
2024-10-08T21:03:34.229795+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33148	162.215.219.170	4444	TCP
2024-10-08T21:03:35.993744+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33150	162.215.219.170	4444	TCP
2024-10-08T21:03:37.572352+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33152	162.215.219.170	4444	TCP
2024-10-08T21:03:39.134855+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33154	162.215.219.170	4444	TCP
2024-10-08T21:03:40.717505+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33156	162.215.219.170	4444	TCP
2024-10-08T21:03:40.929169+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33156	162.215.219.170	4444	TCP
2024-10-08T21:03:42.592003+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33158	162.215.219.170	4444	TCP
2024-10-08T21:03:44.191348+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33160	162.215.219.170	4444	TCP
2024-10-08T21:03:45.748309+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33162	162.215.219.170	4444	TCP
2024-10-08T21:03:47.306981+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33164	162.215.219.170	4444	TCP
2024-10-08T21:03:48.978311+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33166	162.215.219.170	4444	TCP
2024-10-08T21:03:50.544761+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33168	162.215.219.170	4444	TCP
2024-10-08T21:03:52.105067+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33170	162.215.219.170	4444	TCP
2024-10-08T21:03:53.683039+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33172	162.215.219.170	4444	TCP
2024-10-08T21:03:55.248992+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33174	162.215.219.170	4444	TCP
2024-10-08T21:03:56.829499+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33176	162.215.219.170	4444	TCP
2024-10-08T21:03:58.401882+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33178	162.215.219.170	4444	TCP
2024-10-08T21:03:59.980476+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33180	162.215.219.170	4444	TCP
2024-10-08T21:04:01.561336+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33182	162.215.219.170	4444	TCP
2024-10-08T21:04:03.138085+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33184	162.215.219.170	4444	TCP
2024-10-08T21:04:05.031818+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33186	162.215.219.170	4444	TCP
2024-10-08T21:04:06.891888+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33188	162.215.219.170	4444	TCP
2024-10-08T21:04:08.464026+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33190	162.215.219.170	4444	TCP
2024-10-08T21:04:10.041507+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33192	162.215.219.170	4444	TCP
2024-10-08T21:04:11.654508+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33194	162.215.219.170	4444	TCP
2024-10-08T21:04:13.218884+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33196	162.215.219.170	4444	TCP
2024-10-08T21:04:14.778657+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33198	162.215.219.170	4444	TCP
2024-10-08T21:04:16.337760+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33200	162.215.219.170	4444	TCP
2024-10-08T21:04:17.903447+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33202	162.215.219.170	4444	TCP
2024-10-08T21:04:19.487037+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33204	162.215.219.170	4444	TCP
2024-10-08T21:04:21.063189+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33206	162.215.219.170	4444	TCP
2024-10-08T21:04:22.699778+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33208	162.215.219.170	4444	TCP
2024-10-08T21:04:24.448586+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33210	162.215.219.170	4444	TCP
2024-10-08T21:04:26.049256+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33212	162.215.219.170	4444	TCP
2024-10-08T21:04:27.659644+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33214	162.215.219.170	4444	TCP
2024-10-08T21:04:29.217476+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33216	162.215.219.170	4444	TCP
2024-10-08T21:04:30.793468+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33218	162.215.219.170	4444	TCP
2024-10-08T21:04:32.354778+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33220	162.215.219.170	4444	TCP
2024-10-08T21:04:33.921583+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33222	162.215.219.170	4444	TCP
2024-10-08T21:04:35.496681+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33224	162.215.219.170	4444	TCP
2024-10-08T21:04:37.112484+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33226	162.215.219.170	4444	TCP
2024-10-08T21:04:38.686465+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33228	162.215.219.170	4444	TCP
2024-10-08T21:04:40.498642+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33230	162.215.219.170	4444	TCP
2024-10-08T21:04:42.058352+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33232	162.215.219.170	4444	TCP
2024-10-08T21:04:43.624617+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33234	162.215.219.170	4444	TCP
2024-10-08T21:04:45.607355+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33236	162.215.219.170	4444	TCP
2024-10-08T21:04:47.168281+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33238	162.215.219.170	4444	TCP
2024-10-08T21:04:48.783842+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33240	162.215.219.170	4444	TCP
2024-10-08T21:04:50.392555+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33242	162.215.219.170	4444	TCP
2024-10-08T21:04:51.984788+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33244	162.215.219.170	4444	TCP
2024-10-08T21:04:53.560379+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33246	162.215.219.170	4444	TCP
2024-10-08T21:04:55.123830+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33248	162.215.219.170	4444	TCP
2024-10-08T21:04:56.874559+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33250	162.215.219.170	4444	TCP
2024-10-08T21:04:58.441449+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33252	162.215.219.170	4444	TCP
2024-10-08T21:05:00.022299+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33254	162.215.219.170	4444	TCP
2024-10-08T21:05:01.589487+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33256	162.215.219.170	4444	TCP
2024-10-08T21:05:03.170396+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33258	162.215.219.170	4444	TCP
2024-10-08T21:05:04.730219+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33260	162.215.219.170	4444	TCP
2024-10-08T21:05:06.299647+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33262	162.215.219.170	4444	TCP
2024-10-08T21:05:07.856373+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33264	162.215.219.170	4444	TCP
2024-10-08T21:05:10.172371+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33266	162.215.219.170	4444	TCP
2024-10-08T21:05:11.765678+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33268	162.215.219.170	4444	TCP
2024-10-08T21:05:13.322873+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33270	162.215.219.170	4444	TCP
2024-10-08T21:05:14.873235+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33272	162.215.219.170	4444	TCP
2024-10-08T21:05:16.436279+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33274	162.215.219.170	4444	TCP
2024-10-08T21:05:18.011582+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33276	162.215.219.170	4444	TCP
2024-10-08T21:05:19.578602+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33278	162.215.219.170	4444	TCP
2024-10-08T21:05:21.136436+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33280	162.215.219.170	4444	TCP
2024-10-08T21:05:22.701587+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33282	162.215.219.170	4444	TCP
2024-10-08T21:05:24.263809+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33284	162.215.219.170	4444	TCP
2024-10-08T21:05:25.885706+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33286	162.215.219.170	4444	TCP
2024-10-08T21:05:27.474111+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33288	162.215.219.170	4444	TCP
2024-10-08T21:05:29.029223+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33290	162.215.219.170	4444	TCP
2024-10-08T21:05:30.592694+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33292	162.215.219.170	4444	TCP
2024-10-08T21:05:32.169545+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33294	162.215.219.170	4444	TCP
2024-10-08T21:05:33.729649+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33296	162.215.219.170	4444	TCP
2024-10-08T21:05:35.295094+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33298	162.215.219.170	4444	TCP
2024-10-08T21:05:36.929162+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33300	162.215.219.170	4444	TCP
2024-10-08T21:05:38.515456+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33302	162.215.219.170	4444	TCP
2024-10-08T21:05:40.079328+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33304	162.215.219.170	4444	TCP
2024-10-08T21:05:41.660840+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33306	162.215.219.170	4444	TCP
2024-10-08T21:05:43.218210+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33308	162.215.219.170	4444	TCP
2024-10-08T21:05:44.902272+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33310	162.215.219.170	4444	TCP
2024-10-08T21:05:46.488669+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33312	162.215.219.170	4444	TCP
2024-10-08T21:05:48.058240+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33314	162.215.219.170	4444	TCP
2024-10-08T21:05:49.694186+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33316	162.215.219.170	4444	TCP
2024-10-08T21:05:51.281544+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33318	162.215.219.170	4444	TCP
2024-10-08T21:05:52.873181+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33320	162.215.219.170	4444	TCP
2024-10-08T21:05:54.434821+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33322	162.215.219.170	4444	TCP
2024-10-08T21:05:55.999654+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33324	162.215.219.170	4444	TCP
2024-10-08T21:05:57.576857+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33326	162.215.219.170	4444	TCP
2024-10-08T21:05:59.313869+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33328	162.215.219.170	4444	TCP
2024-10-08T21:06:00.983885+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33330	162.215.219.170	4444	TCP
2024-10-08T21:06:02.590314+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33332	162.215.219.170	4444	TCP
2024-10-08T21:06:04.153735+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33334	162.215.219.170	4444	TCP
2024-10-08T21:06:05.717600+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33336	162.215.219.170	4444	TCP
2024-10-08T21:06:07.293552+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33338	162.215.219.170	4444	TCP
2024-10-08T21:06:08.858359+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33340	162.215.219.170	4444	TCP
2024-10-08T21:06:10.418473+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33342	162.215.219.170	4444	TCP
2024-10-08T21:06:11.985395+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33344	162.215.219.170	4444	TCP
2024-10-08T21:06:13.550257+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33346	162.215.219.170	4444	TCP
2024-10-08T21:06:15.137303+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33348	162.215.219.170	4444	TCP
2024-10-08T21:06:16.699917+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33350	162.215.219.170	4444	TCP
2024-10-08T21:06:18.264528+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33352	162.215.219.170	4444	TCP
2024-10-08T21:06:20.114088+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33354	162.215.219.170	4444	TCP
2024-10-08T21:06:21.722903+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33356	162.215.219.170	4444	TCP
2024-10-08T21:06:23.328002+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33358	162.215.219.170	4444	TCP
2024-10-08T21:06:24.887835+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33360	162.215.219.170	4444	TCP
2024-10-08T21:06:26.471719+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33362	162.215.219.170	4444	TCP
2024-10-08T21:06:28.065550+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33364	162.215.219.170	4444	TCP
2024-10-08T21:06:29.673321+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33366	162.215.219.170	4444	TCP
2024-10-08T21:06:31.250103+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33368	162.215.219.170	4444	TCP
2024-10-08T21:06:32.823892+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33370	162.215.219.170	4444	TCP
2024-10-08T21:06:34.409400+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33372	162.215.219.170	4444	TCP
2024-10-08T21:06:35.985705+0200	2846526	1	A Network Trojan was detected	192.168.2.15	33374	162.215.219.170	4444	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: SYoMGYCkDG.elf

Avira: detected

Found malware configuration

Source: SYoMGYCkDG.elf

Malware Configuration Extractor: Gafgyt {"C2 url": "162.215.219.170:4444"}

Multi AV Scanner detection for submitted file

Source: SYoMGYCkDG.elf

ReversingLabs: Detection: 63%

Spreading

Opens /proc/net/* files useful for finding connected devices and routers

Source: /tmp/SYoMGYCkDG.elf (PID: 5522)

Opens: /proc/net/route

Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33114 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33122 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33164 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33126 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33110 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33124 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33166 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33148 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33162 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33170 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33128 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33176 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33158 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33196 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33118 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33188 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33156 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33154 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33136 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33200 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33208 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33168 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33132 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33212 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33210 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33198 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33194 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33204 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33224 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33226 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33152 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33140 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33236 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33142 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33182 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33220 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33190 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33146 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33138 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33192 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33232 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33228 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33174 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33250 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33244 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33214 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33234 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33256 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33260 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33246 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33242 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33202 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33262 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33252 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33206 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33116 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33120 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33238 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33130 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33240 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33180 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33172 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33248 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33150 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33254 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33178 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33230 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33144 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33258 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33160 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33112 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33222 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33134 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33216 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33266 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33268 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33272 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33218 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33278 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33276 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33270 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33290 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33288 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33296 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33264 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33280 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33298 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33304 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33302 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33306 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33284 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33308 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33300 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33314 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33316 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33312 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33322 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33318 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33328 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33326 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33320 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33294 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33330 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33334 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33332 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33336 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33340 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33348 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33310 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33344 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33324 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33354 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33360 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33356 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33358 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33364 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33370 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33350 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33372 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33368 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33374 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33366 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33342 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33346 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33292 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33338 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33108 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33184 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33186 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33286 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33274 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33282 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33352 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.15:33362 -> 162.215.219.170:4444

Source: global traffic

TCP traffic: 192.168.2.15:33108 -> 162.215.219.170:4444

Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

Source: SYoMGYCkDG.elf	String found in binary or memory: http://fast.no/support/crawler.asp)
Source: SYoMGYCkDG.elf	String found in binary or memory: http://feedback.redkolibri.com/
Source: SYoMGYCkDG.elf	String found in binary or memory: http://www.baidu.com/search/spider.htm)
Source: SYoMGYCkDG.elf	String found in binary or memory: http://www.baidu.com/search/spider.html)
Source: SYoMGYCkDG.elf	String found in binary or memory: http://www.billybobbot.com/crawler/)

Source: unknown	Network traffic detected: HTTP traffic on port 49566 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49566

System Summary

Malicious sample detected (through community Yara rule)

Source: SYoMGYCkDG.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: SYoMGYCkDG.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5524.1.00007fb258001000.00007fb258022000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5524.1.00007fb258001000.00007fb258022000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5522.1.00007fb258001000.00007fb258022000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5522.1.00007fb258001000.00007fb258022000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: SYoMGYCkDG.elf PID: 5522, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: SYoMGYCkDG.elf PID: 5522, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: SYoMGYCkDG.elf PID: 5524, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: SYoMGYCkDG.elf PID: 5524, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown

Contains symbols with names commonly found in malware

Source: ELF static info symbol of initial sample	Name: httpattack
Source: ELF static info symbol of initial sample	Name: vseattack

Source: SYoMGYCkDG.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: SYoMGYCkDG.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5524.1.00007fb258001000.00007fb258022000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5524.1.00007fb258001000.00007fb258022000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5522.1.00007fb258001000.00007fb258022000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5522.1.00007fb258001000.00007fb258022000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: SYoMGYCkDG.elf PID: 5522, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: SYoMGYCkDG.elf PID: 5522, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: SYoMGYCkDG.elf PID: 5524, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: SYoMGYCkDG.elf PID: 5524, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.spre.troj.linELF@0/1@2/0

Source: /usr/bin/dash (PID: 5556)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.SRW62QzKFs /tmp/tmp.PYYO00TAbo /tmp/tmp.kVqVH3y4Dp			Jump to behavior
Source: /usr/bin/dash (PID: 5557)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.SRW62QzKFs /tmp/tmp.PYYO00TAbo /tmp/tmp.kVqVH3y4Dp			Jump to behavior

Source: /tmp/SYoMGYCkDG.elf (PID: 5522)

Queries kernel information via 'uname':

Jump to behavior

Source: SYoMGYCkDG.elf, 5522.1.00005639650b3000.0000563965163000.rw-.sdmp, SYoMGYCkDG.elf, 5524.1.00005639650b3000.0000563965163000.rw-.sdmp	Binary or memory string: !/etc/qemu-binfmt/ppc11!hotpluggableq
Source: SYoMGYCkDG.elf, 5522.1.00007ffd554f4000.00007ffd55515000.rw-.sdmp, SYoMGYCkDG.elf, 5524.1.00007ffd554f4000.00007ffd55515000.rw-.sdmp	Binary or memory string: "J6x86_64/usr/bin/qemu-ppc/tmp/SYoMGYCkDG.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/SYoMGYCkDG.elf
Source: SYoMGYCkDG.elf, 5522.1.00005639650b3000.0000563965163000.rw-.sdmp, SYoMGYCkDG.elf, 5524.1.00005639650b3000.0000563965163000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/ppc
Source: SYoMGYCkDG.elf, 5522.1.00007ffd554f4000.00007ffd55515000.rw-.sdmp, SYoMGYCkDG.elf, 5524.1.00007ffd554f4000.00007ffd55515000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-ppc
Source: SYoMGYCkDG.elf, 5522.1.00007ffd554f4000.00007ffd55515000.rw-.sdmp	Binary or memory string: a9V/tmp/qemu-open.Y54pMM\
Source: SYoMGYCkDG.elf, 5522.1.00007ffd554f4000.00007ffd55515000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.Y54pMM

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match	File source: SYoMGYCkDG.elf, type: SAMPLE
Source: Yara match	File source: 5524.1.00007fb258001000.00007fb258022000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5522.1.00007fb258001000.00007fb258022000.r-x.sdmp, type: MEMORY

Yara detected Mirai

Source: Yara match	File source: SYoMGYCkDG.elf, type: SAMPLE
Source: Yara match	File source: 5524.1.00007fb258001000.00007fb258022000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5522.1.00007fb258001000.00007fb258022000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SYoMGYCkDG.elf PID: 5522, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SYoMGYCkDG.elf PID: 5524, type: MEMORYSTR

Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36
Source: Initial sample	User agent string found: Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; rv:2.2) Gecko/20110201
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.2; U; ru) Presto/2.5.22 Version/10.51
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko
Source: Initial sample	User agent string found: Mozilla/5.0 (Android; Linux armv7l; rv:9.0) Gecko/20111216 Firefox/9.0 Fennec/9.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60
Source: Initial sample	User agent string found: Mozilla/5.0 (iPad; U; CPU OS 5_1 like Mac OS X) AppleWebKit/531.21.10 (KHTML, like Gecko) Version/4.0.4 Mobile/7B367 Safari/531.21.10 UCBrowser/3.4.3.532
Source: Initial sample	User agent string found: Mozilla/5.0 (Nintendo WiiU) AppleWebKit/536.30 (KHTML, like Gecko) NX/3.0.4.2.12 NintendoBrowser/4.3.1.11264.US
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:25.0) Gecko/20100101 Firefox/25.0
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; pl) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; en) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; ja) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; cn) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; fr) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20100101 Firefox/12.0
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; U; Linux x86_64; de; rv:1.9.2.8) Gecko/20100723 Ubuntu/10.04 (lucid) Firefox/3.6.8
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; rv:13.0) Gecko/20100101 Firefox/13.0.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:11.0) Gecko/20100101 Firefox/11.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:13.0) Gecko/20100101 Firefox/13.0.1
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.289 Version/12.01
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.02
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.0) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.112 Safari/535.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en; rv:1.8.1.11) Gecko/20071128 Camino/1.5.4
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; cs; rv:1.9.2.6) Gecko/20100628 myibrow/4alpha2
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Win 9x 4.90; SG; rv:1.9.2.4) Gecko/20101104 Netscape/9.1.0285
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.2.0 Lightning/4.0.2
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10; rv:33.0) Gecko/20100101 Firefox/33.0

Remote Access Functionality

Yara detected Gafgyt

Source: Yara match	File source: SYoMGYCkDG.elf, type: SAMPLE
Source: Yara match	File source: 5524.1.00007fb258001000.00007fb258022000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5522.1.00007fb258001000.00007fb258022000.r-x.sdmp, type: MEMORY

Yara detected Mirai

Source: Yara match	File source: SYoMGYCkDG.elf, type: SAMPLE
Source: Yara match	File source: 5524.1.00007fb258001000.00007fb258022000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5522.1.00007fb258001000.00007fb258022000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SYoMGYCkDG.elf PID: 5522, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SYoMGYCkDG.elf PID: 5524, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 File Deletion	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	1 Remote System Discovery	Remote Desktop Protocol	Data from Removable Media	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	2 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact

Malware Configuration

Threatname: Gafgyt

{"C2 url": "162.215.219.170:4444"}

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
SYoMGYCkDG.elf	63%	ReversingLabs	Linux.Trojan.LnxGafgyt
SYoMGYCkDG.elf	100%	Avira	LINUX/Mirai.Gafgyt.

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.billybobbot.com/crawler/)	0%	URL Reputation	safe
http://fast.no/support/crawler.asp)	0%	URL Reputation	safe
http://feedback.redkolibri.com/	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.25	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
162.215.219.170:4444	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.baidu.com/search/spider.html)	SYoMGYCkDG.elf	false		unknown
http://www.billybobbot.com/crawler/)	SYoMGYCkDG.elf	false	URL Reputation: safe	unknown
http://fast.no/support/crawler.asp)	SYoMGYCkDG.elf	false	URL Reputation: safe	unknown
http://feedback.redkolibri.com/	SYoMGYCkDG.elf	false	URL Reputation: safe	unknown
http://www.baidu.com/search/spider.htm)	SYoMGYCkDG.elf	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
54.217.10.153	unknown	United States		16509	AMAZON-02US	false
162.215.219.170	unknown	United States		46606	UNIFIEDLAYER-AS-1US	true

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
54.217.10.153	bot.mips.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	c.arm5.elf	Get hash	malicious	Unknown	Browse
	d92eGGZPEg.elf	Get hash	malicious	Gafgyt	Browse
	frpc_mips.elf	Get hash	malicious	Unknown	Browse
	VMuKxSgV02.elf	Get hash	malicious	Mirai	Browse
	fHaEG1nZHb.elf	Get hash	malicious	Mirai, Okiru	Browse
	Wi32woSUfB.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	9fObA4qMdG.elf	Get hash	malicious	Unknown	Browse
	ZlBOLT3u37.elf	Get hash	malicious	Mirai	Browse
	RAm88JXXYr.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse
162.215.219.170	hmNdVt8mF7.elf	Get hash	malicious	Gafgyt, Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	GfPpov52Oc.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	5skkMenK5x.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	ssk7Ah3h5D.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	4Vw4aRxxGu.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	5FteLLQ1oY.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	gMYQFxufu0.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	k49syyxi7V.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	4LbWi40g57.elf	Get hash	malicious	Unknown	Browse	162.213.35.24

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
UNIFIEDLAYER-AS-1US	hmNdVt8mF7.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.215.219.170
	https://phisher-parts-production-us-east-1.s3.amazonaws.com/da08a569-c476-4c06-9e6f-9e3c8ae51232/2024-10-08/dm05v41jqt45dhgffdnn8f9og9hsqbgjjjhn2jo1/7abc4121254d93d61494ed63a8489e54fc18f49b8fee3f2e42bc06d8de3bd8f4?response-content-disposition=attachment%3B%20filename%3D%22Trailhead%20Media%2024-090.pdf%22%3B%20filename%2A%3DUTF-8%27%27Trailhead%2520Media%252024-090.pdf&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=ASIA37KREM2QGGSCSFZ4%2F20241008%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20241008T163442Z&X-Amz-Expires=13860&X-Amz-Security-Token=IQoJb3JpZ2luX2VjEO%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaCXVzLWVhc3QtMSJHMEUCIDgEEKEw%2BhLGwBtqA9K8lbT2NL7hbWhvf2%2BPjyD670ZwAiEAjxudbMDljL%2FUqXOnRGbBuWM4gt9lBw1st5sI4FM7vZ8q%2FwMIRxAAGgw4MjMxOTMyNjU4MjQiDFL6sO98KdRGT%2FyB6ircA40orR%2Bw3i4U%2B9phl56wCil07vS%2BjAp0tNBfyQAkuYLNSI62vBzUSfUh8AtFx4keNf0RgCCwE%2F5gCyMz9dJzZLyDD2IAKWq0%2BZVLBi%2F7b8rVNUO1YeOio8ujPMfp7PNvhweEfhhY8gWxNds6w8BqlSQW47gyG6lKcp0A7mT5WgKaRXw1WeqCAEMdJCJlPtEma%2BQC5iWhRM0pLWgiBkR6hefhuzg2Tz54kHG3UNQwcDWAaKnjqYhM7zFoyV4AQaheZ%2FfeYnY1yedYoX4pPvs1ESF9JlWKqYxq45XmyrelrdgZHdinsHB9NygBDgLYdQlVcA8q8aEDwM5yaKxZUCkRDUT%2BJb0%2BCtt9rbu6zRC%2FVmZKIGqbIpVGNy4amYEf%2BnSXLUdz7lVpXGsb3kLoOghblbHcyVEfagdESdqIrQuvWG9mqEGbD0OQjdCwVx4Q4jbP%2F64E0vyYOxW5KEhabAoO8CQ4rv8pn47DEAsuKYtGkCRN%2FxqSxHV6ean9UbkBuNzcfqn%2FVpGx3A2uxr7Lyff7MJArWEMXsvfWi5LKjU8A8WeqnHljxyB6lsfFsi3p6KnjmkR9k7rwdRb2wdfEKvrkoq5%2B9cMWCTkzI1xSuI12GZdP74XfakNrsOJTGxzpMOaBlbgGOqUB6EOKQuRv4stEwpQj1THsV61McwaeBhcQW1ZeiHMR%2FPMuUFHOTfzikGnzEF0dw579Pv6WD2vyvq7i7uJv%2BRQQTqPgYSf6GCpXd%2Bpo4bQXTs9GoUG1Dv0s2Tos1ZBR6T7%2BCdAb%2F%2BMYiPDy86%2FFbh1RI6E5jnVh%2ByCIGL%2Bg53Mj67qwCe%2F7aw%2B6TyAnJVcGnug9ml35ow0E3Vc4ob87u3B9PwqgKEDQ&X-Amz-SignedHeaders=host&X-Amz-Signature=e4981c31034331c2fd0b62d9cfd5b86f4ce28daacc9bf862502fbb9c444389d2	Get hash	malicious	HTMLPhisher	Browse	162.214.125.2
	https://hnt.zkg.mybluehost.me/CA/LET	Get hash	malicious	HTMLPhisher	Browse	50.6.153.248
	paymentremittanceinformationCQDM.html	Get hash	malicious	Unknown	Browse	69.49.245.172
	https://ipfs.io/ipfs/QmNRP5R9QkxB8MVgk2kWzrmB6GoTVL3gcLheGnJuUDPaXv?filename=forme.html#jstubblefield@securustechnologies.com	Get hash	malicious	HTMLPhisher	Browse	162.241.27.10
	NIJIMUN6pQ.exe	Get hash	malicious	AgentTesla	Browse	192.254.225.166
	5FRWRDOqk7.exe	Get hash	malicious	FormBook	Browse	162.240.81.18
	enkJ6J7dAn.exe	Get hash	malicious	FormBook	Browse	162.241.244.106
	Remittance_Raveis.htm	Get hash	malicious	Unknown	Browse	69.49.245.172
	vD6qU34v9S.exe	Get hash	malicious	AgentTesla	Browse	192.254.225.136
AMAZON-02US	file.exe	Get hash	malicious	Credential Flusher	Browse	52.222.236.120
	aXyM30sV1V.elf	Get hash	malicious	Mirai	Browse	65.11.58.70
	n9q8iS3aIJ.elf	Get hash	malicious	Mirai	Browse	18.252.132.149
	file.exe	Get hash	malicious	Credential Flusher	Browse	52.222.236.80
	file.exe	Get hash	malicious	Credential Flusher	Browse	52.222.236.120
	hPIF0APgJk.elf	Get hash	malicious	Unknown	Browse	34.211.87.21
	gkjeNrdkot.elf	Get hash	malicious	Mirai	Browse	13.52.148.217
	eLSH927bGM.elf	Get hash	malicious	Unknown	Browse	3.206.10.11
	7paG4dIQuu.elf	Get hash	malicious	Mirai	Browse	35.179.71.183
	BpcC8hBhCN.elf	Get hash	malicious	Mirai	Browse	3.253.242.61

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/tmp/qemu-open.Y54pMM (deleted)

Download File

Process:	/tmp/SYoMGYCkDG.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	230
Entropy (8bit):	3.709552666863289
Encrypted:	false
SSDEEP:	6:iekrEcvwAsE5KlwSd4pzKaV6Lpms/a/1VCxGF:ur+m5MwSdIKaV6L1adVRF
MD5:	2E667F43AE18CD1FE3C108641708A82C
SHA1:	12B90DE2DA0FBCFE66F3D6130905E56C8D6A68D3
SHA-256:	6F721492E7A337C5B498A8F55F5EB7AC745AFF716D0B5B08EFF2C1B6B250F983
SHA-512:	D2A0EE2509154EC1098994F38BE172F98F4150399C534A04D5C675D7C05630802225019F19344CC9070C576BC465A4FEB382AC7712DE6BF25E9244B54A9DB830
Malicious:	false
Reputation:	high, very likely benign file
Preview:	Iface.Destination.Gateway .Flags.RefCnt.Use.Metric.Mask..MTU.Window.IRTT .ens160.00000000.c0a80201.0003.0.0.0.00000000.0.0.0.ens160.c0a80200.00000000.0001.0.0.0.ffffff00.0.0.0.

Static File Info

General

File type:	ELF 32-bit MSB executable, PowerPC or cisco 4500, version 1 (SYSV), statically linked, not stripped
Entropy (8bit):	6.309384593544864
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	SYoMGYCkDG.elf
File size:	161'741 bytes
MD5:	7b5efc69d9d1010e7afe290236ace207
SHA1:	8caaf963a63f5983cbfeae5db54cfd21628ba53d
SHA256:	41d996b9f378244771954f478f5790e72009dfce3e4aad7d1035793bd08d2ac2
SHA512:	f1ea87e2d43222a6ed466e2931f1c9734ca3fe1febb754e7b2df6b633937980656a320d7371e2ab88ec1a8a35ce07cb6d7c11d383c88ebd47fdc40372e4319bb
SSDEEP:	3072:KN6x6sUSIRD3us+PB5ht+UTHmRsSiSh3n:KN6x6/XkxB5htvHmRsSiSh3n
TLSH:	F7F33C77A21D0383C4C745F02E7F3FF24F6896E222E76085561AEB904B73AB62461F59
File Content Preview:	.ELF...........................4...$.....4. ...(..........................................................t................d...d...d................dt.Q.............................!..\|......$H...H......$8!. \|...N.. .!..\|.......?..........4..../...@..`= .

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	PowerPC
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x10000218
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	4
Section Header Offset:	136996
Section Header Size:	40
Number of Section Headers:	19
Header String Table Index:	16

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x100000b4	0xb4	0x24	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x100000d8	0xd8	0x18420	0x0	0x6	AX	0	0	4
.fini	PROGBITS	0x100184f8	0x184f8	0x20	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x10018518	0x18518	0x81f8	0x0	0x2	A	0	0	8
.eh_frame	PROGBITS	0x10030710	0x20710	0x54	0x0	0x3	WA	0	0	4
.tbss	NOBITS	0x10030764	0x20764	0x8	0x0	0x403	WAT	0	0	4
.ctors	PROGBITS	0x10030764	0x20764	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x1003076c	0x2076c	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x10030774	0x20774	0x4	0x0	0x3	WA	0	0	4
.data	PROGBITS	0x10030778	0x20778	0x2c2	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x10030a3c	0x20a3c	0x10	0x4	0x7	WAX	0	0	4
.sdata	PROGBITS	0x10030a4c	0x20a4c	0x54	0x0	0x3	WA	0	0	4
.sbss	NOBITS	0x10030aa0	0x20aa0	0x94	0x0	0x3	WA	0	0	8
.bss	NOBITS	0x10030b34	0x20aa0	0x70bc	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x20aa0	0xc06	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x216a6	0x7e	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x21a1c	0x34f0	0x10	0x0		18	302	4
.strtab	STRTAB	0x0	0x24f0c	0x28c1	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x10000000	0x10000000	0x20710	0x20710	6.3569	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x20710	0x10030710	0x10030710	0x390	0x74e0	4.6177	0x7	RWE	0x10000	.eh_frame .tbss .ctors .dtors .jcr .data .got .sdata .sbss .bss
TLS	0x20764	0x10030764	0x10030764	0x0	0x8	0.0000	0x4	R	0x4	.tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x100000b4	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x100000d8	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x100184f8	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x10018518	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x10030710	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x10030764	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x10030764	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x1003076c	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x10030774	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x10030778	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x10030a3c	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x10030a4c	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x10030aa0	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x10030b34	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
C.107.5853	.symtab	0x1001ae6c	48	OBJECT	<unknown>	DEFAULT	4
C.140.6164	.symtab	0x1001b2e0	24	OBJECT	<unknown>	DEFAULT	4
C.195.6764	.symtab	0x1001b93c	12	OBJECT	<unknown>	DEFAULT	4
C.196.6765	.symtab	0x1001b8cc	92	OBJECT	<unknown>	DEFAULT	4
C.198.6869	.symtab	0x1001c304	1144	OBJECT	<unknown>	DEFAULT	4
C.201.6906	.symtab	0x1001dec8	24	OBJECT	<unknown>	DEFAULT	4
C.204.6937	.symtab	0x1001e0e8	24	OBJECT	<unknown>	DEFAULT	4
C.215.7076	.symtab	0x1001e340	1128	OBJECT	<unknown>	DEFAULT	4
C.256.7372	.symtab	0x1001e8ac	96	OBJECT	<unknown>	DEFAULT	4
C.260.7420	.symtab	0x1001ea40	36	OBJECT	<unknown>	DEFAULT	4
C.3.5322	.symtab	0x10020270	12	OBJECT	<unknown>	DEFAULT	4
C.3.6030	.symtab	0x1001f214	12	OBJECT	<unknown>	DEFAULT	4
C.3.6052	.symtab	0x100202cc	12	OBJECT	<unknown>	DEFAULT	4
C.3.6106	.symtab	0x100202c0	12	OBJECT	<unknown>	DEFAULT	4
C.4.5416	.symtab	0x100202a8	24	OBJECT	<unknown>	DEFAULT	4
C.4.6053	.symtab	0x100202d8	12	OBJECT	<unknown>	DEFAULT	4
C.6.6061	.symtab	0x100202e4	12	OBJECT	<unknown>	DEFAULT	4
C.7.5462	.symtab	0x1002027c	12	OBJECT	<unknown>	DEFAULT	4
DNSw	.symtab	0x10007ed0	668	FUNC	<unknown>	DEFAULT	2
HIPER_OVH	.symtab	0x1000650c	424	FUNC	<unknown>	DEFAULT	2
Q	.symtab	0x10030b50	16384	OBJECT	<unknown>	DEFAULT	14
Randhex	.symtab	0x10006f64	424	FUNC	<unknown>	DEFAULT	2
SendCloudflare	.symtab	0x10004f68	412	FUNC	<unknown>	DEFAULT	2
SendDOMINATE	.symtab	0x10007258	1428	FUNC	<unknown>	DEFAULT	2
SendHOME1	.symtab	0x100066b4	376	FUNC	<unknown>	DEFAULT	2
SendHOME2	.symtab	0x1000682c	376	FUNC	<unknown>	DEFAULT	2
SendHTTPCloudflare	.symtab	0x10005104	412	FUNC	<unknown>	DEFAULT	2
SendHTTPHex	.symtab	0x10004be0	452	FUNC	<unknown>	DEFAULT	2
SendOVH_STORM	.symtab	0x100057a0	3436	FUNC	<unknown>	DEFAULT	2
SendSTD	.symtab	0x10003638	320	FUNC	<unknown>	DEFAULT	2
SendSTDHEX	.symtab	0x10002c3c	352	FUNC	<unknown>	DEFAULT	2
SendSTD_HEX	.symtab	0x100038c4	376	FUNC	<unknown>	DEFAULT	2
SendUDP	.symtab	0x100021bc	1120	FUNC	<unknown>	DEFAULT	2
UDPRAW	.symtab	0x10006ccc	332	FUNC	<unknown>	DEFAULT	2
_Exit	.symtab	0x1000c9c8	92	FUNC	<unknown>	DEFAULT	2
_GLOBAL_OFFSET_TABLE_	.symtab	0x10030a40	0	OBJECT	<unknown>	HIDDEN	11
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_SDA_BASE_	.symtab	0x10038a4c	0	NOTYPE	<unknown>	DEFAULT	12
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x10030768	0	OBJECT	<unknown>	DEFAULT	7
__CTOR_LIST__	.symtab	0x10030764	0	OBJECT	<unknown>	DEFAULT	7
__C_ctype_b	.symtab	0x10030a54	4	OBJECT	<unknown>	DEFAULT	12
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x1001ec12	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x10030a98	4	OBJECT	<unknown>	DEFAULT	12
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x10020410	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x10030a5c	4	OBJECT	<unknown>	DEFAULT	12
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x1001ef12	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x10030770	0	OBJECT	<unknown>	DEFAULT	8
__DTOR_LIST__	.symtab	0x1003076c	0	OBJECT	<unknown>	DEFAULT	8
__EH_FRAME_BEGIN__	.symtab	0x10030710	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x10030760	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x10030a54	4	OBJECT	<unknown>	HIDDEN	12
__GI___C_ctype_tolower	.symtab	0x10030a98	4	OBJECT	<unknown>	HIDDEN	12
__GI___C_ctype_toupper	.symtab	0x10030a5c	4	OBJECT	<unknown>	HIDDEN	12
__GI___close	.symtab	0x10011194	116	FUNC	<unknown>	HIDDEN	2
__GI___close_nocancel	.symtab	0x100111a0	16	FUNC	<unknown>	HIDDEN	2
__GI___ctype_b	.symtab	0x10030a58	4	OBJECT	<unknown>	HIDDEN	12
__GI___ctype_tolower	.symtab	0x10030a9c	4	OBJECT	<unknown>	HIDDEN	12
__GI___ctype_toupper	.symtab	0x10030a60	4	OBJECT	<unknown>	HIDDEN	12
__GI___errno_location	.symtab	0x1000cc64	20	FUNC	<unknown>	HIDDEN	2
__GI___fcntl_nocancel	.symtab	0x1000c868	116	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x10014674	312	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x1000e5f0	48	FUNC	<unknown>	HIDDEN	2
__GI___libc_close	.symtab	0x10011194	116	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x1000c8dc	236	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x10011208	132	FUNC	<unknown>	HIDDEN	2
__GI___libc_read	.symtab	0x10011310	132	FUNC	<unknown>	HIDDEN	2
__GI___libc_waitpid	.symtab	0x10011394	132	FUNC	<unknown>	HIDDEN	2
__GI___libc_write	.symtab	0x1001128c	132	FUNC	<unknown>	HIDDEN	2
__GI___open	.symtab	0x10011208	132	FUNC	<unknown>	HIDDEN	2
__GI___open_nocancel	.symtab	0x10011214	16	FUNC	<unknown>	HIDDEN	2
__GI___read	.symtab	0x10011310	132	FUNC	<unknown>	HIDDEN	2
__GI___read_nocancel	.symtab	0x1001131c	16	FUNC	<unknown>	HIDDEN	2
__GI___register_atfork	.symtab	0x10010dc8	356	FUNC	<unknown>	HIDDEN	2
__GI___sigaddset	.symtab	0x1000ef4c	40	FUNC	<unknown>	HIDDEN	2
__GI___sigdelset	.symtab	0x1000ef74	40	FUNC	<unknown>	HIDDEN	2
__GI___sigismember	.symtab	0x1000ef24	40	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x10011594	144	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x10011684	100	FUNC	<unknown>	HIDDEN	2
__GI___waitpid	.symtab	0x10011394	132	FUNC	<unknown>	HIDDEN	2
__GI___write	.symtab	0x1001128c	132	FUNC	<unknown>	HIDDEN	2
__GI___write_nocancel	.symtab	0x10011298	16	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x1000e620	284	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x1000c9c8	92	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x1000fdec	248	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x10010404	12	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x10015a20	52	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0x1000ca58	52	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x10011194	116	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0x100122dc	212	FUNC	<unknown>	HIDDEN	2
__GI_config_close	.symtab	0x100129e8	80	FUNC	<unknown>	HIDDEN	2
__GI_config_open	.symtab	0x10012a38	84	FUNC	<unknown>	HIDDEN	2
__GI_config_read	.symtab	0x100126b4	820	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x1000eaf0	120	FUNC	<unknown>	HIDDEN	2
__GI_execve	.symtab	0x10012054	52	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x100105d0	136	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x10012bb4	640	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x1000c8dc	236	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x1001438c	744	FUNC	<unknown>	HIDDEN	2
__GI_fgetc	.symtab	0x10013f4c	304	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x10014674	312	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x1001407c	244	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x100147ac	196	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x10012e34	12	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x10010a5c	824	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x1000dfd8	92	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x10015e40	16	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x10015e50	404	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x10015a88	124	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x1000e034	192	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x10014674	312	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x1000ca8c	56	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x10012088	16	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x10012098	16	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x100120a8	16	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname	.symtab	0x1000ea6c	8	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2	.symtab	0x1000ea74	72	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2_r	.symtab	0x10014f28	664	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x10017930	748	FUNC	<unknown>	HIDDEN	2
__GI_gethostname	.symtab	0x10017c74	136	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x100120b8	28	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x10010f2c	56	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x1000cac4	52	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x1000eb68	52	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x100120d4	16	FUNC	<unknown>	HIDDEN	2
__GI_htonl	.symtab	0x1000e980	4	FUNC	<unknown>	HIDDEN	2
__GI_htons	.symtab	0x1000e984	4	FUNC	<unknown>	HIDDEN	2
__GI_inet_addr	.symtab	0x1000ea38	52	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x10014e58	208	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa	.symtab	0x1000ea04	52	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa_r	.symtab	0x1000e988	124	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x10016938	728	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x100165d8	524	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x10010238	236	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x1000c784	228	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x10014e2c	44	FUNC	<unknown>	HIDDEN	2
__GI_isspace	.symtab	0x1000cc2c	24	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x1000caf8	52	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x10017e58	112	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x10014914	264	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x1000e0f4	156	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x10014870	164	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x10014a1c	52	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x10014a50	244	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x1000e190	144	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x100120e4	52	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x10015b04	52	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x10012118	52	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x10012180	112	FUNC	<unknown>	HIDDEN	2
__GI_ntohl	.symtab	0x1000e978	4	FUNC	<unknown>	HIDDEN	2
__GI_ntohs	.symtab	0x1000e97c	4	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x10011208	132	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0x10012468	208	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x10017d30	120	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x10010f64	148	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x1000fee8	104	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x100100b8	140	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x10016388	184	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x10011310	132	FUNC	<unknown>	HIDDEN	2
__GI_readdir64	.symtab	0x100125f0	196	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x1000ec04	128	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x100121f0	116	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x1000cb60	136	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x1000ecb8	128	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x1000ed6c	144	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x1000cbe8	52	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x1000edfc	52	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x10010324	224	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x100151c0	36	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x1000ee64	192	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x10012264	120	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x10010ff8	292	FUNC	<unknown>	HIDDEN	2
__GI_snprintf	.symtab	0x1000cc78	124	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x1000ee30	52	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x1000ccf4	136	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x10010144	244	FUNC	<unknown>	HIDDEN	2
__GI_stat	.symtab	0x10017da8	124	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x10018370	80	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x1000e220	256	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul	.symtab	0x10014b44	248	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x1000e320	52	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x1000e320	52	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x1000e354	32	FUNC	<unknown>	HIDDEN	2
__GI_strcspn	.symtab	0x10014c3c	96	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x10017ec8	80	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x1000e374	160	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x10016440	188	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x1000e414	236	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x10014df0	60	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x10014c9c	112	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x10014d0c	72	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x1000e500	240	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x1000e758	12	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x10014d54	156	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x10010410	8	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x100107a0	624	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x1000e764	156	FUNC	<unknown>	HIDDEN	2
__GI_tcsetattr	.symtab	0x1000e800	376	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x1000cc1c	16	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x1000cc44	32	FUNC	<unknown>	HIDDEN	2
__GI_uname	.symtab	0x10017e24	52	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x1000cd7c	224	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x10011394	132	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x10012a8c	92	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x10012af8	188	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x10012ae8	16	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x1001128c	132	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x10030774	0	OBJECT	<unknown>	DEFAULT	9
__JCR_LIST__	.symtab	0x10030774	0	OBJECT	<unknown>	DEFAULT	9
__app_fini	.symtab	0x10030ae4	4	OBJECT	<unknown>	HIDDEN	13
__atexit_lock	.symtab	0x10030954	24	OBJECT	<unknown>	DEFAULT	10
__bss_start	.symtab	0x10030aa0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x10011624	96	FUNC	<unknown>	DEFAULT	2
__close	.symtab	0x10011194	116	FUNC	<unknown>	DEFAULT	2
__close_nameservers	.symtab	0x10017848	144	FUNC	<unknown>	HIDDEN	2
__close_nocancel	.symtab	0x100111a0	16	FUNC	<unknown>	DEFAULT	2
__ctype_b	.symtab	0x10030a58	4	OBJECT	<unknown>	DEFAULT	12
__ctype_tolower	.symtab	0x10030a9c	4	OBJECT	<unknown>	DEFAULT	12
__ctype_toupper	.symtab	0x10030a60	4	OBJECT	<unknown>	DEFAULT	12
__curbrk	.symtab	0x10030b1c	4	OBJECT	<unknown>	DEFAULT	13
__data_start	.symtab	0x10030780	0	NOTYPE	<unknown>	DEFAULT	10
__decode_dotted	.symtab	0x10016c10	280	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x10018000	188	FUNC	<unknown>	HIDDEN	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__dns_lookup	.symtab	0x10016d28	1672	FUNC	<unknown>	HIDDEN	2
__do_global_ctors_aux	.symtab	0x1001848c	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x100000d8	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x10030778	0	OBJECT	<unknown>	HIDDEN	10
__encode_dotted	.symtab	0x100183c0	204	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x10017f18	232	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x100180bc	124	FUNC	<unknown>	HIDDEN	2
__environ	.symtab	0x10030adc	4	OBJECT	<unknown>	DEFAULT	13
__errno_location	.symtab	0x1000cc64	20	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x10030ac8	4	OBJECT	<unknown>	HIDDEN	13
__fcntl_nocancel	.symtab	0x1000c868	116	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x10014674	312	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x10030764	0	NOTYPE	<unknown>	HIDDEN	6
__fini_array_start	.symtab	0x10030764	0	NOTYPE	<unknown>	HIDDEN	6
__fork	.symtab	0x10010a5c	824	FUNC	<unknown>	DEFAULT	2
__fork_generation_pointer	.symtab	0x10030acc	4	OBJECT	<unknown>	HIDDEN	13
__fork_handlers	.symtab	0x10030ad0	4	OBJECT	<unknown>	HIDDEN	13
__fork_lock	.symtab	0x10030ad4	4	OBJECT	<unknown>	HIDDEN	13
__get_hosts_byname_r	.symtab	0x100178d8	88	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x10015ce8	344	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x100120b8	28	FUNC	<unknown>	DEFAULT	2
__getpid	.symtab	0x10010f2c	56	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x1000e5f0	48	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__h_errno_location	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__init_array_end	.symtab	0x10030764	0	NOTYPE	<unknown>	HIDDEN	6
__init_array_start	.symtab	0x10030764	0	NOTYPE	<unknown>	HIDDEN	6
__libc_close	.symtab	0x10011194	116	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x1000eaf0	120	FUNC	<unknown>	DEFAULT	2
__libc_disable_asynccancel	.symtab	0x10011418	124	FUNC	<unknown>	HIDDEN	2
__libc_enable_asynccancel	.symtab	0x10011494	172	FUNC	<unknown>	HIDDEN	2
__libc_errno	.symtab	0x0	4	TLS	<unknown>	HIDDEN	6
__libc_fcntl	.symtab	0x1000c8dc	236	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x10010a5c	824	FUNC	<unknown>	DEFAULT	2
__libc_h_errno	.symtab	0x4	4	TLS	<unknown>	HIDDEN	6
__libc_nanosleep	.symtab	0x10012180	112	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x10011208	132	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x10011310	132	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x1000ec04	128	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x1000cb60	136	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x1000ecb8	128	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x1000ed6c	144	FUNC	<unknown>	DEFAULT	2
__libc_setup_tls	.symtab	0x10015710	464	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x100151c0	36	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x10030ad8	4	OBJECT	<unknown>	DEFAULT	13
__libc_system	.symtab	0x10011fac	132	FUNC	<unknown>	DEFAULT	2
__libc_waitpid	.symtab	0x10011394	132	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x1001128c	132	FUNC	<unknown>	DEFAULT	2
__linkin_atfork	.symtab	0x10010d94	52	FUNC	<unknown>	HIDDEN	2
__lll_lock_wait_private	.symtab	0x1001111c	120	FUNC	<unknown>	HIDDEN	2
__local_nameserver	.symtab	0x10020398	16	OBJECT	<unknown>	HIDDEN	4
__malloc_consolidate	.symtab	0x1000f9d4	460	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x1000ef9c	112	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x10030878	24	OBJECT	<unknown>	DEFAULT	10
__malloc_state	.symtab	0x10037878	888	OBJECT	<unknown>	DEFAULT	14
__malloc_trim	.symtab	0x1000f91c	184	FUNC	<unknown>	DEFAULT	2
__nameserver	.symtab	0x10030b28	4	OBJECT	<unknown>	HIDDEN	13
__nameservers	.symtab	0x10030b2c	4	OBJECT	<unknown>	HIDDEN	13
__nptl_deallocate_tsd	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__nptl_nthreads	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__open	.symtab	0x10011208	132	FUNC	<unknown>	DEFAULT	2
__open_etc_hosts	.symtab	0x10018138	12	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x10017434	1044	FUNC	<unknown>	HIDDEN	2
__open_nocancel	.symtab	0x10011214	16	FUNC	<unknown>	DEFAULT	2
__pagesize	.symtab	0x10030ae0	4	OBJECT	<unknown>	DEFAULT	13
__preinit_array_end	.symtab	0x10030764	0	NOTYPE	<unknown>	HIDDEN	6
__preinit_array_start	.symtab	0x10030764	0	NOTYPE	<unknown>	HIDDEN	6
__progname	.symtab	0x10030a6c	4	OBJECT	<unknown>	DEFAULT	12
__progname_full	.symtab	0x10030a70	4	OBJECT	<unknown>	DEFAULT	12
__pthread_initialize_minimal	.symtab	0x100158e0	12	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_init	.symtab	0x10011548	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x10011540	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x10011540	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x10011540	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x10011540	8	FUNC	<unknown>	DEFAULT	2
__pthread_unwind	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__read	.symtab	0x10011310	132	FUNC	<unknown>	DEFAULT	2
__read_etc_hosts_r	.symtab	0x10018144	556	FUNC	<unknown>	HIDDEN	2
__read_nocancel	.symtab	0x1001131c	16	FUNC	<unknown>	DEFAULT	2
__register_atfork	.symtab	0x10010dc8	356	FUNC	<unknown>	DEFAULT	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__res_sync	.symtab	0x10030b20	4	OBJECT	<unknown>	HIDDEN	13
__resolv_attempts	.symtab	0x10030a95	1	OBJECT	<unknown>	HIDDEN	12
__resolv_lock	.symtab	0x10037810	24	OBJECT	<unknown>	DEFAULT	14
__resolv_timeout	.symtab	0x10030a94	1	OBJECT	<unknown>	HIDDEN	12
__rtld_fini	.symtab	0x10030ae8	4	OBJECT	<unknown>	HIDDEN	13
__searchdomain	.symtab	0x10030b24	4	OBJECT	<unknown>	HIDDEN	13
__searchdomains	.symtab	0x10030b30	4	OBJECT	<unknown>	HIDDEN	13
__sigaddset	.symtab	0x1000ef4c	40	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x1000ef74	40	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x1000ef24	40	FUNC	<unknown>	DEFAULT	2
__sigjmp_save	.symtab	0x10017c1c	88	FUNC	<unknown>	HIDDEN	2
__sigsetjmp	.symtab	0x10015974	172	FUNC	<unknown>	DEFAULT	2
__stdin	.symtab	0x10030a80	4	OBJECT	<unknown>	DEFAULT	12
__stdio_READ	.symtab	0x10015fe4	120	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x1001605c	264	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x10016164	212	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x10013228	364	FUNC	<unknown>	HIDDEN	2
__stdio_rfill	.symtab	0x10016238	72	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x10016330	88	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x10016280	176	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x10013550	260	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x10013654	76	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x10030a84	4	OBJECT	<unknown>	DEFAULT	12
__sys_connect	.symtab	0x1000eabc	52	FUNC	<unknown>	DEFAULT	2
__sys_recv	.symtab	0x1000ebd0	52	FUNC	<unknown>	DEFAULT	2
__sys_send	.symtab	0x1000ec84	52	FUNC	<unknown>	DEFAULT	2
__sys_sendto	.symtab	0x1000ed38	52	FUNC	<unknown>	DEFAULT	2
__syscall_error	.symtab	0x10012030	28	FUNC	<unknown>	HIDDEN	2
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_nanosleep	.symtab	0x1001214c	52	FUNC	<unknown>	DEFAULT	2
__syscall_poll	.symtab	0x10017cfc	52	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction	.symtab	0x10015a54	52	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_select	.symtab	0x1000cb2c	52	FUNC	<unknown>	DEFAULT	2
__uClibc_fini	.symtab	0x10011594	144	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x10011684	100	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x100116e8	840	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x10030a68	4	OBJECT	<unknown>	HIDDEN	12
__waitpid	.symtab	0x10011394	132	FUNC	<unknown>	DEFAULT	2
__waitpid_nocancel	.symtab	0x100113a0	16	FUNC	<unknown>	DEFAULT	2
__write	.symtab	0x1001128c	132	FUNC	<unknown>	DEFAULT	2
__write_nocancel	.symtab	0x10011298	16	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r	.symtab	0x1000e620	284	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__xstat32_conv	.symtab	0x10015c1c	204	FUNC	<unknown>	HIDDEN	2
__xstat64_conv	.symtab	0x10015b38	228	FUNC	<unknown>	HIDDEN	2
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_bss_custom_printf_spec	.symtab	0x10034b50	10	OBJECT	<unknown>	DEFAULT	14
_charpad	.symtab	0x1000ce5c	100	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_custom_printf_arginfo	.symtab	0x10037828	40	OBJECT	<unknown>	HIDDEN	14
_custom_printf_handler	.symtab	0x10037850	40	OBJECT	<unknown>	HIDDEN	14
_custom_printf_spec	.symtab	0x10030a64	4	OBJECT	<unknown>	HIDDEN	12
_dl_aux_init	.symtab	0x100158ec	28	FUNC	<unknown>	DEFAULT	2
_dl_init_static_tls	.symtab	0x10030a90	4	OBJECT	<unknown>	DEFAULT	12
_dl_nothread_init_static_tls	.symtab	0x10015908	108	FUNC	<unknown>	HIDDEN	2
_dl_phdr	.symtab	0x10030b14	4	OBJECT	<unknown>	DEFAULT	13
_dl_phnum	.symtab	0x10030b18	4	OBJECT	<unknown>	DEFAULT	13
_dl_tls_dtv_gaps	.symtab	0x10030b08	1	OBJECT	<unknown>	DEFAULT	13
_dl_tls_dtv_slotinfo_list	.symtab	0x10030b04	4	OBJECT	<unknown>	DEFAULT	13
_dl_tls_generation	.symtab	0x10030b0c	4	OBJECT	<unknown>	DEFAULT	13
_dl_tls_max_dtv_idx	.symtab	0x10030afc	4	OBJECT	<unknown>	DEFAULT	13
_dl_tls_setup	.symtab	0x100156c0	80	FUNC	<unknown>	DEFAULT	2
_dl_tls_static_align	.symtab	0x10030af8	4	OBJECT	<unknown>	DEFAULT	13
_dl_tls_static_nelem	.symtab	0x10030b10	4	OBJECT	<unknown>	DEFAULT	13
_dl_tls_static_size	.symtab	0x10030b00	4	OBJECT	<unknown>	DEFAULT	13
_dl_tls_static_used	.symtab	0x10030af4	4	OBJECT	<unknown>	DEFAULT	13
_edata	.symtab	0x10030aa0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x10037bf0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_exit	.symtab	0x1000c9c8	92	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x100184f8	0	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x100352cc	8192	OBJECT	<unknown>	DEFAULT	14
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x1000cec0	152	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x10013854	1784	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_init	.symtab	0x100000b4	0	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x100136a0	128	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_init	.symtab	0x1000d650	188	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x1000da08	1488	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x1000d70c	92	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x1000d768	608	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x1000d9c8	64	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x1001155c	56	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x10011550	12	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_setjmp	.symtab	0x1001204c	8	FUNC	<unknown>	DEFAULT	2
_sigintr	.symtab	0x10030ac0	8	OBJECT	<unknown>	HIDDEN	13
_start	.symtab	0x10000218	72	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x10012e40	1000	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x10013394	128	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x10030a88	4	OBJECT	<unknown>	DEFAULT	12
_stdio_openlist_add_lock	.symtab	0x100352b4	12	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_dec_use	.symtab	0x10014170	540	FUNC	<unknown>	HIDDEN	2
_stdio_openlist_del_count	.symtab	0x10030af0	4	OBJECT	<unknown>	DEFAULT	13
_stdio_openlist_del_lock	.symtab	0x100352c0	12	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_use_count	.symtab	0x10030aec	4	OBJECT	<unknown>	DEFAULT	13
_stdio_streams	.symtab	0x1003096c	204	OBJECT	<unknown>	DEFAULT	10
_stdio_term	.symtab	0x10013414	316	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x10030a8c	4	OBJECT	<unknown>	DEFAULT	12
_stdlib_strto_l	.symtab	0x10010418	440	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x10013720	60	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x1001f2e0	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x1001375c	248	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x1000cf58	1784	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x1000fdec	248	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
access	.symtab	0x1000ca24	52	FUNC	<unknown>	DEFAULT	2
access.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
astd	.symtab	0x10004a8c	340	FUNC	<unknown>	DEFAULT	2
atcp	.symtab	0x1000446c	1568	FUNC	<unknown>	DEFAULT	2
atoi	.symtab	0x10010404	12	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x10010404	12	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
audp	.symtab	0x10003edc	1424	FUNC	<unknown>	DEFAULT	2
bcopy	.symtab	0x1000e73c	16	FUNC	<unknown>	DEFAULT	2
bcopy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
been_there_done_that	.symtab	0x10034d3c	4	OBJECT	<unknown>	DEFAULT	14
bot.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
brk	.symtab	0x10015a20	52	FUNC	<unknown>	DEFAULT	2
bsd_signal	.symtab	0x1000ee64	192	FUNC	<unknown>	DEFAULT	2
buf.4826	.symtab	0x10034b60	16	OBJECT	<unknown>	DEFAULT	14
buf.6501	.symtab	0x10034b84	440	OBJECT	<unknown>	DEFAULT	14
bzero	.symtab	0x1000e74c	12	FUNC	<unknown>	DEFAULT	2
bzero.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
c	.symtab	0x10030870	4	OBJECT	<unknown>	DEFAULT	10
call___do_global_ctors_aux	.symtab	0x100184dc	0	FUNC	<unknown>	DEFAULT	2
call___do_global_dtors_aux	.symtab	0x10000170	0	FUNC	<unknown>	DEFAULT	2
call_frame_dummy	.symtab	0x100001fc	0	FUNC	<unknown>	DEFAULT	2
calloc	.symtab	0x100151e4	264	FUNC	<unknown>	DEFAULT	2
calloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
cancel_handler	.symtab	0x10011a30	272	FUNC	<unknown>	DEFAULT	2
chdir	.symtab	0x1000ca58	52	FUNC	<unknown>	DEFAULT	2
chdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x10011194	116	FUNC	<unknown>	DEFAULT	2
closedir	.symtab	0x100122dc	212	FUNC	<unknown>	DEFAULT	2
closedir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
closenameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
commServer	.symtab	0x10030a4c	4	OBJECT	<unknown>	DEFAULT	12
completed.5580	.symtab	0x10030b34	0	OBJECT	<unknown>	DEFAULT	14
connect	.symtab	0x1000eaf0	120	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connectTimeout	.symtab	0x10001a4c	656	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
csum	.symtab	0x10001ea8	320	FUNC	<unknown>	DEFAULT	2
currentServer	.symtab	0x10030a50	4	OBJECT	<unknown>	DEFAULT	12
data_start	.symtab	0x10030780	0	NOTYPE	<unknown>	DEFAULT	10
decoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dnslookup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
do_system	.symtab	0x10011b40	1132	FUNC	<unknown>	DEFAULT	2
encoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ	.symtab	0x10030adc	4	OBJECT	<unknown>	DEFAULT	13
errno	.symtab	0x0	4	TLS	<unknown>	DEFAULT	6
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execve	.symtab	0x10012054	52	FUNC	<unknown>	DEFAULT	2
execve.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x100105d0	136	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x10020308	72	OBJECT	<unknown>	DEFAULT	4
fclose	.symtab	0x10012bb4	640	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x1000c8dc	236	FUNC	<unknown>	DEFAULT	2
fd_to_DIR	.symtab	0x100123b0	184	FUNC	<unknown>	DEFAULT	2
fdgets	.symtab	0x100005e4	232	FUNC	<unknown>	DEFAULT	2
fdopendir	.symtab	0x10012538	184	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x1001438c	744	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc	.symtab	0x10013f4c	304	FUNC	<unknown>	DEFAULT	2
fgetc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x10014674	312	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x1001407c	244	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x100147ac	196	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fmt	.symtab	0x100202f0	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x10012e34	12	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0x10010a5c	824	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork_handler_pool	.symtab	0x10034d40	1348	OBJECT	<unknown>	DEFAULT	14
fputs_unlocked	.symtab	0x1000dfd8	92	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x1000018c	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x1000fba0	524	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x10015e40	16	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x10015e40	16	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x10015e50	404	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fstat	.symtab	0x10015a88	124	FUNC	<unknown>	DEFAULT	2
fstat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ftcp	.symtab	0x1000261c	1568	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked	.symtab	0x1000e034	192	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getArch	.symtab	0x10008768	40	FUNC	<unknown>	DEFAULT	2
getHost	.symtab	0x10001620	124	FUNC	<unknown>	DEFAULT	2
getOurIP	.symtab	0x100006cc	644	FUNC	<unknown>	DEFAULT	2
getPortz	.symtab	0x10008790	256	FUNC	<unknown>	DEFAULT	2
getRandomIP	.symtab	0x10000574	112	FUNC	<unknown>	DEFAULT	2
get_hosts_byname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getc	.symtab	0x10013f4c	304	FUNC	<unknown>	DEFAULT	2
getc_unlocked	.symtab	0x10014674	312	FUNC	<unknown>	DEFAULT	2
getdents64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdtablesize	.symtab	0x1000ca8c	56	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x10012088	16	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x10012098	16	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x100120a8	16	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname	.symtab	0x1000ea6c	8	FUNC	<unknown>	DEFAULT	2
gethostbyname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname2	.symtab	0x1000ea74	72	FUNC	<unknown>	DEFAULT	2
gethostbyname2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname2_r	.symtab	0x10014f28	664	FUNC	<unknown>	DEFAULT	2
gethostbyname2_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r	.symtab	0x10017930	748	FUNC	<unknown>	DEFAULT	2
gethostbyname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostname	.symtab	0x10017c74	136	FUNC	<unknown>	DEFAULT	2
gethostname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpagesize	.symtab	0x100120b8	28	FUNC	<unknown>	DEFAULT	2
getpagesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x10010f2c	56	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x1000cac4	52	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockname	.symtab	0x1000eb68	52	FUNC	<unknown>	DEFAULT	2
getsockname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x1000eb9c	52	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x100120d4	16	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gotIP	.symtab	0x10030aa4	4	OBJECT	<unknown>	DEFAULT	13
h_errno	.symtab	0x4	4	TLS	<unknown>	DEFAULT	6
hoste.6500	.symtab	0x10034b70	20	OBJECT	<unknown>	DEFAULT	14
htonl	.symtab	0x1000e980	4	FUNC	<unknown>	DEFAULT	2
htons	.symtab	0x1000e984	4	FUNC	<unknown>	DEFAULT	2
httpattack	.symtab	0x100052a0	1280	FUNC	<unknown>	DEFAULT	2
i.4882	.symtab	0x10030874	4	OBJECT	<unknown>	DEFAULT	10
index	.symtab	0x1000e220	256	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x1000ea38	52	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x10014e58	208	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa	.symtab	0x1000ea04	52	FUNC	<unknown>	DEFAULT	2
inet_ntoa.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa_r	.symtab	0x1000e988	124	FUNC	<unknown>	DEFAULT	2
inet_ntop	.symtab	0x10016938	728	FUNC	<unknown>	DEFAULT	2
inet_ntop4	.symtab	0x100167e4	340	FUNC	<unknown>	DEFAULT	2
inet_pton	.symtab	0x100165d8	524	FUNC	<unknown>	DEFAULT	2
inet_pton4	.symtab	0x100164fc	220	FUNC	<unknown>	DEFAULT	2
initConnection	.symtab	0x1000bdfc	412	FUNC	<unknown>	DEFAULT	2
init_rand	.symtab	0x10000334	232	FUNC	<unknown>	DEFAULT	2
init_static_tls	.symtab	0x10015684	60	FUNC	<unknown>	DEFAULT	2
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initstate	.symtab	0x1000ffcc	132	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x10010238	236	FUNC	<unknown>	DEFAULT	2
intr	.symtab	0x100352a0	20	OBJECT	<unknown>	DEFAULT	14
ioctl	.symtab	0x1000c784	228	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isatty	.symtab	0x10014e2c	44	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isspace	.symtab	0x1000cc2c	24	FUNC	<unknown>	DEFAULT	2
isspace.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0x1000caf8	52	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
last_id.6558	.symtab	0x10030a38	2	OBJECT	<unknown>	DEFAULT	10
last_ns_num.6557	.symtab	0x10037808	4	OBJECT	<unknown>	DEFAULT	14
libc-cancellation.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc-lowlevellock.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc-tls.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
listFork	.symtab	0x10001cdc	460	FUNC	<unknown>	DEFAULT	2
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lock	.symtab	0x10035284	4	OBJECT	<unknown>	DEFAULT	14
lseek64	.symtab	0x10017e58	112	FUNC	<unknown>	DEFAULT	2
macAddress	.symtab	0x10030ab0	6	OBJECT	<unknown>	DEFAULT	13
main	.symtab	0x1000bf98	2028	FUNC	<unknown>	DEFAULT	2
mainCommSock	.symtab	0x10030aa0	4	OBJECT	<unknown>	DEFAULT	13
makeIPPacket	.symtab	0x100020d0	236	FUNC	<unknown>	DEFAULT	2
makeRandomStr	.symtab	0x1000169c	188	FUNC	<unknown>	DEFAULT	2
makevsepacket	.symtab	0x10002ee4	264	FUNC	<unknown>	DEFAULT	2
malloc	.symtab	0x1000f00c	2320	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
malloc_trim	.symtab	0x1000fdac	64	FUNC	<unknown>	DEFAULT	2
memchr	.symtab	0x10014914	264	FUNC	<unknown>	DEFAULT	2
memchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memcpy	.symtab	0x1000e0f4	156	FUNC	<unknown>	DEFAULT	2
memcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memmove	.symtab	0x10014870	164	FUNC	<unknown>	DEFAULT	2
memmove.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mempcpy	.symtab	0x10014a1c	52	FUNC	<unknown>	DEFAULT	2
mempcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memrchr	.symtab	0x10014a50	244	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x1000e190	144	FUNC	<unknown>	DEFAULT	2
memset.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mmap	.symtab	0x100120e4	52	FUNC	<unknown>	DEFAULT	2
mmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mremap	.symtab	0x10015b04	52	FUNC	<unknown>	DEFAULT	2
mremap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
munmap	.symtab	0x10012118	52	FUNC	<unknown>	DEFAULT	2
munmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mylock	.symtab	0x10030890	24	OBJECT	<unknown>	DEFAULT	10
mylock	.symtab	0x100308a8	24	OBJECT	<unknown>	DEFAULT	10
nanosleep	.symtab	0x10012180	112	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
next_start.1347	.symtab	0x10034b5c	4	OBJECT	<unknown>	DEFAULT	14
nprocessors_onln	.symtab	0x10010658	328	FUNC	<unknown>	DEFAULT	2
ntohl	.symtab	0x1000e978	4	FUNC	<unknown>	DEFAULT	2
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0x1000e97c	4	FUNC	<unknown>	DEFAULT	2
ntop.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
numpids	.symtab	0x10030aa8	8	OBJECT	<unknown>	DEFAULT	13
object.5595	.symtab	0x10030b38	0	OBJECT	<unknown>	DEFAULT	14
open	.symtab	0x10011208	132	FUNC	<unknown>	DEFAULT	2
opendir	.symtab	0x10012468	208	FUNC	<unknown>	DEFAULT	2
opendir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opennameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ourIP	.symtab	0x10030ab8	4	OBJECT	<unknown>	DEFAULT	13
p.5578	.symtab	0x1003077c	0	OBJECT	<unknown>	DEFAULT	10
parse_config.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pids	.symtab	0x10030abc	4	OBJECT	<unknown>	DEFAULT	13
poll	.symtab	0x10017d30	120	FUNC	<unknown>	DEFAULT	2
poll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prefix.6256	.symtab	0x1001f228	12	OBJECT	<unknown>	DEFAULT	4
print	.symtab	0x10000ed0	1568	FUNC	<unknown>	DEFAULT	2
printchar	.symtab	0x10000aac	128	FUNC	<unknown>	DEFAULT	2
printi	.symtab	0x10000cd0	512	FUNC	<unknown>	DEFAULT	2
prints	.symtab	0x10000b2c	420	FUNC	<unknown>	DEFAULT	2
processCmd	.symtab	0x10008890	13520	FUNC	<unknown>	DEFAULT	2
program_invocation_name	.symtab	0x10030a70	4	OBJECT	<unknown>	DEFAULT	12
program_invocation_short_name	.symtab	0x10030a6c	4	OBJECT	<unknown>	DEFAULT	12
qual_chars.6264	.symtab	0x1001f270	20	OBJECT	<unknown>	DEFAULT	4
quit	.symtab	0x1003528c	20	OBJECT	<unknown>	DEFAULT	14
raise	.symtab	0x10010f64	148	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x1000fee4	4	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand_cmwc	.symtab	0x1000041c	344	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x1000fee8	104	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x1001fe3c	40	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x100100b8	140	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randtbl	.symtab	0x100308d4	128	OBJECT	<unknown>	DEFAULT	10
rawmemchr	.symtab	0x10016388	184	FUNC	<unknown>	DEFAULT	2
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read	.symtab	0x10011310	132	FUNC	<unknown>	DEFAULT	2
read_etc_hosts_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
readdir64	.symtab	0x100125f0	196	FUNC	<unknown>	DEFAULT	2
readdir64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
realloc	.symtab	0x100152ec	920	FUNC	<unknown>	DEFAULT	2
realloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
realrand	.symtab	0x1000bd60	156	FUNC	<unknown>	DEFAULT	2
recv	.symtab	0x1000ec04	128	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recvLine	.symtab	0x10001758	756	FUNC	<unknown>	DEFAULT	2
register-atfork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
resolv_conf_mtime.6540	.symtab	0x1003780c	4	OBJECT	<unknown>	DEFAULT	14
rindex	.symtab	0x10014c9c	112	FUNC	<unknown>	DEFAULT	2
rtcp	.symtab	0x10003a3c	1184	FUNC	<unknown>	DEFAULT	2
sa_refcntr	.symtab	0x10035288	4	OBJECT	<unknown>	DEFAULT	14
sbrk	.symtab	0x100121f0	116	FUNC	<unknown>	DEFAULT	2
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
select	.symtab	0x1000cb60	136	FUNC	<unknown>	DEFAULT	2
select.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send	.symtab	0x1000ecb8	128	FUNC	<unknown>	DEFAULT	2
send.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sendHLD	.symtab	0x1000816c	1532	FUNC	<unknown>	DEFAULT	2
sendHTTPtwo	.symtab	0x10004da4	452	FUNC	<unknown>	DEFAULT	2
sendKILLALL	.symtab	0x100069a4	808	FUNC	<unknown>	DEFAULT	2
sendPkt	.symtab	0x10007d14	444	FUNC	<unknown>	DEFAULT	2
sendTLS	.symtab	0x100077ec	1320	FUNC	<unknown>	DEFAULT	2
senditbudAMP	.symtab	0x10000260	212	FUNC	<unknown>	DEFAULT	2
sendnfo	.symtab	0x10006e18	332	FUNC	<unknown>	DEFAULT	2
sendto	.symtab	0x1000ed6c	144	FUNC	<unknown>	DEFAULT	2
sendto.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsid	.symtab	0x1000cbe8	52	FUNC	<unknown>	DEFAULT	2
setsid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsockopt	.symtab	0x1000edfc	52	FUNC	<unknown>	DEFAULT	2
setsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate	.symtab	0x1000ff50	124	FUNC	<unknown>	DEFAULT	2
setstate_r	.symtab	0x10010324	224	FUNC	<unknown>	DEFAULT	2
sigaction	.symtab	0x100151c0	36	FUNC	<unknown>	DEFAULT	2
sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigjmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
signal	.symtab	0x1000ee64	192	FUNC	<unknown>	DEFAULT	2
signal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigprocmask	.symtab	0x10012264	120	FUNC	<unknown>	DEFAULT	2
sigprocmask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigsetops.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
skip_and_NUL_space	.symtab	0x100173f0	68	FUNC	<unknown>	DEFAULT	2
skip_nospace	.symtab	0x100173b0	64	FUNC	<unknown>	DEFAULT	2
sleep	.symtab	0x10010ff8	292	FUNC	<unknown>	DEFAULT	2
sleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
snprintf	.symtab	0x1000cc78	124	FUNC	<unknown>	DEFAULT	2
snprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket	.symtab	0x1000ee30	52	FUNC	<unknown>	DEFAULT	2
socket.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket_connect	.symtab	0x10002d9c	328	FUNC	<unknown>	DEFAULT	2
sockprintf	.symtab	0x100014f0	304	FUNC	<unknown>	DEFAULT	2
spec_and_mask.6263	.symtab	0x1001f29e	16	OBJECT	<unknown>	DEFAULT	4
spec_base.6255	.symtab	0x1001f220	7	OBJECT	<unknown>	DEFAULT	4
spec_chars.6260	.symtab	0x1001f2b0	21	OBJECT	<unknown>	DEFAULT	4
spec_flags.6259	.symtab	0x1001f2c8	8	OBJECT	<unknown>	DEFAULT	4
spec_or_mask.6262	.symtab	0x1001f28e	16	OBJECT	<unknown>	DEFAULT	4
spec_ranges.6261	.symtab	0x1001f284	9	OBJECT	<unknown>	DEFAULT	4
sprintf	.symtab	0x1000ccf4	136	FUNC	<unknown>	DEFAULT	2
sprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
srand	.symtab	0x10010050	104	FUNC	<unknown>	DEFAULT	2
srandom	.symtab	0x10010050	104	FUNC	<unknown>	DEFAULT	2
srandom_r	.symtab	0x10010144	244	FUNC	<unknown>	DEFAULT	2
stat	.symtab	0x10017da8	124	FUNC	<unknown>	DEFAULT	2
stat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
static_dtv	.symtab	0x100375d4	512	OBJECT	<unknown>	DEFAULT	14
static_map	.symtab	0x100377d4	52	OBJECT	<unknown>	DEFAULT	14
static_slotinfo	.symtab	0x100372cc	776	OBJECT	<unknown>	DEFAULT	14
stderr	.symtab	0x10030a7c	4	OBJECT	<unknown>	DEFAULT	12
stdhexflood	.symtab	0x10003778	332	FUNC	<unknown>	DEFAULT	2
stdin	.symtab	0x10030a74	4	OBJECT	<unknown>	DEFAULT	12
stdout	.symtab	0x10030a78	4	OBJECT	<unknown>	DEFAULT	12
strcasecmp	.symtab	0x10018370	80	FUNC	<unknown>	DEFAULT	2
strcasecmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchr	.symtab	0x1000e220	256	FUNC	<unknown>	DEFAULT	2
strchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchrnul	.symtab	0x10014b44	248	FUNC	<unknown>	DEFAULT	2
strchrnul.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcmp	.symtab	0x1000e320	52	FUNC	<unknown>	DEFAULT	2
strcmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcoll	.symtab	0x1000e320	52	FUNC	<unknown>	DEFAULT	2
strcpy	.symtab	0x1000e354	32	FUNC	<unknown>	DEFAULT	2
strcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcspn	.symtab	0x10014c3c	96	FUNC	<unknown>	DEFAULT	2
strcspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strdup	.symtab	0x10017ec8	80	FUNC	<unknown>	DEFAULT	2
strdup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strerror_r	.symtab	0x1000e620	284	FUNC	<unknown>	DEFAULT	2
strlen	.symtab	0x1000e374	160	FUNC	<unknown>	DEFAULT	2
strlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncpy	.symtab	0x10016440	188	FUNC	<unknown>	DEFAULT	2
strncpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strnlen	.symtab	0x1000e414	236	FUNC	<unknown>	DEFAULT	2
strnlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strpbrk	.symtab	0x10014df0	60	FUNC	<unknown>	DEFAULT	2
strpbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strrchr	.symtab	0x10014c9c	112	FUNC	<unknown>	DEFAULT	2
strrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strspn	.symtab	0x10014d0c	72	FUNC	<unknown>	DEFAULT	2
strspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strstr	.symtab	0x1000e500	240	FUNC	<unknown>	DEFAULT	2
strstr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok	.symtab	0x1000e758	12	FUNC	<unknown>	DEFAULT	2
strtok.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok_r	.symtab	0x10014d54	156	FUNC	<unknown>	DEFAULT	2
strtok_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtol	.symtab	0x10010410	8	FUNC	<unknown>	DEFAULT	2
strtol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sysconf	.symtab	0x100107a0	624	FUNC	<unknown>	DEFAULT	2
sysconf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
system	.symtab	0x10011fac	132	FUNC	<unknown>	DEFAULT	2
system.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcgetattr	.symtab	0x1000e764	156	FUNC	<unknown>	DEFAULT	2
tcgetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcpcsum	.symtab	0x10001fe8	232	FUNC	<unknown>	DEFAULT	2
tcsetattr	.symtab	0x1000e800	376	FUNC	<unknown>	DEFAULT	2
tcsetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
time	.symtab	0x1000cc1c	16	FUNC	<unknown>	DEFAULT	2
time.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
toupper	.symtab	0x1000cc44	32	FUNC	<unknown>	DEFAULT	2
toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
trim	.symtab	0x10000950	348	FUNC	<unknown>	DEFAULT	2
type_codes	.symtab	0x1001f24c	24	OBJECT	<unknown>	DEFAULT	4
type_sizes	.symtab	0x1001f264	12	OBJECT	<unknown>	DEFAULT	4
uname	.symtab	0x10017e24	52	FUNC	<unknown>	DEFAULT	2
uname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
unknown.1370	.symtab	0x1001f2d0	14	OBJECT	<unknown>	DEFAULT	4
unsafe_state	.symtab	0x100308c0	20	OBJECT	<unknown>	DEFAULT	10
useragents	.symtab	0x10030784	236	OBJECT	<unknown>	DEFAULT	10
usleep	.symtab	0x10010a10	76	FUNC	<unknown>	DEFAULT	2
usleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
vseattack	.symtab	0x10002fec	1612	FUNC	<unknown>	DEFAULT	2
vsnprintf	.symtab	0x1000cd7c	224	FUNC	<unknown>	DEFAULT	2
vsnprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
waitpid	.symtab	0x10011394	132	FUNC	<unknown>	DEFAULT	2
wcrtomb	.symtab	0x10012a8c	92	FUNC	<unknown>	DEFAULT	2
wcrtomb.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsnrtombs	.symtab	0x10012af8	188	FUNC	<unknown>	DEFAULT	2
wcsnrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsrtombs	.symtab	0x10012ae8	16	FUNC	<unknown>	DEFAULT	2
wcsrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
write	.symtab	0x1001128c	132	FUNC	<unknown>	DEFAULT	2
xdigits.5264	.symtab	0x1002037c	17	OBJECT	<unknown>	DEFAULT	4
xstatconv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
xtdcustom	.symtab	0x1000710c	332	FUNC	<unknown>	DEFAULT	2

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-08T21:03:01.597578+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33108	162.215.219.170	4444	TCP
2024-10-08T21:03:03.168331+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33110	162.215.219.170	4444	TCP
2024-10-08T21:03:04.766745+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33112	162.215.219.170	4444	TCP
2024-10-08T21:03:06.354764+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33114	162.215.219.170	4444	TCP
2024-10-08T21:03:07.963918+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33116	162.215.219.170	4444	TCP
2024-10-08T21:03:09.591684+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33118	162.215.219.170	4444	TCP
2024-10-08T21:03:12.170745+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33120	162.215.219.170	4444	TCP
2024-10-08T21:03:13.727740+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33122	162.215.219.170	4444	TCP
2024-10-08T21:03:15.291944+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33124	162.215.219.170	4444	TCP
2024-10-08T21:03:16.875064+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33126	162.215.219.170	4444	TCP
2024-10-08T21:03:18.431515+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33128	162.215.219.170	4444	TCP
2024-10-08T21:03:20.030859+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33130	162.215.219.170	4444	TCP
2024-10-08T21:03:21.588677+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33132	162.215.219.170	4444	TCP
2024-10-08T21:03:23.150315+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33134	162.215.219.170	4444	TCP
2024-10-08T21:03:24.714016+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33136	162.215.219.170	4444	TCP
2024-10-08T21:03:26.292807+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33138	162.215.219.170	4444	TCP
2024-10-08T21:03:27.866798+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33140	162.215.219.170	4444	TCP
2024-10-08T21:03:29.469052+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33142	162.215.219.170	4444	TCP
2024-10-08T21:03:31.058879+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33144	162.215.219.170	4444	TCP
2024-10-08T21:03:32.649595+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33146	162.215.219.170	4444	TCP
2024-10-08T21:03:34.229795+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33148	162.215.219.170	4444	TCP
2024-10-08T21:03:35.993744+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33150	162.215.219.170	4444	TCP
2024-10-08T21:03:37.572352+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33152	162.215.219.170	4444	TCP
2024-10-08T21:03:39.134855+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33154	162.215.219.170	4444	TCP
2024-10-08T21:03:40.717505+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33156	162.215.219.170	4444	TCP
2024-10-08T21:03:40.929169+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33156	162.215.219.170	4444	TCP
2024-10-08T21:03:42.592003+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33158	162.215.219.170	4444	TCP
2024-10-08T21:03:44.191348+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33160	162.215.219.170	4444	TCP
2024-10-08T21:03:45.748309+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33162	162.215.219.170	4444	TCP
2024-10-08T21:03:47.306981+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33164	162.215.219.170	4444	TCP
2024-10-08T21:03:48.978311+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33166	162.215.219.170	4444	TCP
2024-10-08T21:03:50.544761+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33168	162.215.219.170	4444	TCP
2024-10-08T21:03:52.105067+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33170	162.215.219.170	4444	TCP
2024-10-08T21:03:53.683039+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33172	162.215.219.170	4444	TCP
2024-10-08T21:03:55.248992+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33174	162.215.219.170	4444	TCP
2024-10-08T21:03:56.829499+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33176	162.215.219.170	4444	TCP
2024-10-08T21:03:58.401882+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33178	162.215.219.170	4444	TCP
2024-10-08T21:03:59.980476+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33180	162.215.219.170	4444	TCP
2024-10-08T21:04:01.561336+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33182	162.215.219.170	4444	TCP
2024-10-08T21:04:03.138085+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33184	162.215.219.170	4444	TCP
2024-10-08T21:04:05.031818+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33186	162.215.219.170	4444	TCP
2024-10-08T21:04:06.891888+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33188	162.215.219.170	4444	TCP
2024-10-08T21:04:08.464026+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33190	162.215.219.170	4444	TCP
2024-10-08T21:04:10.041507+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33192	162.215.219.170	4444	TCP
2024-10-08T21:04:11.654508+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33194	162.215.219.170	4444	TCP
2024-10-08T21:04:13.218884+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33196	162.215.219.170	4444	TCP
2024-10-08T21:04:14.778657+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33198	162.215.219.170	4444	TCP
2024-10-08T21:04:16.337760+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33200	162.215.219.170	4444	TCP
2024-10-08T21:04:17.903447+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33202	162.215.219.170	4444	TCP
2024-10-08T21:04:19.487037+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33204	162.215.219.170	4444	TCP
2024-10-08T21:04:21.063189+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33206	162.215.219.170	4444	TCP
2024-10-08T21:04:22.699778+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33208	162.215.219.170	4444	TCP
2024-10-08T21:04:24.448586+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33210	162.215.219.170	4444	TCP
2024-10-08T21:04:26.049256+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33212	162.215.219.170	4444	TCP
2024-10-08T21:04:27.659644+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33214	162.215.219.170	4444	TCP
2024-10-08T21:04:29.217476+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33216	162.215.219.170	4444	TCP
2024-10-08T21:04:30.793468+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33218	162.215.219.170	4444	TCP
2024-10-08T21:04:32.354778+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33220	162.215.219.170	4444	TCP
2024-10-08T21:04:33.921583+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33222	162.215.219.170	4444	TCP
2024-10-08T21:04:35.496681+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33224	162.215.219.170	4444	TCP
2024-10-08T21:04:37.112484+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33226	162.215.219.170	4444	TCP
2024-10-08T21:04:38.686465+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33228	162.215.219.170	4444	TCP
2024-10-08T21:04:40.498642+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33230	162.215.219.170	4444	TCP
2024-10-08T21:04:42.058352+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33232	162.215.219.170	4444	TCP
2024-10-08T21:04:43.624617+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33234	162.215.219.170	4444	TCP
2024-10-08T21:04:45.607355+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33236	162.215.219.170	4444	TCP
2024-10-08T21:04:47.168281+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33238	162.215.219.170	4444	TCP
2024-10-08T21:04:48.783842+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33240	162.215.219.170	4444	TCP
2024-10-08T21:04:50.392555+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33242	162.215.219.170	4444	TCP
2024-10-08T21:04:51.984788+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33244	162.215.219.170	4444	TCP
2024-10-08T21:04:53.560379+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33246	162.215.219.170	4444	TCP
2024-10-08T21:04:55.123830+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33248	162.215.219.170	4444	TCP
2024-10-08T21:04:56.874559+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33250	162.215.219.170	4444	TCP
2024-10-08T21:04:58.441449+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33252	162.215.219.170	4444	TCP
2024-10-08T21:05:00.022299+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33254	162.215.219.170	4444	TCP
2024-10-08T21:05:01.589487+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33256	162.215.219.170	4444	TCP
2024-10-08T21:05:03.170396+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33258	162.215.219.170	4444	TCP
2024-10-08T21:05:04.730219+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33260	162.215.219.170	4444	TCP
2024-10-08T21:05:06.299647+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33262	162.215.219.170	4444	TCP
2024-10-08T21:05:07.856373+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33264	162.215.219.170	4444	TCP
2024-10-08T21:05:10.172371+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33266	162.215.219.170	4444	TCP
2024-10-08T21:05:11.765678+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33268	162.215.219.170	4444	TCP
2024-10-08T21:05:13.322873+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33270	162.215.219.170	4444	TCP
2024-10-08T21:05:14.873235+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33272	162.215.219.170	4444	TCP
2024-10-08T21:05:16.436279+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33274	162.215.219.170	4444	TCP
2024-10-08T21:05:18.011582+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33276	162.215.219.170	4444	TCP
2024-10-08T21:05:19.578602+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33278	162.215.219.170	4444	TCP
2024-10-08T21:05:21.136436+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33280	162.215.219.170	4444	TCP
2024-10-08T21:05:22.701587+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33282	162.215.219.170	4444	TCP
2024-10-08T21:05:24.263809+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33284	162.215.219.170	4444	TCP
2024-10-08T21:05:25.885706+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33286	162.215.219.170	4444	TCP
2024-10-08T21:05:27.474111+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33288	162.215.219.170	4444	TCP
2024-10-08T21:05:29.029223+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33290	162.215.219.170	4444	TCP
2024-10-08T21:05:30.592694+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33292	162.215.219.170	4444	TCP
2024-10-08T21:05:32.169545+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33294	162.215.219.170	4444	TCP
2024-10-08T21:05:33.729649+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33296	162.215.219.170	4444	TCP
2024-10-08T21:05:35.295094+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33298	162.215.219.170	4444	TCP
2024-10-08T21:05:36.929162+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33300	162.215.219.170	4444	TCP
2024-10-08T21:05:38.515456+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33302	162.215.219.170	4444	TCP
2024-10-08T21:05:40.079328+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33304	162.215.219.170	4444	TCP
2024-10-08T21:05:41.660840+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33306	162.215.219.170	4444	TCP
2024-10-08T21:05:43.218210+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33308	162.215.219.170	4444	TCP
2024-10-08T21:05:44.902272+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33310	162.215.219.170	4444	TCP
2024-10-08T21:05:46.488669+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33312	162.215.219.170	4444	TCP
2024-10-08T21:05:48.058240+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33314	162.215.219.170	4444	TCP
2024-10-08T21:05:49.694186+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33316	162.215.219.170	4444	TCP
2024-10-08T21:05:51.281544+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33318	162.215.219.170	4444	TCP
2024-10-08T21:05:52.873181+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33320	162.215.219.170	4444	TCP
2024-10-08T21:05:54.434821+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33322	162.215.219.170	4444	TCP
2024-10-08T21:05:55.999654+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33324	162.215.219.170	4444	TCP
2024-10-08T21:05:57.576857+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33326	162.215.219.170	4444	TCP
2024-10-08T21:05:59.313869+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33328	162.215.219.170	4444	TCP
2024-10-08T21:06:00.983885+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33330	162.215.219.170	4444	TCP
2024-10-08T21:06:02.590314+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33332	162.215.219.170	4444	TCP
2024-10-08T21:06:04.153735+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33334	162.215.219.170	4444	TCP
2024-10-08T21:06:05.717600+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33336	162.215.219.170	4444	TCP
2024-10-08T21:06:07.293552+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33338	162.215.219.170	4444	TCP
2024-10-08T21:06:08.858359+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33340	162.215.219.170	4444	TCP
2024-10-08T21:06:10.418473+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33342	162.215.219.170	4444	TCP
2024-10-08T21:06:11.985395+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33344	162.215.219.170	4444	TCP
2024-10-08T21:06:13.550257+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33346	162.215.219.170	4444	TCP
2024-10-08T21:06:15.137303+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33348	162.215.219.170	4444	TCP
2024-10-08T21:06:16.699917+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33350	162.215.219.170	4444	TCP
2024-10-08T21:06:18.264528+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33352	162.215.219.170	4444	TCP
2024-10-08T21:06:20.114088+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33354	162.215.219.170	4444	TCP
2024-10-08T21:06:21.722903+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33356	162.215.219.170	4444	TCP
2024-10-08T21:06:23.328002+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33358	162.215.219.170	4444	TCP
2024-10-08T21:06:24.887835+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33360	162.215.219.170	4444	TCP
2024-10-08T21:06:26.471719+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33362	162.215.219.170	4444	TCP
2024-10-08T21:06:28.065550+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33364	162.215.219.170	4444	TCP
2024-10-08T21:06:29.673321+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33366	162.215.219.170	4444	TCP
2024-10-08T21:06:31.250103+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33368	162.215.219.170	4444	TCP
2024-10-08T21:06:32.823892+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33370	162.215.219.170	4444	TCP
2024-10-08T21:06:34.409400+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33372	162.215.219.170	4444	TCP
2024-10-08T21:06:35.985705+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.15	33374	162.215.219.170	4444	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 21:03:01.590902090 CEST	33108	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:01.596277952 CEST	4444	33108	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:01.596354961 CEST	33108	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:01.597578049 CEST	33108	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:01.602479935 CEST	4444	33108	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:03.160052061 CEST	4444	33108	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:03.160716057 CEST	33108	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:03.162920952 CEST	33110	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:03.165765047 CEST	4444	33108	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:03.167905092 CEST	4444	33110	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:03.168031931 CEST	33110	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:03.168330908 CEST	33110	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:03.173346043 CEST	4444	33110	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:04.760631084 CEST	4444	33110	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:04.760914087 CEST	33110	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:04.761418104 CEST	33112	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:04.765881062 CEST	4444	33110	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:04.766477108 CEST	4444	33112	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:04.766624928 CEST	33112	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:04.766745090 CEST	33112	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:04.771965027 CEST	4444	33112	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:06.347655058 CEST	4444	33112	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:06.347930908 CEST	33112	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:06.348773003 CEST	33114	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:06.352998972 CEST	4444	33112	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:06.354654074 CEST	4444	33114	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:06.354712963 CEST	33114	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:06.354763985 CEST	33114	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:06.360626936 CEST	4444	33114	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:07.957102060 CEST	4444	33114	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:07.957231045 CEST	33114	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:07.958792925 CEST	33116	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:07.962297916 CEST	4444	33114	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:07.963815928 CEST	4444	33116	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:07.963876009 CEST	33116	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:07.963917971 CEST	33116	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:07.968868971 CEST	4444	33116	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:09.585566998 CEST	4444	33116	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:09.585820913 CEST	33116	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:09.586560965 CEST	33118	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:09.590863943 CEST	4444	33116	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:09.591576099 CEST	4444	33118	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:09.591646910 CEST	33118	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:09.591684103 CEST	33118	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:09.596923113 CEST	4444	33118	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:12.163589954 CEST	4444	33118	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:12.163913012 CEST	33118	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:12.163994074 CEST	4444	33118	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:12.164073944 CEST	33118	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:12.165019035 CEST	33120	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:12.165183067 CEST	4444	33118	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:12.165220022 CEST	33118	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:12.165595055 CEST	4444	33118	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:12.165641069 CEST	33118	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:12.169190884 CEST	4444	33118	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:12.170555115 CEST	4444	33120	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:12.170618057 CEST	33120	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:12.170744896 CEST	33120	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:12.175806999 CEST	4444	33120	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:13.721295118 CEST	4444	33120	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:13.721584082 CEST	33120	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:13.722626925 CEST	33122	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:13.726958036 CEST	4444	33120	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:13.727524996 CEST	4444	33122	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:13.727740049 CEST	33122	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:13.727740049 CEST	33122	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:13.733109951 CEST	4444	33122	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:15.285353899 CEST	4444	33122	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:15.285686016 CEST	33122	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:15.286324024 CEST	33124	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:15.290844917 CEST	4444	33122	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:15.291821003 CEST	4444	33124	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:15.291889906 CEST	33124	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:15.291944027 CEST	33124	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:15.296935081 CEST	4444	33124	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:16.868076086 CEST	4444	33124	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:16.868262053 CEST	33124	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:16.869390011 CEST	33126	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:16.873364925 CEST	4444	33124	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:16.874887943 CEST	4444	33126	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:16.875062943 CEST	33126	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:16.875063896 CEST	33126	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:16.880261898 CEST	4444	33126	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:18.424784899 CEST	4444	33126	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:18.425172091 CEST	33126	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:18.426067114 CEST	33128	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:18.430217981 CEST	4444	33126	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:18.431358099 CEST	4444	33128	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:18.431449890 CEST	33128	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:18.431514978 CEST	33128	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:18.436625957 CEST	4444	33128	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:20.023957968 CEST	4444	33128	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:20.024262905 CEST	33128	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:20.025298119 CEST	33130	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:20.029258013 CEST	4444	33128	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:20.030670881 CEST	4444	33130	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:20.030756950 CEST	33130	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:20.030858994 CEST	33130	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:20.035885096 CEST	4444	33130	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:21.581784010 CEST	4444	33130	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:21.582195997 CEST	33130	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:21.583513975 CEST	33132	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:21.587100983 CEST	4444	33130	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:21.588469982 CEST	4444	33132	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:21.588563919 CEST	33132	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:21.588676929 CEST	33132	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:21.594026089 CEST	4444	33132	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:23.143990040 CEST	4444	33132	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:23.144354105 CEST	33132	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:23.145167112 CEST	33134	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:23.149564028 CEST	4444	33132	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:23.150160074 CEST	4444	33134	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:23.150239944 CEST	33134	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:23.150315046 CEST	33134	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:23.155502081 CEST	4444	33134	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:24.706836939 CEST	4444	33134	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:24.707565069 CEST	33134	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:24.708468914 CEST	33136	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:24.713020086 CEST	4444	33134	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:24.713721991 CEST	4444	33136	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:24.713932037 CEST	33136	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:24.714015961 CEST	33136	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:24.719218969 CEST	4444	33136	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:26.285986900 CEST	49566	443	192.168.2.15	54.217.10.153
Oct 8, 2024 21:03:26.286349058 CEST	4444	33136	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:26.286612034 CEST	33136	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:26.287723064 CEST	33138	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:26.291706085 CEST	443	49566	54.217.10.153	192.168.2.15
Oct 8, 2024 21:03:26.291735888 CEST	4444	33136	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:26.291764021 CEST	49566	443	192.168.2.15	54.217.10.153
Oct 8, 2024 21:03:26.292663097 CEST	4444	33138	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:26.292732000 CEST	33138	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:26.292807102 CEST	33138	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:26.297811031 CEST	4444	33138	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:27.860165119 CEST	4444	33138	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:27.860435009 CEST	33138	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:27.861382008 CEST	33140	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:27.866379023 CEST	4444	33138	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:27.866669893 CEST	4444	33140	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:27.866739988 CEST	33140	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:27.866797924 CEST	33140	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:27.872023106 CEST	4444	33140	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:29.461226940 CEST	4444	33140	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:29.462029934 CEST	33140	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:29.463424921 CEST	33142	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:29.467462063 CEST	4444	33140	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:29.468637943 CEST	4444	33142	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:29.468878984 CEST	33142	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:29.469052076 CEST	33142	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:29.474195957 CEST	4444	33142	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:31.052165031 CEST	4444	33142	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:31.052467108 CEST	33142	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:31.053457022 CEST	33144	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:31.057744980 CEST	4444	33142	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:31.058686018 CEST	4444	33144	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:31.058795929 CEST	33144	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:31.058878899 CEST	33144	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:31.064989090 CEST	4444	33144	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:32.642770052 CEST	4444	33144	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:32.643261909 CEST	33144	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:32.644304037 CEST	33146	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:32.648224115 CEST	4444	33144	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:32.649405003 CEST	4444	33146	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:32.649496078 CEST	33146	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:32.649595022 CEST	33146	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:32.654473066 CEST	4444	33146	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:34.222743034 CEST	4444	33146	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:34.223315954 CEST	33146	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:34.224431038 CEST	33148	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:34.228455067 CEST	4444	33146	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:34.229604006 CEST	4444	33148	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:34.229698896 CEST	33148	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:34.229794979 CEST	33148	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:34.234771967 CEST	4444	33148	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:35.987512112 CEST	4444	33148	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:35.987859011 CEST	33148	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:35.988688946 CEST	33150	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:35.992835045 CEST	4444	33148	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:35.993578911 CEST	4444	33150	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:35.993648052 CEST	33150	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:35.993743896 CEST	33150	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:35.999116898 CEST	4444	33150	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:37.565931082 CEST	4444	33150	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:37.566257000 CEST	33150	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:37.567219019 CEST	33152	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:37.571151018 CEST	4444	33150	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:37.572215080 CEST	4444	33152	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:37.572305918 CEST	33152	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:37.572351933 CEST	33152	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:37.577223063 CEST	4444	33152	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:39.127852917 CEST	4444	33152	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:39.128398895 CEST	33152	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:39.129731894 CEST	33154	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:39.133505106 CEST	4444	33152	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:39.134707928 CEST	4444	33154	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:39.134805918 CEST	33154	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:39.134855032 CEST	33154	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:39.139693022 CEST	4444	33154	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:40.710752010 CEST	4444	33154	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:40.711224079 CEST	33154	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:40.712095022 CEST	33156	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:40.716281891 CEST	4444	33154	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:40.717314959 CEST	4444	33156	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:40.717403889 CEST	33156	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:40.717504978 CEST	33156	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:40.929168940 CEST	33156	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:40.990294933 CEST	4444	33156	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:40.990322113 CEST	4444	33156	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:42.585563898 CEST	4444	33156	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:42.585763931 CEST	33156	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:42.586822033 CEST	33158	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:42.590938091 CEST	4444	33156	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:42.591877937 CEST	4444	33158	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:42.591948986 CEST	33158	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:42.592003107 CEST	33158	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:42.596935034 CEST	4444	33158	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:44.183250904 CEST	4444	33158	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:44.183593988 CEST	33158	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:44.184562922 CEST	33160	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:44.189430952 CEST	4444	33158	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:44.191035986 CEST	4444	33160	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:44.191272974 CEST	33160	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:44.191348076 CEST	33160	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:44.197302103 CEST	4444	33160	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:45.738114119 CEST	4444	33160	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:45.738596916 CEST	33160	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:45.739708900 CEST	33162	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:45.748049021 CEST	4444	33160	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:45.748084068 CEST	4444	33162	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:45.748194933 CEST	33162	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:45.748308897 CEST	33162	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:45.753639936 CEST	4444	33162	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:47.300832033 CEST	4444	33162	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:47.301057100 CEST	33162	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:47.302001953 CEST	33164	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:47.305923939 CEST	4444	33162	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:47.306859016 CEST	4444	33164	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:47.306937933 CEST	33164	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:47.306981087 CEST	33164	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:47.312566996 CEST	4444	33164	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:48.970956087 CEST	4444	33164	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:48.971286058 CEST	33164	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:48.972656965 CEST	33166	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:48.976495028 CEST	4444	33164	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:48.978141069 CEST	4444	33166	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:48.978216887 CEST	33166	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:48.978311062 CEST	33166	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:48.983470917 CEST	4444	33166	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:50.538106918 CEST	4444	33166	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:50.538701057 CEST	33166	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:50.539654970 CEST	33168	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:50.543597937 CEST	4444	33166	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:50.544548988 CEST	4444	33168	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:50.544646978 CEST	33168	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:50.544760942 CEST	33168	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:50.549691916 CEST	4444	33168	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:52.097773075 CEST	4444	33168	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:52.098208904 CEST	33168	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:52.098983049 CEST	33170	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:52.103173018 CEST	4444	33168	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:52.104901075 CEST	4444	33170	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:52.104967117 CEST	33170	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:52.105067015 CEST	33170	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:52.110063076 CEST	4444	33170	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:53.675755978 CEST	4444	33170	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:53.676177025 CEST	33170	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:53.676955938 CEST	33172	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:53.681066036 CEST	4444	33170	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:53.682357073 CEST	4444	33172	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:53.682461023 CEST	33172	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:53.683038950 CEST	33172	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:53.688535929 CEST	4444	33172	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:55.242225885 CEST	4444	33172	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:55.242626905 CEST	33172	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:55.243887901 CEST	33174	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:55.247792959 CEST	4444	33172	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:55.248814106 CEST	4444	33174	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:55.248891115 CEST	33174	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:55.248991966 CEST	33174	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:55.254398108 CEST	4444	33174	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:56.821822882 CEST	4444	33174	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:56.822300911 CEST	33174	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:56.824335098 CEST	33176	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:56.827464104 CEST	4444	33174	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:56.829282045 CEST	4444	33176	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:56.829499006 CEST	33176	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:56.829499006 CEST	33176	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:56.834678888 CEST	4444	33176	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:58.394268036 CEST	4444	33176	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:58.395062923 CEST	33176	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:58.396354914 CEST	33178	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:58.400399923 CEST	4444	33176	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:58.401673079 CEST	4444	33178	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:58.401770115 CEST	33178	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:58.401881933 CEST	33178	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:58.407243967 CEST	4444	33178	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:59.974250078 CEST	4444	33178	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:59.974477053 CEST	33178	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:59.975281000 CEST	33180	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:59.979427099 CEST	4444	33178	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:59.980328083 CEST	4444	33180	162.215.219.170	192.168.2.15
Oct 8, 2024 21:03:59.980407953 CEST	33180	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:59.980475903 CEST	33180	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:03:59.985326052 CEST	4444	33180	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:01.554862022 CEST	4444	33180	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:01.555037975 CEST	33180	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:01.555912018 CEST	33182	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:01.560237885 CEST	4444	33180	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:01.561244011 CEST	4444	33182	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:01.561291933 CEST	33182	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:01.561336040 CEST	33182	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:01.567337036 CEST	4444	33182	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:03.130820990 CEST	4444	33182	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:03.131198883 CEST	33182	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:03.132113934 CEST	33184	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:03.136996031 CEST	4444	33182	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:03.137993097 CEST	4444	33184	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:03.138041019 CEST	33184	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:03.138084888 CEST	33184	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:03.143043041 CEST	4444	33184	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:05.023907900 CEST	4444	33184	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:05.024384975 CEST	33184	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:05.024725914 CEST	4444	33184	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:05.024890900 CEST	33184	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:05.025919914 CEST	33186	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:05.030071020 CEST	4444	33184	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:05.031708002 CEST	4444	33186	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:05.031769991 CEST	33186	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:05.031817913 CEST	33186	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:05.036998034 CEST	4444	33186	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:06.598252058 CEST	4444	33186	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:06.598637104 CEST	33186	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:06.599999905 CEST	33188	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:06.808393002 CEST	33186	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:06.890402079 CEST	4444	33186	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:06.890476942 CEST	33186	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:06.891530991 CEST	4444	33186	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:06.891686916 CEST	4444	33188	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:06.891710043 CEST	4444	33186	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:06.891777992 CEST	33188	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:06.891804934 CEST	33186	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:06.891887903 CEST	33188	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:06.897351027 CEST	4444	33188	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:08.457201004 CEST	4444	33188	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:08.457575083 CEST	33188	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:08.458726883 CEST	33190	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:08.462728977 CEST	4444	33188	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:08.463846922 CEST	4444	33190	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:08.463921070 CEST	33190	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:08.464025974 CEST	33190	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:08.469106913 CEST	4444	33190	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:10.034603119 CEST	4444	33190	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:10.034900904 CEST	33190	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:10.036115885 CEST	33192	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:10.040371895 CEST	4444	33190	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:10.041268110 CEST	4444	33192	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:10.041368008 CEST	33192	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:10.041507006 CEST	33192	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:10.046889067 CEST	4444	33192	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:11.647819042 CEST	4444	33192	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:11.648067951 CEST	33192	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:11.649266005 CEST	33194	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:11.653273106 CEST	4444	33192	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:11.654335022 CEST	4444	33194	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:11.654418945 CEST	33194	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:11.654508114 CEST	33194	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:11.659910917 CEST	4444	33194	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:13.209916115 CEST	4444	33194	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:13.210289001 CEST	33194	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:13.211147070 CEST	33196	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:13.217386961 CEST	4444	33194	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:13.218703032 CEST	4444	33196	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:13.218803883 CEST	33196	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:13.218883991 CEST	33196	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:13.225820065 CEST	4444	33196	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:14.771433115 CEST	4444	33196	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:14.771648884 CEST	33196	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:14.772519112 CEST	33198	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:14.777599096 CEST	4444	33196	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:14.778513908 CEST	4444	33198	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:14.778584003 CEST	33198	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:14.778656960 CEST	33198	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:14.784506083 CEST	4444	33198	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:16.331657887 CEST	4444	33198	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:16.331984997 CEST	33198	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:16.332633972 CEST	33200	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:16.336848974 CEST	4444	33198	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:16.337615967 CEST	4444	33200	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:16.337697983 CEST	33200	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:16.337759972 CEST	33200	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:16.342859983 CEST	4444	33200	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:17.895512104 CEST	4444	33200	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:17.895917892 CEST	33200	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:17.897226095 CEST	33202	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:17.901664972 CEST	4444	33200	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:17.902786970 CEST	4444	33202	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:17.903137922 CEST	33202	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:17.903446913 CEST	33202	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:17.909111977 CEST	4444	33202	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:19.478928089 CEST	4444	33202	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:19.479439974 CEST	33202	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:19.480523109 CEST	33204	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:19.485707045 CEST	4444	33202	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:19.486855030 CEST	4444	33204	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:19.486936092 CEST	33204	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:19.487036943 CEST	33204	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:19.492682934 CEST	4444	33204	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:21.057066917 CEST	4444	33204	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:21.057323933 CEST	33204	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:21.058072090 CEST	33206	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:21.062450886 CEST	4444	33204	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:21.062993050 CEST	4444	33206	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:21.063080072 CEST	33206	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:21.063189030 CEST	33206	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:21.069169998 CEST	4444	33206	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:22.689456940 CEST	4444	33206	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:22.689802885 CEST	33206	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:22.691203117 CEST	33208	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:22.694910049 CEST	4444	33206	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:22.699480057 CEST	4444	33208	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:22.699629068 CEST	33208	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:22.699778080 CEST	33208	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:22.705291033 CEST	4444	33208	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:24.437325001 CEST	4444	33208	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:24.437491894 CEST	33208	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:24.438543081 CEST	33210	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:24.443490982 CEST	4444	33208	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:24.448474884 CEST	4444	33210	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:24.448534966 CEST	33210	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:24.448585987 CEST	33210	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:24.453521013 CEST	4444	33210	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:26.041040897 CEST	4444	33210	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:26.041563034 CEST	33210	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:26.042960882 CEST	33212	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:26.047379971 CEST	4444	33210	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:26.049050093 CEST	4444	33212	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:26.049155951 CEST	33212	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:26.049256086 CEST	33212	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:26.059113979 CEST	4444	33212	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:27.652513981 CEST	4444	33212	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:27.652879000 CEST	33212	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:27.654216051 CEST	33214	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:27.659308910 CEST	4444	33212	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:27.659502029 CEST	4444	33214	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:27.659600973 CEST	33214	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:27.659643888 CEST	33214	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:27.665775061 CEST	4444	33214	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:29.210422993 CEST	4444	33214	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:29.210640907 CEST	33214	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:29.212130070 CEST	33216	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:29.215811014 CEST	4444	33214	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:29.217344046 CEST	4444	33216	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:29.217453003 CEST	33216	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:29.217475891 CEST	33216	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:29.223148108 CEST	4444	33216	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:30.787610054 CEST	4444	33216	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:30.787868023 CEST	33216	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:30.788455009 CEST	33218	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:30.792929888 CEST	4444	33216	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:30.793363094 CEST	4444	33218	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:30.793412924 CEST	33218	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:30.793467999 CEST	33218	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:30.798599005 CEST	4444	33218	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:32.348560095 CEST	4444	33218	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:32.348722935 CEST	33218	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:32.349520922 CEST	33220	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:32.353647947 CEST	4444	33218	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:32.354640961 CEST	4444	33220	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:32.354731083 CEST	33220	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:32.354778051 CEST	33220	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:32.361195087 CEST	4444	33220	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:33.911039114 CEST	4444	33220	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:33.911533117 CEST	33220	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:33.912498951 CEST	33222	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:33.920236111 CEST	4444	33220	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:33.921412945 CEST	4444	33222	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:33.921504974 CEST	33222	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:33.921582937 CEST	33222	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:33.935544014 CEST	4444	33222	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:35.489681005 CEST	4444	33222	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:35.489849091 CEST	33222	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:35.490494967 CEST	33224	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:35.495076895 CEST	4444	33222	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:35.496568918 CEST	4444	33224	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:35.496642113 CEST	33224	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:35.496680975 CEST	33224	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:35.502340078 CEST	4444	33224	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:37.105123043 CEST	4444	33224	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:37.105459929 CEST	33224	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:37.106370926 CEST	33226	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:37.111512899 CEST	4444	33224	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:37.112303972 CEST	4444	33226	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:37.112390995 CEST	33226	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:37.112483978 CEST	33226	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:37.117811918 CEST	4444	33226	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:38.680288076 CEST	4444	33226	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:38.680702925 CEST	33226	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:38.681377888 CEST	33228	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:38.685762882 CEST	4444	33226	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:38.686288118 CEST	4444	33228	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:38.686356068 CEST	33228	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:38.686465025 CEST	33228	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:38.691438913 CEST	4444	33228	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:40.491115093 CEST	4444	33228	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:40.491326094 CEST	33228	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:40.492115974 CEST	4444	33228	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:40.492158890 CEST	33228	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:40.492439032 CEST	33230	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:40.497309923 CEST	4444	33228	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:40.498492002 CEST	4444	33230	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:40.498552084 CEST	33230	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:40.498641968 CEST	33230	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:40.503647089 CEST	4444	33230	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:42.051606894 CEST	4444	33230	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:42.051918030 CEST	33230	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:42.052759886 CEST	33232	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:42.056785107 CEST	4444	33230	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:42.058216095 CEST	4444	33232	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:42.058296919 CEST	33232	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:42.058351994 CEST	33232	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:42.063328028 CEST	4444	33232	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:43.617836952 CEST	4444	33232	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:43.618139029 CEST	33232	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:43.618895054 CEST	33234	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:43.624034882 CEST	4444	33232	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:43.624439001 CEST	4444	33234	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:43.624516010 CEST	33234	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:43.624617100 CEST	33234	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:43.629612923 CEST	4444	33234	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:45.597744942 CEST	4444	33234	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:45.597815037 CEST	4444	33234	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:45.597938061 CEST	33234	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:45.598124981 CEST	33234	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:45.598979950 CEST	33236	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:45.606961012 CEST	4444	33234	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:45.607213020 CEST	4444	33236	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:45.607287884 CEST	33236	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:45.607355118 CEST	33236	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:45.612456083 CEST	4444	33236	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:47.162415028 CEST	4444	33236	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:47.162592888 CEST	33236	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:47.163336039 CEST	33238	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:47.167511940 CEST	4444	33236	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:47.168111086 CEST	4444	33238	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:47.168168068 CEST	33238	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:47.168281078 CEST	33238	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:47.173305035 CEST	4444	33238	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:48.777738094 CEST	4444	33238	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:48.778132915 CEST	33238	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:48.778853893 CEST	33240	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:48.782982111 CEST	4444	33238	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:48.783636093 CEST	4444	33240	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:48.783720970 CEST	33240	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:48.783842087 CEST	33240	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:48.788695097 CEST	4444	33240	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:50.386338949 CEST	4444	33240	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:50.386698008 CEST	33240	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:50.387412071 CEST	33242	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:50.391796112 CEST	4444	33240	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:50.392390966 CEST	4444	33242	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:50.392458916 CEST	33242	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:50.392554998 CEST	33242	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:50.397353888 CEST	4444	33242	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:51.978435040 CEST	4444	33242	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:51.978698969 CEST	33242	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:51.979715109 CEST	33244	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:51.983730078 CEST	4444	33242	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:51.984637976 CEST	4444	33244	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:51.984711885 CEST	33244	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:51.984787941 CEST	33244	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:51.990456104 CEST	4444	33244	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:53.553258896 CEST	4444	33244	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:53.553813934 CEST	33244	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:53.554717064 CEST	33246	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:53.560101986 CEST	4444	33244	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:53.560209036 CEST	4444	33246	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:53.560286045 CEST	33246	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:53.560379028 CEST	33246	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:53.565485001 CEST	4444	33246	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:55.116504908 CEST	4444	33246	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:55.116724014 CEST	33246	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:55.117789030 CEST	33248	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:55.122509956 CEST	4444	33246	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:55.123692989 CEST	4444	33248	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:55.123790026 CEST	33248	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:55.123830080 CEST	33248	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:55.130347967 CEST	4444	33248	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:56.868413925 CEST	4444	33248	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:56.868653059 CEST	33248	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:56.869607925 CEST	33250	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:56.873634100 CEST	4444	33248	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:56.874440908 CEST	4444	33250	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:56.874526024 CEST	33250	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:56.874558926 CEST	33250	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:56.879427910 CEST	4444	33250	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:58.434612989 CEST	4444	33250	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:58.435147047 CEST	33250	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:58.435987949 CEST	33252	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:58.440627098 CEST	4444	33250	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:58.441253901 CEST	4444	33252	162.215.219.170	192.168.2.15
Oct 8, 2024 21:04:58.441349983 CEST	33252	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:58.441448927 CEST	33252	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:04:58.446615934 CEST	4444	33252	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:00.011401892 CEST	4444	33252	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:00.011792898 CEST	33252	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:00.012697935 CEST	33254	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:00.021449089 CEST	4444	33252	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:00.022182941 CEST	4444	33254	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:00.022232056 CEST	33254	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:00.022299051 CEST	33254	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:00.030247927 CEST	4444	33254	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:01.583405018 CEST	4444	33254	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:01.583664894 CEST	33254	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:01.584398031 CEST	33256	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:01.589171886 CEST	4444	33254	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:01.589323997 CEST	4444	33256	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:01.589379072 CEST	33256	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:01.589487076 CEST	33256	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:01.601350069 CEST	4444	33256	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:03.163068056 CEST	4444	33256	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:03.163566113 CEST	33256	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:03.164351940 CEST	33258	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:03.168658972 CEST	4444	33256	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:03.170279980 CEST	4444	33258	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:03.170365095 CEST	33258	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:03.170396090 CEST	33258	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:03.175954103 CEST	4444	33258	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:04.724033117 CEST	4444	33258	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:04.724421978 CEST	33258	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:04.725115061 CEST	33260	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:04.729589939 CEST	4444	33258	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:04.730097055 CEST	4444	33260	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:04.730166912 CEST	33260	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:04.730218887 CEST	33260	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:04.735248089 CEST	4444	33260	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:06.292802095 CEST	4444	33260	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:06.293059111 CEST	33260	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:06.294050932 CEST	33262	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:06.298418999 CEST	4444	33260	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:06.299410105 CEST	4444	33262	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:06.299501896 CEST	33262	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:06.299647093 CEST	33262	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:06.304750919 CEST	4444	33262	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:07.849950075 CEST	4444	33262	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:07.850272894 CEST	33262	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:07.851130009 CEST	33264	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:07.855340004 CEST	4444	33262	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:07.856240988 CEST	4444	33264	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:07.856331110 CEST	33264	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:07.856373072 CEST	33264	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:07.861290932 CEST	4444	33264	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:10.162092924 CEST	4444	33264	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:10.162220955 CEST	4444	33264	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:10.162328005 CEST	33264	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:10.162328005 CEST	33264	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:10.162369013 CEST	4444	33264	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:10.162425995 CEST	33264	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:10.163033009 CEST	33266	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:10.167422056 CEST	4444	33264	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:10.172214031 CEST	4444	33266	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:10.172302008 CEST	33266	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:10.172370911 CEST	33266	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:10.178122044 CEST	4444	33266	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:11.758995056 CEST	4444	33266	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:11.759381056 CEST	33266	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:11.760318041 CEST	33268	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:11.764332056 CEST	4444	33266	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:11.765460968 CEST	4444	33268	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:11.765578032 CEST	33268	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:11.765677929 CEST	33268	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:11.770817041 CEST	4444	33268	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:13.316865921 CEST	4444	33268	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:13.317147017 CEST	33268	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:13.317770958 CEST	33270	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:13.322196007 CEST	4444	33268	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:13.322742939 CEST	4444	33270	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:13.322824955 CEST	33270	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:13.322873116 CEST	33270	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:13.328998089 CEST	4444	33270	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:14.866750002 CEST	4444	33270	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:14.867151976 CEST	33270	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:14.867954016 CEST	33272	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:14.872050047 CEST	4444	33270	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:14.873017073 CEST	4444	33272	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:14.873106956 CEST	33272	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:14.873234987 CEST	33272	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:14.878006935 CEST	4444	33272	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:16.430493116 CEST	4444	33272	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:16.430685997 CEST	33272	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:16.431332111 CEST	33274	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:16.435503006 CEST	4444	33272	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:16.436160088 CEST	4444	33274	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:16.436218023 CEST	33274	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:16.436279058 CEST	33274	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:16.441414118 CEST	4444	33274	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:18.005783081 CEST	4444	33274	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:18.006012917 CEST	33274	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:18.006620884 CEST	33276	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:18.010920048 CEST	4444	33274	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:18.011470079 CEST	4444	33276	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:18.011545897 CEST	33276	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:18.011581898 CEST	33276	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:18.016515970 CEST	4444	33276	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:19.571566105 CEST	4444	33276	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:19.572067976 CEST	33276	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:19.572840929 CEST	33278	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:19.577333927 CEST	4444	33276	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:19.578418016 CEST	4444	33278	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:19.578491926 CEST	33278	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:19.578602076 CEST	33278	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:19.583585978 CEST	4444	33278	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:21.129921913 CEST	4444	33278	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:21.130187988 CEST	33278	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:21.130780935 CEST	33280	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:21.135818958 CEST	4444	33278	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:21.136327982 CEST	4444	33280	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:21.136394978 CEST	33280	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:21.136435986 CEST	33280	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:21.141580105 CEST	4444	33280	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:22.694212914 CEST	4444	33280	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:22.694614887 CEST	33280	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:22.695482016 CEST	33282	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:22.700591087 CEST	4444	33280	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:22.701391935 CEST	4444	33282	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:22.701509953 CEST	33282	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:22.701586962 CEST	33282	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:22.706762075 CEST	4444	33282	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:24.257087946 CEST	4444	33282	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:24.257441044 CEST	33282	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:24.258318901 CEST	33284	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:24.263212919 CEST	4444	33282	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:24.263577938 CEST	4444	33284	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:24.263715029 CEST	33284	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:24.263808966 CEST	33284	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:24.269081116 CEST	4444	33284	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:25.879430056 CEST	4444	33284	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:25.879832983 CEST	33284	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:25.880578041 CEST	33286	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:25.884759903 CEST	4444	33284	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:25.885503054 CEST	4444	33286	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:25.885592937 CEST	33286	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:25.885705948 CEST	33286	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:25.890647888 CEST	4444	33286	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:27.463808060 CEST	4444	33286	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:27.464202881 CEST	33286	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:27.464843035 CEST	33288	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:27.473470926 CEST	4444	33286	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:27.473944902 CEST	4444	33288	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:27.474003077 CEST	33288	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:27.474111080 CEST	33288	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:27.483144999 CEST	4444	33288	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:29.023130894 CEST	4444	33288	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:29.023289919 CEST	33288	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:29.023828030 CEST	33290	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:29.028650999 CEST	4444	33288	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:29.029076099 CEST	4444	33290	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:29.029181004 CEST	33290	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:29.029222965 CEST	33290	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:29.034146070 CEST	4444	33290	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:30.584867001 CEST	4444	33290	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:30.585524082 CEST	33290	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:30.586189985 CEST	33292	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:30.592056990 CEST	4444	33290	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:30.592562914 CEST	4444	33292	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:30.592680931 CEST	33292	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:30.592694044 CEST	33292	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:30.599184990 CEST	4444	33292	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:32.163167000 CEST	4444	33292	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:32.163382053 CEST	33292	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:32.164010048 CEST	33294	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:32.168370962 CEST	4444	33292	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:32.169434071 CEST	4444	33294	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:32.169488907 CEST	33294	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:32.169544935 CEST	33294	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:32.174427032 CEST	4444	33294	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:33.723793983 CEST	4444	33294	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:33.724066973 CEST	33294	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:33.724567890 CEST	33296	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:33.729255915 CEST	4444	33294	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:33.729516029 CEST	4444	33296	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:33.729609013 CEST	33296	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:33.729649067 CEST	33296	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:33.734536886 CEST	4444	33296	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:35.288804054 CEST	4444	33296	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:35.289138079 CEST	33296	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:35.289839983 CEST	33298	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:35.294240952 CEST	4444	33296	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:35.294934034 CEST	4444	33298	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:35.294998884 CEST	33298	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:35.295094013 CEST	33298	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:35.301011086 CEST	4444	33298	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:36.921464920 CEST	4444	33298	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:36.922034979 CEST	33298	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:36.922832012 CEST	33300	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:36.928059101 CEST	4444	33298	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:36.928889990 CEST	4444	33300	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:36.929162025 CEST	33300	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:36.929162025 CEST	33300	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:36.934194088 CEST	4444	33300	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:38.509665966 CEST	4444	33300	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:38.509794950 CEST	33300	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:38.510420084 CEST	33302	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:38.515347958 CEST	4444	33300	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:38.515358925 CEST	4444	33302	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:38.515405893 CEST	33302	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:38.515455961 CEST	33302	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:38.520370960 CEST	4444	33302	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:40.072364092 CEST	4444	33302	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:40.072513103 CEST	33302	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:40.074146986 CEST	33304	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:40.077316046 CEST	4444	33302	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:40.079204082 CEST	4444	33304	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:40.079328060 CEST	33304	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:40.079328060 CEST	33304	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:40.084275961 CEST	4444	33304	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:41.654886961 CEST	4444	33304	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:41.655148029 CEST	33304	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:41.655844927 CEST	33306	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:41.659909010 CEST	4444	33304	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:41.660660982 CEST	4444	33306	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:41.660773039 CEST	33306	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:41.660840034 CEST	33306	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:41.666187048 CEST	4444	33306	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:43.210125923 CEST	4444	33306	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:43.210521936 CEST	33306	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:43.211280107 CEST	33308	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:43.217200041 CEST	4444	33306	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:43.218024969 CEST	4444	33308	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:43.218116999 CEST	33308	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:43.218209982 CEST	33308	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:43.224997044 CEST	4444	33308	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:44.896501064 CEST	4444	33308	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:44.896619081 CEST	33308	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:44.897360086 CEST	33310	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:44.901561022 CEST	4444	33308	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:44.902153969 CEST	4444	33310	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:44.902209044 CEST	33310	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:44.902271986 CEST	33310	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:44.907357931 CEST	4444	33310	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:46.479934931 CEST	4444	33310	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:46.480110884 CEST	33310	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:46.483695984 CEST	33312	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:46.484966040 CEST	4444	33310	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:46.488540888 CEST	4444	33312	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:46.488668919 CEST	33312	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:46.488668919 CEST	33312	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:46.493530035 CEST	4444	33312	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:48.052265882 CEST	4444	33312	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:48.052467108 CEST	33312	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:48.053261995 CEST	33314	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:48.057359934 CEST	4444	33312	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:48.058109045 CEST	4444	33314	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:48.058171988 CEST	33314	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:48.058239937 CEST	33314	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:48.063057899 CEST	4444	33314	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:49.688246965 CEST	4444	33314	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:49.688616037 CEST	33314	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:49.689266920 CEST	33316	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:49.693546057 CEST	4444	33314	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:49.694075108 CEST	4444	33316	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:49.694133997 CEST	33316	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:49.694185972 CEST	33316	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:49.698982000 CEST	4444	33316	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:51.275703907 CEST	4444	33316	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:51.275989056 CEST	33316	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:51.276443005 CEST	33318	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:51.280807972 CEST	4444	33316	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:51.281424999 CEST	4444	33318	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:51.281522036 CEST	33318	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:51.281543970 CEST	33318	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:51.288321018 CEST	4444	33318	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:52.866977930 CEST	4444	33318	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:52.867285013 CEST	33318	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:52.867925882 CEST	33320	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:52.872164965 CEST	4444	33318	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:52.872978926 CEST	4444	33320	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:52.873181105 CEST	33320	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:52.873181105 CEST	33320	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:52.878765106 CEST	4444	33320	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:54.428195000 CEST	4444	33320	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:54.428747892 CEST	33320	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:54.429805040 CEST	33322	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:54.433588028 CEST	4444	33320	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:54.434636116 CEST	4444	33322	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:54.434726954 CEST	33322	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:54.434820890 CEST	33322	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:54.440136909 CEST	4444	33322	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:55.993900061 CEST	4444	33322	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:55.994121075 CEST	33322	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:55.994641066 CEST	33324	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:55.998939037 CEST	4444	33322	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:55.999557018 CEST	4444	33324	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:55.999617100 CEST	33324	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:55.999654055 CEST	33324	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:56.006175041 CEST	4444	33324	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:57.570461035 CEST	4444	33324	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:57.570930958 CEST	33324	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:57.571794987 CEST	33326	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:57.576586008 CEST	4444	33324	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:57.576695919 CEST	4444	33326	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:57.576751947 CEST	33326	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:57.576857090 CEST	33326	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:57.581852913 CEST	4444	33326	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:59.307209969 CEST	4444	33326	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:59.307626009 CEST	33326	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:59.308479071 CEST	33328	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:59.313138962 CEST	4444	33326	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:59.313687086 CEST	4444	33328	162.215.219.170	192.168.2.15
Oct 8, 2024 21:05:59.313772917 CEST	33328	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:59.313868999 CEST	33328	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:05:59.319372892 CEST	4444	33328	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:00.977582932 CEST	4444	33328	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:00.977955103 CEST	33328	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:00.978883028 CEST	33330	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:00.983057976 CEST	4444	33328	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:00.983722925 CEST	4444	33330	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:00.983793020 CEST	33330	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:00.983885050 CEST	33330	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:00.989063978 CEST	4444	33330	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:02.584083080 CEST	4444	33330	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:02.584371090 CEST	33330	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:02.584856033 CEST	33332	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:02.590109110 CEST	4444	33330	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:02.590120077 CEST	4444	33332	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:02.590173006 CEST	33332	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:02.590313911 CEST	33332	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:02.595794916 CEST	4444	33332	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:04.147595882 CEST	4444	33332	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:04.147953033 CEST	33332	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:04.148554087 CEST	33334	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:04.153053045 CEST	4444	33332	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:04.153553963 CEST	4444	33334	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:04.153698921 CEST	33334	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:04.153734922 CEST	33334	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:04.158801079 CEST	4444	33334	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:05.711164951 CEST	4444	33334	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:05.711644888 CEST	33334	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:05.712501049 CEST	33336	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:05.716638088 CEST	4444	33334	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:05.717405081 CEST	4444	33336	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:05.717504025 CEST	33336	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:05.717600107 CEST	33336	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:05.723115921 CEST	4444	33336	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:07.287812948 CEST	4444	33336	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:07.288122892 CEST	33336	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:07.288511038 CEST	33338	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:07.293021917 CEST	4444	33336	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:07.293450117 CEST	4444	33338	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:07.293509007 CEST	33338	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:07.293551922 CEST	33338	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:07.298729897 CEST	4444	33338	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:08.852349043 CEST	4444	33338	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:08.852514029 CEST	33338	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:08.853315115 CEST	33340	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:08.857362032 CEST	4444	33338	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:08.858158112 CEST	4444	33340	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:08.858247042 CEST	33340	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:08.858359098 CEST	33340	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:08.864031076 CEST	4444	33340	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:10.412425995 CEST	4444	33340	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:10.412811041 CEST	33340	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:10.413486958 CEST	33342	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:10.417982101 CEST	4444	33340	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:10.418339014 CEST	4444	33342	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:10.418418884 CEST	33342	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:10.418473005 CEST	33342	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:10.423455000 CEST	4444	33342	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:11.979149103 CEST	4444	33342	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:11.979429960 CEST	33342	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:11.980298042 CEST	33344	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:11.984366894 CEST	4444	33342	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:11.985172033 CEST	4444	33344	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:11.985282898 CEST	33344	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:11.985394955 CEST	33344	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:11.990277052 CEST	4444	33344	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:13.543838024 CEST	4444	33344	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:13.544092894 CEST	33344	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:13.544966936 CEST	33346	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:13.549091101 CEST	4444	33344	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:13.550088882 CEST	4444	33346	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:13.550163984 CEST	33346	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:13.550256968 CEST	33346	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:13.555242062 CEST	4444	33346	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:15.131396055 CEST	4444	33346	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:15.131567001 CEST	33346	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:15.132126093 CEST	33348	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:15.136449099 CEST	4444	33346	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:15.137115955 CEST	4444	33348	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:15.137196064 CEST	33348	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:15.137303114 CEST	33348	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:15.142637014 CEST	4444	33348	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:16.693860054 CEST	4444	33348	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:16.694056988 CEST	33348	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:16.694631100 CEST	33350	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:16.699057102 CEST	4444	33348	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:16.699764967 CEST	4444	33350	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:16.699836969 CEST	33350	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:16.699917078 CEST	33350	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:16.704885960 CEST	4444	33350	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:18.258131027 CEST	4444	33350	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:18.258404016 CEST	33350	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:18.259008884 CEST	33352	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:18.263501883 CEST	4444	33350	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:18.264379025 CEST	4444	33352	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:18.264447927 CEST	33352	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:18.264528036 CEST	33352	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:18.269896984 CEST	4444	33352	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:20.105813026 CEST	4444	33352	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:20.106074095 CEST	33352	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:20.106841087 CEST	33354	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:20.113325119 CEST	4444	33352	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:20.113902092 CEST	4444	33354	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:20.113992929 CEST	33354	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:20.114088058 CEST	33354	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:20.119342089 CEST	4444	33354	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:21.715902090 CEST	4444	33354	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:21.716154099 CEST	33354	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:21.717072964 CEST	33356	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:21.722009897 CEST	4444	33354	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:21.722732067 CEST	4444	33356	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:21.722806931 CEST	33356	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:21.722903013 CEST	33356	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:21.729857922 CEST	4444	33356	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:23.320918083 CEST	4444	33356	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:23.321253061 CEST	33356	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:23.321938038 CEST	33358	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:23.326620102 CEST	4444	33356	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:23.327826023 CEST	4444	33358	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:23.327891111 CEST	33358	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:23.328001976 CEST	33358	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:23.333091021 CEST	4444	33358	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:24.881400108 CEST	4444	33358	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:24.881758928 CEST	33358	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:24.882430077 CEST	33360	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:24.887640953 CEST	4444	33358	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:24.887660980 CEST	4444	33360	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:24.887748003 CEST	33360	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:24.887835026 CEST	33360	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:24.893259048 CEST	4444	33360	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:26.465759993 CEST	4444	33360	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:26.466104984 CEST	33360	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:26.466723919 CEST	33362	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:26.471012115 CEST	4444	33360	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:26.471621037 CEST	4444	33362	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:26.471668005 CEST	33362	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:26.471719027 CEST	33362	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:26.476835012 CEST	4444	33362	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:28.057970047 CEST	4444	33362	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:28.058206081 CEST	33362	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:28.059443951 CEST	33364	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:28.063653946 CEST	4444	33362	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:28.065339088 CEST	4444	33364	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:28.065433025 CEST	33364	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:28.065550089 CEST	33364	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:28.071475029 CEST	4444	33364	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:29.667419910 CEST	4444	33364	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:29.667702913 CEST	33364	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:29.668287992 CEST	33366	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:29.672872066 CEST	4444	33364	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:29.673209906 CEST	4444	33366	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:29.673266888 CEST	33366	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:29.673321009 CEST	33366	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:29.678472996 CEST	4444	33366	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:31.243055105 CEST	4444	33366	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:31.243268967 CEST	33366	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:31.244333982 CEST	33368	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:31.248955011 CEST	4444	33366	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:31.249864101 CEST	4444	33368	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:31.250102997 CEST	33368	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:31.250102997 CEST	33368	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:31.255610943 CEST	4444	33368	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:32.818073988 CEST	4444	33368	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:32.818422079 CEST	33368	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:32.818892956 CEST	33370	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:32.823335886 CEST	4444	33368	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:32.823770046 CEST	4444	33370	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:32.823857069 CEST	33370	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:32.823892117 CEST	33370	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:32.829019070 CEST	4444	33370	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:34.403096914 CEST	4444	33370	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:34.403363943 CEST	33370	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:34.404366016 CEST	33372	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:34.408287048 CEST	4444	33370	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:34.409213066 CEST	4444	33372	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:34.409287930 CEST	33372	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:34.409399986 CEST	33372	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:34.414458990 CEST	4444	33372	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:35.979543924 CEST	4444	33372	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:35.979816914 CEST	33372	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:35.980583906 CEST	33374	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:35.984699011 CEST	4444	33372	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:35.985532999 CEST	4444	33374	162.215.219.170	192.168.2.15
Oct 8, 2024 21:06:35.985605955 CEST	33374	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:35.985704899 CEST	33374	4444	192.168.2.15	162.215.219.170
Oct 8, 2024 21:06:35.991241932 CEST	4444	33374	162.215.219.170	192.168.2.15

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 21:05:44.619796038 CEST	56768	53	192.168.2.15	1.1.1.1
Oct 8, 2024 21:05:44.619859934 CEST	38015	53	192.168.2.15	1.1.1.1
Oct 8, 2024 21:05:44.899092913 CEST	53	56768	1.1.1.1	192.168.2.15
Oct 8, 2024 21:05:44.899640083 CEST	53	38015	1.1.1.1	192.168.2.15

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 8, 2024 21:05:44.619796038 CEST	192.168.2.15	1.1.1.1	0x4cdd	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Oct 8, 2024 21:05:44.619859934 CEST	192.168.2.15	1.1.1.1	0x9f19	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 8, 2024 21:05:44.899092913 CEST	1.1.1.1	192.168.2.15	0x4cdd	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false
Oct 8, 2024 21:05:44.899092913 CEST	1.1.1.1	192.168.2.15	0x4cdd	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: SYoMGYCkDG.elf PID: 5522, Parent PID: 5441

General

Start time (UTC):	19:03:00
Start date (UTC):	08/10/2024
Path:	/tmp/SYoMGYCkDG.elf
Arguments:	/tmp/SYoMGYCkDG.elf
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: SYoMGYCkDG.elf PID: 5524, Parent PID: 5522

General

Start time (UTC):	19:03:01
Start date (UTC):	08/10/2024
Path:	/tmp/SYoMGYCkDG.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: SYoMGYCkDG.elf PID: 5526, Parent PID: 5524

General

Start time (UTC):	19:03:01
Start date (UTC):	08/10/2024
Path:	/tmp/SYoMGYCkDG.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: dash PID: 5556, Parent PID: 3671

General

Start time (UTC):	19:03:25
Start date (UTC):	08/10/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rm PID: 5556, Parent PID: 3671

General

Start time (UTC):	19:03:25
Start date (UTC):	08/10/2024
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.SRW62QzKFs /tmp/tmp.PYYO00TAbo /tmp/tmp.kVqVH3y4Dp
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Chronological Activities

Analysis Process: dash PID: 5557, Parent PID: 3671

General

Start time (UTC):	19:03:25
Start date (UTC):	08/10/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rm PID: 5557, Parent PID: 3671

General

Start time (UTC):	19:03:25
Start date (UTC):	08/10/2024
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.SRW62QzKFs /tmp/tmp.PYYO00TAbo /tmp/tmp.kVqVH3y4Dp
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping or `net view` using Net .
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report SYoMGYCkDG.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Threatname: Gafgyt

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.Y54pMM (deleted)

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: SYoMGYCkDG.elf PID: 5522, Parent PID: 5441

General

Chronological Activities

Analysis Process: SYoMGYCkDG.elf PID: 5524, Parent PID: 5522

General

Chronological Activities

Analysis Process: SYoMGYCkDG.elf PID: 5526, Parent PID: 5524

General

Chronological Activities

Linux Analysis Report
SYoMGYCkDG.elf