Edit tour

Linux Analysis Report
lln4e2EfeB.elf

Overview

General Information

Sample name:	lln4e2EfeB.elf renamed because original name is a hash value
Original sample name:	851e68c55ba020000f848519703a4761.elf
Analysis ID:	1529321
MD5:	851e68c55ba020000f848519703a4761
SHA1:	8c0894ea4b423d55590f86c71140c1473685354d
SHA256:	bbaa5899e84efb2fb99a5f238c8e8f3cca72f7a33da90ed897d0adf1d260d2e1
Tags:	32elfmips
Infos:

Detection

Gafgyt, Mirai

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Gafgyt

Yara detected Mirai

Contains symbols with names commonly found in malware

Opens /proc/net/* files useful for finding connected devices and routers

Detected TCP or UDP traffic on non-standard ports

Sample contains strings that are user agent strings indicative of HTTP manipulation

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1529321
Start date and time:	2024-10-08 21:06:35 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	lln4e2EfeB.elf renamed because original name is a hash value
Original Sample Name:	851e68c55ba020000f848519703a4761.elf
Detection:	MAL
Classification:	mal100.spre.troj.linELF@0/1@0/0

Warnings

VT rate limit hit for: lln4e2EfeB.elf

Runtime Messages

Command:	/tmp/lln4e2EfeB.elf
PID:	6211
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

lln4e2EfeB.elf (PID: 6211, Parent: 6131, MD5: 0083f1f0e77be34ad27f849842bbb00c) Arguments: /tmp/lln4e2EfeB.elf

lln4e2EfeB.elf New Fork (PID: 6213, Parent: 6211)

lln4e2EfeB.elf New Fork (PID: 6215, Parent: 6213)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
lln4e2EfeB.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
lln4e2EfeB.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
lln4e2EfeB.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x23f50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x23f64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x23f78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x23f8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x23fa0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x23fb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x23fc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x23fdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x23ff0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24004:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24018:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2402c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24040:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24054:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24068:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2407c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24090:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x240a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x240b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x240cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x240e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
lln4e2EfeB.elf	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x26408:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x27f9c:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64

Memory Dumps

Source	Rule	Description	Author	Strings
6213.1.00007f867c400000.00007f867c42b000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
6213.1.00007f867c400000.00007f867c42b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6213.1.00007f867c400000.00007f867c42b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x23f50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x23f64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x23f78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x23f8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x23fa0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x23fb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x23fc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x23fdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x23ff0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24004:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24018:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2402c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24040:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24054:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24068:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2407c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24090:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x240a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x240b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x240cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x240e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6213.1.00007f867c400000.00007f867c42b000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x26408:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x27f9c:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
6211.1.00007f867c400000.00007f867c42b000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
6211.1.00007f867c400000.00007f867c42b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6211.1.00007f867c400000.00007f867c42b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x23f50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x23f64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x23f78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x23f8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x23fa0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x23fb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x23fc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x23fdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x23ff0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24004:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24018:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2402c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24040:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24054:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24068:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2407c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24090:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x240a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x240b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x240cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x240e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6211.1.00007f867c400000.00007f867c42b000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x26408:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x27f9c:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: lln4e2EfeB.elf PID: 6211	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: lln4e2EfeB.elf PID: 6211	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x394c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3960:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3974:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3988:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x399c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x39b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x39c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x39d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x39ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3a00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3a14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3a28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3a3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3a50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3a64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3a78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3a8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3aa0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3ab4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3ac8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3adc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: lln4e2EfeB.elf PID: 6211	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x6de8:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x7055:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x91d5:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x9cd7:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: lln4e2EfeB.elf PID: 6213	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: lln4e2EfeB.elf PID: 6213	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xa4fe:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa512:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa526:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa53a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa54e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa562:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa576:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa58a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa59e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa5b2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa5c6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa5da:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa5ee:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa602:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa616:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa62a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa63e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa652:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa666:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa67a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa68e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: lln4e2EfeB.elf PID: 6213	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xd99a:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0xdc07:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0xfd87:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x10889:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Click to see the 9 entries

Suricata Signatures

ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T21:07:14.648832+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56324	162.215.219.170	4444	TCP
2024-10-08T21:07:16.363499+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56326	162.215.219.170	4444	TCP
2024-10-08T21:07:17.919635+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56328	162.215.219.170	4444	TCP
2024-10-08T21:07:19.487360+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56330	162.215.219.170	4444	TCP
2024-10-08T21:07:21.341350+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56332	162.215.219.170	4444	TCP
2024-10-08T21:07:22.905497+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56334	162.215.219.170	4444	TCP
2024-10-08T21:07:24.504334+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56336	162.215.219.170	4444	TCP
2024-10-08T21:07:26.101426+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56338	162.215.219.170	4444	TCP
2024-10-08T21:07:27.691002+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56340	162.215.219.170	4444	TCP
2024-10-08T21:07:29.248021+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56342	162.215.219.170	4444	TCP
2024-10-08T21:07:30.831358+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56344	162.215.219.170	4444	TCP
2024-10-08T21:07:32.393681+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56346	162.215.219.170	4444	TCP
2024-10-08T21:07:34.355539+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56348	162.215.219.170	4444	TCP
2024-10-08T21:07:35.903760+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56350	162.215.219.170	4444	TCP
2024-10-08T21:07:37.473383+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56352	162.215.219.170	4444	TCP
2024-10-08T21:07:39.063960+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56354	162.215.219.170	4444	TCP
2024-10-08T21:07:40.707367+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56356	162.215.219.170	4444	TCP
2024-10-08T21:07:42.280833+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56358	162.215.219.170	4444	TCP
2024-10-08T21:07:43.902679+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56360	162.215.219.170	4444	TCP
2024-10-08T21:07:45.472026+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56362	162.215.219.170	4444	TCP
2024-10-08T21:07:47.064139+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56364	162.215.219.170	4444	TCP
2024-10-08T21:07:48.624842+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56366	162.215.219.170	4444	TCP
2024-10-08T21:07:50.207299+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56368	162.215.219.170	4444	TCP
2024-10-08T21:07:51.785968+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56370	162.215.219.170	4444	TCP
2024-10-08T21:07:53.377473+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56372	162.215.219.170	4444	TCP
2024-10-08T21:07:54.957501+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56374	162.215.219.170	4444	TCP
2024-10-08T21:07:56.536651+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56376	162.215.219.170	4444	TCP
2024-10-08T21:07:58.145787+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56378	162.215.219.170	4444	TCP
2024-10-08T21:07:59.725763+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56380	162.215.219.170	4444	TCP
2024-10-08T21:08:02.016188+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56382	162.215.219.170	4444	TCP
2024-10-08T21:08:03.936465+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56384	162.215.219.170	4444	TCP
2024-10-08T21:08:05.859379+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56386	162.215.219.170	4444	TCP
2024-10-08T21:08:07.425075+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56388	162.215.219.170	4444	TCP
2024-10-08T21:08:08.984797+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56390	162.215.219.170	4444	TCP
2024-10-08T21:08:10.553478+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56392	162.215.219.170	4444	TCP
2024-10-08T21:08:12.141848+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56394	162.215.219.170	4444	TCP
2024-10-08T21:08:13.716251+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56396	162.215.219.170	4444	TCP
2024-10-08T21:08:15.286873+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56398	162.215.219.170	4444	TCP
2024-10-08T21:08:16.844449+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56400	162.215.219.170	4444	TCP
2024-10-08T21:08:18.421203+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56402	162.215.219.170	4444	TCP
2024-10-08T21:08:19.989330+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56404	162.215.219.170	4444	TCP
2024-10-08T21:08:21.561787+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56406	162.215.219.170	4444	TCP
2024-10-08T21:08:23.140874+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56408	162.215.219.170	4444	TCP
2024-10-08T21:08:24.909280+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56410	162.215.219.170	4444	TCP
2024-10-08T21:08:26.504556+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56412	162.215.219.170	4444	TCP
2024-10-08T21:08:28.216560+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56414	162.215.219.170	4444	TCP
2024-10-08T21:08:29.786493+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56416	162.215.219.170	4444	TCP
2024-10-08T21:08:32.121698+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56418	162.215.219.170	4444	TCP
2024-10-08T21:08:33.751910+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56420	162.215.219.170	4444	TCP
2024-10-08T21:08:35.377465+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56422	162.215.219.170	4444	TCP
2024-10-08T21:08:36.954459+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56424	162.215.219.170	4444	TCP
2024-10-08T21:08:38.536703+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56426	162.215.219.170	4444	TCP
2024-10-08T21:08:40.109095+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56428	162.215.219.170	4444	TCP
2024-10-08T21:08:41.702718+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56430	162.215.219.170	4444	TCP
2024-10-08T21:08:43.295914+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56432	162.215.219.170	4444	TCP
2024-10-08T21:08:44.874124+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56434	162.215.219.170	4444	TCP
2024-10-08T21:08:46.441579+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56436	162.215.219.170	4444	TCP
2024-10-08T21:08:48.038456+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56438	162.215.219.170	4444	TCP
2024-10-08T21:08:49.629880+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56440	162.215.219.170	4444	TCP
2024-10-08T21:08:51.187329+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56442	162.215.219.170	4444	TCP
2024-10-08T21:08:52.770352+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56444	162.215.219.170	4444	TCP
2024-10-08T21:08:54.330659+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56446	162.215.219.170	4444	TCP
2024-10-08T21:08:55.891444+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56448	162.215.219.170	4444	TCP
2024-10-08T21:08:57.473829+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56450	162.215.219.170	4444	TCP
2024-10-08T21:08:59.068630+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56452	162.215.219.170	4444	TCP
2024-10-08T21:09:00.675879+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56454	162.215.219.170	4444	TCP
2024-10-08T21:09:02.271875+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56456	162.215.219.170	4444	TCP
2024-10-08T21:09:04.079411+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56458	162.215.219.170	4444	TCP
2024-10-08T21:09:05.642286+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56460	162.215.219.170	4444	TCP
2024-10-08T21:09:07.207000+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56462	162.215.219.170	4444	TCP
2024-10-08T21:09:08.767003+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56464	162.215.219.170	4444	TCP
2024-10-08T21:09:10.345652+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56466	162.215.219.170	4444	TCP
2024-10-08T21:09:12.119893+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56468	162.215.219.170	4444	TCP
2024-10-08T21:09:13.766002+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56470	162.215.219.170	4444	TCP
2024-10-08T21:09:15.348847+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56472	162.215.219.170	4444	TCP
2024-10-08T21:09:16.909991+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56474	162.215.219.170	4444	TCP
2024-10-08T21:09:18.486129+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56476	162.215.219.170	4444	TCP
2024-10-08T21:09:20.080899+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56478	162.215.219.170	4444	TCP
2024-10-08T21:09:21.707126+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56480	162.215.219.170	4444	TCP
2024-10-08T21:09:23.287345+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56482	162.215.219.170	4444	TCP
2024-10-08T21:09:24.864079+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56484	162.215.219.170	4444	TCP
2024-10-08T21:09:26.443968+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56486	162.215.219.170	4444	TCP
2024-10-08T21:09:28.020160+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56488	162.215.219.170	4444	TCP
2024-10-08T21:09:29.579569+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56490	162.215.219.170	4444	TCP
2024-10-08T21:09:31.163832+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56492	162.215.219.170	4444	TCP
2024-10-08T21:09:32.756673+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56494	162.215.219.170	4444	TCP
2024-10-08T21:09:34.326387+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56496	162.215.219.170	4444	TCP
2024-10-08T21:09:35.893114+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56498	162.215.219.170	4444	TCP
2024-10-08T21:09:37.456462+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56500	162.215.219.170	4444	TCP
2024-10-08T21:09:39.017444+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56502	162.215.219.170	4444	TCP
2024-10-08T21:09:40.841462+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56504	162.215.219.170	4444	TCP
2024-10-08T21:09:42.407007+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56506	162.215.219.170	4444	TCP
2024-10-08T21:09:43.987394+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56508	162.215.219.170	4444	TCP
2024-10-08T21:09:45.551973+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56510	162.215.219.170	4444	TCP
2024-10-08T21:09:47.117485+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56512	162.215.219.170	4444	TCP
2024-10-08T21:09:48.698252+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56514	162.215.219.170	4444	TCP
2024-10-08T21:09:50.254212+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56516	162.215.219.170	4444	TCP
2024-10-08T21:09:52.131928+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56518	162.215.219.170	4444	TCP
2024-10-08T21:09:53.701174+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56520	162.215.219.170	4444	TCP
2024-10-08T21:09:55.319875+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56522	162.215.219.170	4444	TCP
2024-10-08T21:09:56.894017+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56524	162.215.219.170	4444	TCP
2024-10-08T21:09:58.454554+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56526	162.215.219.170	4444	TCP
2024-10-08T21:10:00.035119+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56528	162.215.219.170	4444	TCP
2024-10-08T21:10:01.600148+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56530	162.215.219.170	4444	TCP
2024-10-08T21:10:03.342476+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56532	162.215.219.170	4444	TCP
2024-10-08T21:10:04.892137+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56534	162.215.219.170	4444	TCP
2024-10-08T21:10:06.457873+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56536	162.215.219.170	4444	TCP
2024-10-08T21:10:08.092780+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56538	162.215.219.170	4444	TCP
2024-10-08T21:10:09.705419+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56540	162.215.219.170	4444	TCP
2024-10-08T21:10:12.110134+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56542	162.215.219.170	4444	TCP
2024-10-08T21:10:13.713139+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56544	162.215.219.170	4444	TCP
2024-10-08T21:10:15.291361+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56546	162.215.219.170	4444	TCP
2024-10-08T21:10:16.893911+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56548	162.215.219.170	4444	TCP
2024-10-08T21:10:18.490056+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56550	162.215.219.170	4444	TCP
2024-10-08T21:10:20.201887+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56552	162.215.219.170	4444	TCP
2024-10-08T21:10:21.769765+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56554	162.215.219.170	4444	TCP
2024-10-08T21:10:23.329450+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56556	162.215.219.170	4444	TCP
2024-10-08T21:10:24.937771+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56558	162.215.219.170	4444	TCP
2024-10-08T21:10:26.502712+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56560	162.215.219.170	4444	TCP
2024-10-08T21:10:28.082278+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56562	162.215.219.170	4444	TCP
2024-10-08T21:10:29.643273+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56564	162.215.219.170	4444	TCP
2024-10-08T21:10:31.254043+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56566	162.215.219.170	4444	TCP
2024-10-08T21:10:33.738497+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56568	162.215.219.170	4444	TCP
2024-10-08T21:10:35.317742+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56570	162.215.219.170	4444	TCP
2024-10-08T21:10:36.876663+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56572	162.215.219.170	4444	TCP
2024-10-08T21:10:38.439459+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56574	162.215.219.170	4444	TCP
2024-10-08T21:10:40.002313+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56576	162.215.219.170	4444	TCP
2024-10-08T21:10:41.565206+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56578	162.215.219.170	4444	TCP
2024-10-08T21:10:43.146757+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56580	162.215.219.170	4444	TCP
2024-10-08T21:10:44.736494+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56582	162.215.219.170	4444	TCP
2024-10-08T21:10:46.320963+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56584	162.215.219.170	4444	TCP
2024-10-08T21:10:47.899308+0200	2846526	1	A Network Trojan was detected	192.168.2.23	56586	162.215.219.170	4444	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: lln4e2EfeB.elf

Avira: detected

Found malware configuration

Source: lln4e2EfeB.elf

Malware Configuration Extractor: Gafgyt {"C2 url": "162.215.219.170:4444"}

Multi AV Scanner detection for submitted file

Source: lln4e2EfeB.elf

ReversingLabs: Detection: 50%

Spreading

Opens /proc/net/* files useful for finding connected devices and routers

Source: /tmp/lln4e2EfeB.elf (PID: 6211)

Opens: /proc/net/route

Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56336 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56398 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56380 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56326 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56352 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56456 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56324 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56394 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56362 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56416 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56366 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56454 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56340 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56368 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56358 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56408 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56360 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56370 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56330 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56414 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56430 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56328 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56424 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56560 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56346 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56434 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56402 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56526 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56376 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56406 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56356 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56462 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56410 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56458 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56342 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56490 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56530 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56444 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56552 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56334 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56500 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56374 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56520 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56400 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56354 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56466 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56488 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56412 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56372 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56396 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56364 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56558 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56418 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56510 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56580 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56404 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56586 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56522 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56450 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56344 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56554 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56492 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56384 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56440 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56518 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56508 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56392 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56390 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56422 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56540 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56432 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56332 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56428 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56452 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56486 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56468 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56338 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56570 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56578 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56472 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56494 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56532 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56584 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56582 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56348 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56528 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56572 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56480 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56426 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56382 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56506 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56478 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56502 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56564 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56496 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56544 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56378 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56388 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56350 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56556 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56470 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56436 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56498 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56386 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56446 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56474 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56538 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56448 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56512 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56460 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56568 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56548 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56516 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56550 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56562 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56566 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56504 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56524 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56420 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56574 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56484 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56438 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56514 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56542 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56464 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56576 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56476 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56536 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56442 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56482 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56534 -> 162.215.219.170:4444
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:56546 -> 162.215.219.170:4444

Source: global traffic

TCP traffic: 192.168.2.23:56324 -> 162.215.219.170:4444

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.219.170

Source: lln4e2EfeB.elf	String found in binary or memory: http://fast.no/support/crawler.asp)
Source: lln4e2EfeB.elf	String found in binary or memory: http://feedback.redkolibri.com/
Source: lln4e2EfeB.elf	String found in binary or memory: http://www.baidu.com/search/spider.htm)
Source: lln4e2EfeB.elf	String found in binary or memory: http://www.baidu.com/search/spider.html)
Source: lln4e2EfeB.elf	String found in binary or memory: http://www.billybobbot.com/crawler/)

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: lln4e2EfeB.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: lln4e2EfeB.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6213.1.00007f867c400000.00007f867c42b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6213.1.00007f867c400000.00007f867c42b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6211.1.00007f867c400000.00007f867c42b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6211.1.00007f867c400000.00007f867c42b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: lln4e2EfeB.elf PID: 6211, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: lln4e2EfeB.elf PID: 6211, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: lln4e2EfeB.elf PID: 6213, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: lln4e2EfeB.elf PID: 6213, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown

Contains symbols with names commonly found in malware

Source: ELF static info symbol of initial sample	Name: httpattack
Source: ELF static info symbol of initial sample	Name: vseattack

Source: lln4e2EfeB.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: lln4e2EfeB.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6213.1.00007f867c400000.00007f867c42b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6213.1.00007f867c400000.00007f867c42b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6211.1.00007f867c400000.00007f867c42b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6211.1.00007f867c400000.00007f867c42b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: lln4e2EfeB.elf PID: 6211, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: lln4e2EfeB.elf PID: 6211, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: lln4e2EfeB.elf PID: 6213, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: lln4e2EfeB.elf PID: 6213, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.spre.troj.linELF@0/1@0/0

Source: /tmp/lln4e2EfeB.elf (PID: 6211)

Queries kernel information via 'uname':

Jump to behavior

Source: lln4e2EfeB.elf, 6211.1.0000557e9af5f000.0000557e9afe6000.rw-.sdmp, lln4e2EfeB.elf, 6213.1.0000557e9af5f000.0000557e9afe6000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/mips
Source: lln4e2EfeB.elf, 6211.1.00007fff5b4c0000.00007fff5b4e1000.rw-.sdmp, lln4e2EfeB.elf, 6213.1.00007fff5b4c0000.00007fff5b4e1000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-mips
Source: lln4e2EfeB.elf, 6211.1.0000557e9af5f000.0000557e9afe6000.rw-.sdmp, lln4e2EfeB.elf, 6213.1.0000557e9af5f000.0000557e9afe6000.rw-.sdmp	Binary or memory string: ~U!/etc/qemu-binfmt/mips
Source: lln4e2EfeB.elf, 6211.1.00007fff5b4c0000.00007fff5b4e1000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.pSovwR
Source: lln4e2EfeB.elf, 6211.1.00007fff5b4c0000.00007fff5b4e1000.rw-.sdmp, lln4e2EfeB.elf, 6213.1.00007fff5b4c0000.00007fff5b4e1000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-mips/tmp/lln4e2EfeB.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/lln4e2EfeB.elf
Source: lln4e2EfeB.elf, 6211.1.00007fff5b4c0000.00007fff5b4e1000.rw-.sdmp	Binary or memory string: ~U/tmp/qemu-open.pSovwR\

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match	File source: lln4e2EfeB.elf, type: SAMPLE
Source: Yara match	File source: 6213.1.00007f867c400000.00007f867c42b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6211.1.00007f867c400000.00007f867c42b000.r-x.sdmp, type: MEMORY

Yara detected Mirai

Source: Yara match	File source: lln4e2EfeB.elf, type: SAMPLE
Source: Yara match	File source: 6213.1.00007f867c400000.00007f867c42b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6211.1.00007f867c400000.00007f867c42b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: lln4e2EfeB.elf PID: 6211, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: lln4e2EfeB.elf PID: 6213, type: MEMORYSTR

Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36
Source: Initial sample	User agent string found: Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; rv:2.2) Gecko/20110201
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.2; U; ru) Presto/2.5.22 Version/10.51
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko
Source: Initial sample	User agent string found: Mozilla/5.0 (Android; Linux armv7l; rv:9.0) Gecko/20111216 Firefox/9.0 Fennec/9.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60
Source: Initial sample	User agent string found: Mozilla/5.0 (iPad; U; CPU OS 5_1 like Mac OS X) AppleWebKit/531.21.10 (KHTML, like Gecko) Version/4.0.4 Mobile/7B367 Safari/531.21.10 UCBrowser/3.4.3.532
Source: Initial sample	User agent string found: Mozilla/5.0 (Nintendo WiiU) AppleWebKit/536.30 (KHTML, like Gecko) NX/3.0.4.2.12 NintendoBrowser/4.3.1.11264.US
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:25.0) Gecko/20100101 Firefox/25.0
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; pl) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; en) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; ja) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; cn) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; fr) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20100101 Firefox/12.0
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; U; Linux x86_64; de; rv:1.9.2.8) Gecko/20100723 Ubuntu/10.04 (lucid) Firefox/3.6.8
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; rv:13.0) Gecko/20100101 Firefox/13.0.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:11.0) Gecko/20100101 Firefox/11.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:13.0) Gecko/20100101 Firefox/13.0.1
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.289 Version/12.01
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.02
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.0) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.112 Safari/535.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en; rv:1.8.1.11) Gecko/20071128 Camino/1.5.4
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; cs; rv:1.9.2.6) Gecko/20100628 myibrow/4alpha2
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Win 9x 4.90; SG; rv:1.9.2.4) Gecko/20101104 Netscape/9.1.0285
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.2.0 Lightning/4.0.2
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10; rv:33.0) Gecko/20100101 Firefox/33.0

Remote Access Functionality

Yara detected Gafgyt

Source: Yara match	File source: lln4e2EfeB.elf, type: SAMPLE
Source: Yara match	File source: 6213.1.00007f867c400000.00007f867c42b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6211.1.00007f867c400000.00007f867c42b000.r-x.sdmp, type: MEMORY

Yara detected Mirai

Source: Yara match	File source: lln4e2EfeB.elf, type: SAMPLE
Source: Yara match	File source: 6213.1.00007f867c400000.00007f867c42b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6211.1.00007f867c400000.00007f867c42b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: lln4e2EfeB.elf PID: 6211, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: lln4e2EfeB.elf PID: 6213, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	1 Remote System Discovery	Remote Desktop Protocol	Data from Removable Media	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

Threatname: Gafgyt

{"C2 url": "162.215.219.170:4444"}

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
lln4e2EfeB.elf	50%	ReversingLabs	Linux.Backdoor.DemonBot
lln4e2EfeB.elf	100%	Avira	LINUX/Mirai.Gafgyt.

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.billybobbot.com/crawler/)	0%	URL Reputation	safe
http://fast.no/support/crawler.asp)	0%	URL Reputation	safe
http://feedback.redkolibri.com/	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
162.215.219.170:4444	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.baidu.com/search/spider.html)	lln4e2EfeB.elf	false		unknown
http://www.billybobbot.com/crawler/)	lln4e2EfeB.elf	false	URL Reputation: safe	unknown
http://fast.no/support/crawler.asp)	lln4e2EfeB.elf	false	URL Reputation: safe	unknown
http://feedback.redkolibri.com/	lln4e2EfeB.elf	false	URL Reputation: safe	unknown
http://www.baidu.com/search/spider.htm)	lln4e2EfeB.elf	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
162.215.219.170	unknown	United States	46606	UNIFIEDLAYER-AS-1US	true
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
162.215.219.170	SYoMGYCkDG.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	Hy0AyRD058.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	j3wIEvE5Sj.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	hmNdVt8mF7.elf	Get hash	malicious	Gafgyt, Mirai	Browse
91.189.91.43	Hy0AyRD058.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	NCVLNSfw1e.elf	Get hash	malicious	Unknown	Browse
	MO52No4WnT.elf	Get hash	malicious	Unknown	Browse
	BOVYJVrOjt.elf	Get hash	malicious	Mirai	Browse
	UZPtyH1Maa.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Mirai	Browse
91.189.91.42	Hy0AyRD058.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	NCVLNSfw1e.elf	Get hash	malicious	Unknown	Browse
	MO52No4WnT.elf	Get hash	malicious	Unknown	Browse
	BOVYJVrOjt.elf	Get hash	malicious	Mirai	Browse
	UZPtyH1Maa.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	Hy0AyRD058.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	NCVLNSfw1e.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	5skkMenK5x.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	MO52No4WnT.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	gMYQFxufu0.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	4LbWi40g57.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	BOVYJVrOjt.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	UZPtyH1Maa.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	irods-runtime-4.1.9-centos7-x86_64.rpm	Get hash	malicious	Xmrig	Browse	185.125.188.62
	na.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
CANONICAL-ASGB	Hy0AyRD058.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	NCVLNSfw1e.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	5skkMenK5x.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	MO52No4WnT.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	gMYQFxufu0.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	4LbWi40g57.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	BOVYJVrOjt.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	UZPtyH1Maa.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	irods-runtime-4.1.9-centos7-x86_64.rpm	Get hash	malicious	Xmrig	Browse	185.125.188.62
	na.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
UNIFIEDLAYER-AS-1US	SYoMGYCkDG.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.215.219.170
	Hy0AyRD058.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.215.219.170
	j3wIEvE5Sj.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.215.219.170
	hmNdVt8mF7.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.215.219.170
	https://phisher-parts-production-us-east-1.s3.amazonaws.com/da08a569-c476-4c06-9e6f-9e3c8ae51232/2024-10-08/dm05v41jqt45dhgffdnn8f9og9hsqbgjjjhn2jo1/7abc4121254d93d61494ed63a8489e54fc18f49b8fee3f2e42bc06d8de3bd8f4?response-content-disposition=attachment%3B%20filename%3D%22Trailhead%20Media%2024-090.pdf%22%3B%20filename%2A%3DUTF-8%27%27Trailhead%2520Media%252024-090.pdf&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=ASIA37KREM2QGGSCSFZ4%2F20241008%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20241008T163442Z&X-Amz-Expires=13860&X-Amz-Security-Token=IQoJb3JpZ2luX2VjEO%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaCXVzLWVhc3QtMSJHMEUCIDgEEKEw%2BhLGwBtqA9K8lbT2NL7hbWhvf2%2BPjyD670ZwAiEAjxudbMDljL%2FUqXOnRGbBuWM4gt9lBw1st5sI4FM7vZ8q%2FwMIRxAAGgw4MjMxOTMyNjU4MjQiDFL6sO98KdRGT%2FyB6ircA40orR%2Bw3i4U%2B9phl56wCil07vS%2BjAp0tNBfyQAkuYLNSI62vBzUSfUh8AtFx4keNf0RgCCwE%2F5gCyMz9dJzZLyDD2IAKWq0%2BZVLBi%2F7b8rVNUO1YeOio8ujPMfp7PNvhweEfhhY8gWxNds6w8BqlSQW47gyG6lKcp0A7mT5WgKaRXw1WeqCAEMdJCJlPtEma%2BQC5iWhRM0pLWgiBkR6hefhuzg2Tz54kHG3UNQwcDWAaKnjqYhM7zFoyV4AQaheZ%2FfeYnY1yedYoX4pPvs1ESF9JlWKqYxq45XmyrelrdgZHdinsHB9NygBDgLYdQlVcA8q8aEDwM5yaKxZUCkRDUT%2BJb0%2BCtt9rbu6zRC%2FVmZKIGqbIpVGNy4amYEf%2BnSXLUdz7lVpXGsb3kLoOghblbHcyVEfagdESdqIrQuvWG9mqEGbD0OQjdCwVx4Q4jbP%2F64E0vyYOxW5KEhabAoO8CQ4rv8pn47DEAsuKYtGkCRN%2FxqSxHV6ean9UbkBuNzcfqn%2FVpGx3A2uxr7Lyff7MJArWEMXsvfWi5LKjU8A8WeqnHljxyB6lsfFsi3p6KnjmkR9k7rwdRb2wdfEKvrkoq5%2B9cMWCTkzI1xSuI12GZdP74XfakNrsOJTGxzpMOaBlbgGOqUB6EOKQuRv4stEwpQj1THsV61McwaeBhcQW1ZeiHMR%2FPMuUFHOTfzikGnzEF0dw579Pv6WD2vyvq7i7uJv%2BRQQTqPgYSf6GCpXd%2Bpo4bQXTs9GoUG1Dv0s2Tos1ZBR6T7%2BCdAb%2F%2BMYiPDy86%2FFbh1RI6E5jnVh%2ByCIGL%2Bg53Mj67qwCe%2F7aw%2B6TyAnJVcGnug9ml35ow0E3Vc4ob87u3B9PwqgKEDQ&X-Amz-SignedHeaders=host&X-Amz-Signature=e4981c31034331c2fd0b62d9cfd5b86f4ce28daacc9bf862502fbb9c444389d2	Get hash	malicious	HTMLPhisher	Browse	162.214.125.2
	https://hnt.zkg.mybluehost.me/CA/LET	Get hash	malicious	HTMLPhisher	Browse	50.6.153.248
	paymentremittanceinformationCQDM.html	Get hash	malicious	Unknown	Browse	69.49.245.172
	https://ipfs.io/ipfs/QmNRP5R9QkxB8MVgk2kWzrmB6GoTVL3gcLheGnJuUDPaXv?filename=forme.html#jstubblefield@securustechnologies.com	Get hash	malicious	HTMLPhisher	Browse	162.241.27.10
	NIJIMUN6pQ.exe	Get hash	malicious	AgentTesla	Browse	192.254.225.166
	5FRWRDOqk7.exe	Get hash	malicious	FormBook	Browse	162.240.81.18
INIT7CH	Hy0AyRD058.elf	Get hash	malicious	Gafgyt, Mirai	Browse	109.202.202.202
	NCVLNSfw1e.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	MO52No4WnT.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	BOVYJVrOjt.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	UZPtyH1Maa.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	na.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	na.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	na.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	na.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	na.elf	Get hash	malicious	Unknown	Browse	109.202.202.202

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/tmp/qemu-open.pSovwR (deleted)

Download File

Process:	/tmp/lln4e2EfeB.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	230
Entropy (8bit):	3.709552666863289
Encrypted:	false
SSDEEP:	6:iekrEcvwAsE5KlwSd4pzKaV6Lpms/a/1VCxGF:ur+m5MwSdIKaV6L1adVRF
MD5:	2E667F43AE18CD1FE3C108641708A82C
SHA1:	12B90DE2DA0FBCFE66F3D6130905E56C8D6A68D3
SHA-256:	6F721492E7A337C5B498A8F55F5EB7AC745AFF716D0B5B08EFF2C1B6B250F983
SHA-512:	D2A0EE2509154EC1098994F38BE172F98F4150399C534A04D5C675D7C05630802225019F19344CC9070C576BC465A4FEB382AC7712DE6BF25E9244B54A9DB830
Malicious:	false
Reputation:	high, very likely benign file
Preview:	Iface.Destination.Gateway .Flags.RefCnt.Use.Metric.Mask..MTU.Window.IRTT .ens160.00000000.c0a80201.0003.0.0.0.00000000.0.0.0.ens160.c0a80200.00000000.0001.0.0.0.ffffff00.0.0.0.

Static File Info

General

File type:	ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, not stripped
Entropy (8bit):	5.49058247114134
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	lln4e2EfeB.elf
File size:	215'144 bytes
MD5:	851e68c55ba020000f848519703a4761
SHA1:	8c0894ea4b423d55590f86c71140c1473685354d
SHA256:	bbaa5899e84efb2fb99a5f238c8e8f3cca72f7a33da90ed897d0adf1d260d2e1
SHA512:	96b3b023d30bf3e34afceb9243565a1da0db01c2f8f46252f3917ebea85ed57f1df9e617e0bab450a15fb03375368288b4bde084d5fd11598a7ecc9a140a8c34
SSDEEP:	3072:VINFBQXGEz6r5tCtIMkHNTUrrqGXNGE2lW6Uzvql7GS3sRRRn6N5hgj06Y7mrpy8:q5Ann6N5hgj0vmrpy6n9Nn
TLSH:	B424933E7912AB7DE1A9833207F76FB09B5511E323A19341E26CCB186E7125D2C8FB54
File Content Preview:	.ELF.....................@.....4.........4. ...(....p........@...@...........................@...@...........................C...C.........................4.C.4.C.4................dt.Q.................................................D0@<...'./T...!'......

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	MIPS R3000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x4002d0
Flags:	0x1007
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	5
Section Header Offset:	190104
Section Header Size:	40
Number of Section Headers:	23
Header String Table Index:	20

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.reginfo	MIPS_REGINFO	0x4000d4	0xd4	0x18	0x18	0x2	A	0	0	4
.init	PROGBITS	0x4000ec	0xec	0x8c	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x400180	0x180	0x22720	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x4228a0	0x228a0	0x5c	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x422900	0x22900	0x78f0	0x0	0x2	A	0	0	16
.eh_frame	PROGBITS	0x43a1f0	0x2a1f0	0x44	0x0	0x3	WA	0	0	4
.tbss	NOBITS	0x43a234	0x2a234	0x8	0x0	0x403	WAT	0	0	4
.ctors	PROGBITS	0x43a234	0x2a234	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x43a23c	0x2a23c	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x43a244	0x2a244	0x4	0x0	0x3	WA	0	0	4
.data.rel.ro	PROGBITS	0x43a248	0x2a248	0xa44	0x0	0x3	WA	0	0	4
.data	PROGBITS	0x43ac90	0x2ac90	0x3c0	0x0	0x3	WA	0	0	16
.got	PROGBITS	0x43b050	0x2b050	0x574	0x4	0x10000003	WAp	0	0	16
.sdata	PROGBITS	0x43b5c4	0x2b5c4	0x4	0x0	0x10000003	WAp	0	0	4
.sbss	NOBITS	0x43b5c8	0x2b5c8	0x4c	0x0	0x10000003	WAp	0	0	4
.bss	NOBITS	0x43b620	0x2b5c8	0x7188	0x0	0x3	WA	0	0	16
.comment	PROGBITS	0x0	0x2b5c8	0xc06	0x0	0x0		0	0	1
.mdebug.abi32	PROGBITS	0xc06	0x2c1ce	0x0	0x0	0x0		0	0	1
.pdr	PROGBITS	0x0	0x2c1d0	0x2420	0x0	0x0		0	0	4
.shstrtab	STRTAB	0x0	0x2e5f0	0xa7	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x2ea30	0x3590	0x10	0x0		22	344	4
.strtab	STRTAB	0x0	0x31fc0	0x28a8	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
<unknown>	0xd4	0x4000d4	0x4000d4	0x18	0x18	0.9834	0x4	R	0x4	.reginfo
LOAD	0x0	0x400000	0x400000	0x2a1f0	0x2a1f0	5.4947	0x5	R E	0x10000	.reginfo .init .text .fini .rodata
LOAD	0x2a1f0	0x43a1f0	0x43a1f0	0x13d8	0x85b8	4.8529	0x6	RW	0x10000	.eh_frame .tbss .ctors .dtors .jcr .data.rel.ro .data .got .sdata .sbss .bss
TLS	0x2a234	0x43a234	0x43a234	0x0	0x8	0.0000	0x4	R	0x4	.tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x4000d4	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x4000ec	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x400180	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x4228a0	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x422900	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x43a1f0	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x43a234	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x43a234	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x43a23c	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x43a244	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x43a248	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x43ac90	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x43b050	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x43b5c4	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x43b5c8	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x43b620	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0xc06	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	19
C.1.5091	.symtab	0x429d30	24	OBJECT	<unknown>	DEFAULT	5
C.108.5632	.symtab	0x43a248	48	OBJECT	<unknown>	DEFAULT	11
C.141.5948	.symtab	0x43a278	24	OBJECT	<unknown>	DEFAULT	11
C.196.6560	.symtab	0x43a2ec	12	OBJECT	<unknown>	DEFAULT	11
C.197.6561	.symtab	0x43a290	92	OBJECT	<unknown>	DEFAULT	11
C.199.6667	.symtab	0x43a2f8	1144	OBJECT	<unknown>	DEFAULT	11
C.202.6704	.symtab	0x43a770	24	OBJECT	<unknown>	DEFAULT	11
C.205.6735	.symtab	0x43a788	24	OBJECT	<unknown>	DEFAULT	11
C.216.6874	.symtab	0x43a7a0	1128	OBJECT	<unknown>	DEFAULT	11
C.257.7174	.symtab	0x43ac08	96	OBJECT	<unknown>	DEFAULT	11
C.261.7222	.symtab	0x43ac68	36	OBJECT	<unknown>	DEFAULT	11
C.3.5380	.symtab	0x429cfc	12	OBJECT	<unknown>	DEFAULT	5
C.3.6092	.symtab	0x428bc0	12	OBJECT	<unknown>	DEFAULT	5
C.3.6114	.symtab	0x429d78	12	OBJECT	<unknown>	DEFAULT	5
C.3.6172	.symtab	0x429d50	12	OBJECT	<unknown>	DEFAULT	5
C.4.6115	.symtab	0x429d6c	12	OBJECT	<unknown>	DEFAULT	5
C.5.6123	.symtab	0x429d60	12	OBJECT	<unknown>	DEFAULT	5
C.6.5518	.symtab	0x429cf0	12	OBJECT	<unknown>	DEFAULT	5
DNSw	.symtab	0x40b544	1064	FUNC	<unknown>	DEFAULT	3
FRAMESZ	.symtab	0x20	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
GPOFF	.symtab	0x18	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
HIPER_OVH	.symtab	0x408e34	688	FUNC	<unknown>	DEFAULT	3
LOCALSZ	.symtab	0x3	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
Q	.symtab	0x43b658	16384	OBJECT	<unknown>	DEFAULT	16
RAOFF	.symtab	0x1c	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
Randhex	.symtab	0x409e74	696	FUNC	<unknown>	DEFAULT	3
SendCloudflare	.symtab	0x406f50	624	FUNC	<unknown>	DEFAULT	3
SendDOMINATE	.symtab	0x40a344	2248	FUNC	<unknown>	DEFAULT	3
SendHOME1	.symtab	0x4090e4	596	FUNC	<unknown>	DEFAULT	3
SendHOME2	.symtab	0x409338	596	FUNC	<unknown>	DEFAULT	3
SendHTTPCloudflare	.symtab	0x4071c0	624	FUNC	<unknown>	DEFAULT	3
SendHTTPHex	.symtab	0x4069f8	684	FUNC	<unknown>	DEFAULT	3
SendOVH_STORM	.symtab	0x407ba0	4756	FUNC	<unknown>	DEFAULT	3
SendSTD	.symtab	0x404904	524	FUNC	<unknown>	DEFAULT	3
SendSTDHEX	.symtab	0x403a4c	564	FUNC	<unknown>	DEFAULT	3
SendSTD_HEX	.symtab	0x404d28	596	FUNC	<unknown>	DEFAULT	3
SendUDP	.symtab	0x402a90	1704	FUNC	<unknown>	DEFAULT	3
UDPRAW	.symtab	0x409a44	536	FUNC	<unknown>	DEFAULT	3
V0OFF	.symtab	0x14	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_Exit	.symtab	0x412ec0	76	FUNC	<unknown>	DEFAULT	3
_GLOBAL_OFFSET_TABLE_	.symtab	0x43b050	0	OBJECT	<unknown>	DEFAULT	13
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x43a238	0	OBJECT	<unknown>	DEFAULT	8
__CTOR_LIST__	.symtab	0x43a234	0	OBJECT	<unknown>	DEFAULT	8
__C_ctype_b	.symtab	0x43adb0	4	OBJECT	<unknown>	DEFAULT	12
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x4285c0	768	OBJECT	<unknown>	DEFAULT	5
__C_ctype_tolower	.symtab	0x43b040	4	OBJECT	<unknown>	DEFAULT	12
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x429ef0	768	OBJECT	<unknown>	DEFAULT	5
__C_ctype_toupper	.symtab	0x43adc0	4	OBJECT	<unknown>	DEFAULT	12
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x4288c0	768	OBJECT	<unknown>	DEFAULT	5
__DTOR_END__	.symtab	0x43a240	0	OBJECT	<unknown>	DEFAULT	9
__DTOR_LIST__	.symtab	0x43a23c	0	OBJECT	<unknown>	DEFAULT	9
__EH_FRAME_BEGIN__	.symtab	0x43a1f0	0	OBJECT	<unknown>	DEFAULT	6
__FRAME_END__	.symtab	0x43a230	0	OBJECT	<unknown>	DEFAULT	6
__GI___C_ctype_b	.symtab	0x43adb0	4	OBJECT	<unknown>	HIDDEN	12
__GI___C_ctype_tolower	.symtab	0x43b040	4	OBJECT	<unknown>	HIDDEN	12
__GI___C_ctype_toupper	.symtab	0x43adc0	4	OBJECT	<unknown>	HIDDEN	12
__GI___close	.symtab	0x418a9c	176	FUNC	<unknown>	HIDDEN	3
__GI___close_nocancel	.symtab	0x418a74	40	FUNC	<unknown>	HIDDEN	3
__GI___ctype_b	.symtab	0x43adb4	4	OBJECT	<unknown>	HIDDEN	12
__GI___ctype_tolower	.symtab	0x43b044	4	OBJECT	<unknown>	HIDDEN	12
__GI___ctype_toupper	.symtab	0x43adc4	4	OBJECT	<unknown>	HIDDEN	12
__GI___errno_location	.symtab	0x413390	28	FUNC	<unknown>	HIDDEN	3
__GI___fcntl_nocancel	.symtab	0x412d40	108	FUNC	<unknown>	HIDDEN	3
__GI___fgetc_unlocked	.symtab	0x41d230	388	FUNC	<unknown>	HIDDEN	3
__GI___glibc_strerror_r	.symtab	0x415190	68	FUNC	<unknown>	HIDDEN	3
__GI___libc_close	.symtab	0x418a9c	176	FUNC	<unknown>	HIDDEN	3
__GI___libc_fcntl	.symtab	0x412dac	268	FUNC	<unknown>	HIDDEN	3
__GI___libc_open	.symtab	0x418b8c	192	FUNC	<unknown>	HIDDEN	3
__GI___libc_read	.symtab	0x418d8c	192	FUNC	<unknown>	HIDDEN	3
__GI___libc_waitpid	.symtab	0x418e8c	192	FUNC	<unknown>	HIDDEN	3
__GI___libc_write	.symtab	0x418c8c	192	FUNC	<unknown>	HIDDEN	3
__GI___open	.symtab	0x418b8c	192	FUNC	<unknown>	HIDDEN	3
__GI___open_nocancel	.symtab	0x418b64	40	FUNC	<unknown>	HIDDEN	3
__GI___read	.symtab	0x418d8c	192	FUNC	<unknown>	HIDDEN	3
__GI___read_nocancel	.symtab	0x418d64	40	FUNC	<unknown>	HIDDEN	3
__GI___register_atfork	.symtab	0x418500	452	FUNC	<unknown>	HIDDEN	3
__GI___sigaddset	.symtab	0x415cf8	44	FUNC	<unknown>	HIDDEN	3
__GI___sigdelset	.symtab	0x415d24	48	FUNC	<unknown>	HIDDEN	3
__GI___sigismember	.symtab	0x415cd0	40	FUNC	<unknown>	HIDDEN	3
__GI___uClibc_fini	.symtab	0x419100	204	FUNC	<unknown>	HIDDEN	3
__GI___uClibc_init	.symtab	0x419254	120	FUNC	<unknown>	HIDDEN	3
__GI___waitpid	.symtab	0x418e8c	192	FUNC	<unknown>	HIDDEN	3
__GI___write	.symtab	0x418c8c	192	FUNC	<unknown>	HIDDEN	3
__GI___write_nocancel	.symtab	0x418c64	40	FUNC	<unknown>	HIDDEN	3
__GI___xpg_strerror_r	.symtab	0x4151e0	380	FUNC	<unknown>	HIDDEN	3
__GI__exit	.symtab	0x412ec0	76	FUNC	<unknown>	HIDDEN	3
__GI_abort	.symtab	0x416ee0	408	FUNC	<unknown>	HIDDEN	3
__GI_atoi	.symtab	0x417800	28	FUNC	<unknown>	HIDDEN	3
__GI_brk	.symtab	0x41edb0	80	FUNC	<unknown>	HIDDEN	3
__GI_chdir	.symtab	0x412f50	56	FUNC	<unknown>	HIDDEN	3
__GI_close	.symtab	0x418a9c	176	FUNC	<unknown>	HIDDEN	3
__GI_closedir	.symtab	0x41a410	292	FUNC	<unknown>	HIDDEN	3
__GI_config_close	.symtab	0x41ae04	132	FUNC	<unknown>	HIDDEN	3
__GI_config_open	.symtab	0x41ae88	116	FUNC	<unknown>	HIDDEN	3
__GI_config_read	.symtab	0x41a940	1220	FUNC	<unknown>	HIDDEN	3
__GI_connect	.symtab	0x4155cc	220	FUNC	<unknown>	HIDDEN	3
__GI_execve	.symtab	0x41a0b0	60	FUNC	<unknown>	HIDDEN	3
__GI_exit	.symtab	0x417a30	240	FUNC	<unknown>	HIDDEN	3
__GI_fclose	.symtab	0x41b070	804	FUNC	<unknown>	HIDDEN	3
__GI_fcntl	.symtab	0x412dac	268	FUNC	<unknown>	HIDDEN	3
__GI_fflush_unlocked	.symtab	0x41ce78	940	FUNC	<unknown>	HIDDEN	3
__GI_fgetc	.symtab	0x41c930	372	FUNC	<unknown>	HIDDEN	3
__GI_fgetc_unlocked	.symtab	0x41d230	388	FUNC	<unknown>	HIDDEN	3
__GI_fgets	.symtab	0x41cab0	320	FUNC	<unknown>	HIDDEN	3
__GI_fgets_unlocked	.symtab	0x41d3c0	276	FUNC	<unknown>	HIDDEN	3
__GI_fopen	.symtab	0x41b3a0	28	FUNC	<unknown>	HIDDEN	3
__GI_fork	.symtab	0x4180d0	988	FUNC	<unknown>	HIDDEN	3
__GI_fputs_unlocked	.symtab	0x414a10	124	FUNC	<unknown>	HIDDEN	3
__GI_fseek	.symtab	0x41f310	68	FUNC	<unknown>	HIDDEN	3
__GI_fseeko64	.symtab	0x41f360	500	FUNC	<unknown>	HIDDEN	3
__GI_fstat	.symtab	0x41ee80	136	FUNC	<unknown>	HIDDEN	3
__GI_fwrite_unlocked	.symtab	0x414a90	268	FUNC	<unknown>	HIDDEN	3
__GI_getc_unlocked	.symtab	0x41d230	388	FUNC	<unknown>	HIDDEN	3
__GI_getdtablesize	.symtab	0x412f90	72	FUNC	<unknown>	HIDDEN	3
__GI_getegid	.symtab	0x41a0f0	16	FUNC	<unknown>	HIDDEN	3
__GI_geteuid	.symtab	0x41a100	16	FUNC	<unknown>	HIDDEN	3
__GI_getgid	.symtab	0x41a110	16	FUNC	<unknown>	HIDDEN	3
__GI_gethostbyname	.symtab	0x415500	28	FUNC	<unknown>	HIDDEN	3
__GI_gethostbyname2	.symtab	0x415520	104	FUNC	<unknown>	HIDDEN	3
__GI_gethostbyname2_r	.symtab	0x41dfc0	948	FUNC	<unknown>	HIDDEN	3
__GI_gethostbyname_r	.symtab	0x4218d0	968	FUNC	<unknown>	HIDDEN	3
__GI_gethostname	.symtab	0x421d00	192	FUNC	<unknown>	HIDDEN	3
__GI_getpagesize	.symtab	0x41a120	48	FUNC	<unknown>	HIDDEN	3
__GI_getpid	.symtab	0x4186d0	84	FUNC	<unknown>	HIDDEN	3
__GI_getrlimit	.symtab	0x412fe0	60	FUNC	<unknown>	HIDDEN	3
__GI_getsockname	.symtab	0x4156b0	60	FUNC	<unknown>	HIDDEN	3
__GI_getuid	.symtab	0x41a150	16	FUNC	<unknown>	HIDDEN	3
__GI_htonl	.symtab	0x4153d0	8	FUNC	<unknown>	HIDDEN	3
__GI_htons	.symtab	0x4153d8	8	FUNC	<unknown>	HIDDEN	3
__GI_inet_addr	.symtab	0x4154b0	72	FUNC	<unknown>	HIDDEN	3
__GI_inet_aton	.symtab	0x41dec0	244	FUNC	<unknown>	HIDDEN	3
__GI_inet_ntoa	.symtab	0x41548c	32	FUNC	<unknown>	HIDDEN	3
__GI_inet_ntoa_r	.symtab	0x4153e0	172	FUNC	<unknown>	HIDDEN	3
__GI_inet_ntop	.symtab	0x42012c	852	FUNC	<unknown>	HIDDEN	3
__GI_inet_pton	.symtab	0x41fcb8	696	FUNC	<unknown>	HIDDEN	3
__GI_initstate_r	.symtab	0x4175bc	300	FUNC	<unknown>	HIDDEN	3
__GI_ioctl	.symtab	0x413020	248	FUNC	<unknown>	HIDDEN	3
__GI_isatty	.symtab	0x41ddd0	60	FUNC	<unknown>	HIDDEN	3
__GI_isspace	.symtab	0x413320	44	FUNC	<unknown>	HIDDEN	3
__GI_kill	.symtab	0x413120	56	FUNC	<unknown>	HIDDEN	3
__GI_lseek64	.symtab	0x421fb0	140	FUNC	<unknown>	HIDDEN	3
__GI_memchr	.symtab	0x41d4e0	260	FUNC	<unknown>	HIDDEN	3
__GI_memcpy	.symtab	0x414ba0	308	FUNC	<unknown>	HIDDEN	3
__GI_memmove	.symtab	0x41d5f0	824	FUNC	<unknown>	HIDDEN	3
__GI_mempcpy	.symtab	0x41fa00	76	FUNC	<unknown>	HIDDEN	3
__GI_memrchr	.symtab	0x41d930	260	FUNC	<unknown>	HIDDEN	3
__GI_memset	.symtab	0x414ce0	144	FUNC	<unknown>	HIDDEN	3
__GI_mmap	.symtab	0x419f30	112	FUNC	<unknown>	HIDDEN	3
__GI_mremap	.symtab	0x41ef10	96	FUNC	<unknown>	HIDDEN	3
__GI_munmap	.symtab	0x41a160	60	FUNC	<unknown>	HIDDEN	3
__GI_nanosleep	.symtab	0x41a1dc	200	FUNC	<unknown>	HIDDEN	3
__GI_ntohl	.symtab	0x4153c0	8	FUNC	<unknown>	HIDDEN	3
__GI_ntohs	.symtab	0x4153c8	8	FUNC	<unknown>	HIDDEN	3
__GI_open	.symtab	0x418b8c	192	FUNC	<unknown>	HIDDEN	3
__GI_opendir	.symtab	0x41a654	240	FUNC	<unknown>	HIDDEN	3
__GI_poll	.symtab	0x421dfc	220	FUNC	<unknown>	HIDDEN	3
__GI_raise	.symtab	0x418730	264	FUNC	<unknown>	HIDDEN	3
__GI_random	.symtab	0x4170a0	164	FUNC	<unknown>	HIDDEN	3
__GI_random_r	.symtab	0x417380	172	FUNC	<unknown>	HIDDEN	3
__GI_rawmemchr	.symtab	0x41fa50	192	FUNC	<unknown>	HIDDEN	3
__GI_read	.symtab	0x418d8c	192	FUNC	<unknown>	HIDDEN	3
__GI_readdir64	.symtab	0x41a830	272	FUNC	<unknown>	HIDDEN	3
__GI_recv	.symtab	0x41578c	240	FUNC	<unknown>	HIDDEN	3
__GI_sbrk	.symtab	0x41a2b0	164	FUNC	<unknown>	HIDDEN	3
__GI_select	.symtab	0x4131c0	260	FUNC	<unknown>	HIDDEN	3
__GI_send	.symtab	0x4158bc	240	FUNC	<unknown>	HIDDEN	3
__GI_sendto	.symtab	0x415a20	280	FUNC	<unknown>	HIDDEN	3
__GI_setsid	.symtab	0x4132d0	60	FUNC	<unknown>	HIDDEN	3
__GI_setsockopt	.symtab	0x415b40	96	FUNC	<unknown>	HIDDEN	3
__GI_setstate_r	.symtab	0x4176e8	272	FUNC	<unknown>	HIDDEN	3
__GI_sigaction	.symtab	0x419fa0	28	FUNC	<unknown>	HIDDEN	3
__GI_signal	.symtab	0x415be0	228	FUNC	<unknown>	HIDDEN	3
__GI_sigprocmask	.symtab	0x41a360	176	FUNC	<unknown>	HIDDEN	3
__GI_sleep	.symtab	0x418840	404	FUNC	<unknown>	HIDDEN	3
__GI_snprintf	.symtab	0x4133b0	68	FUNC	<unknown>	HIDDEN	3
__GI_socket	.symtab	0x415ba0	60	FUNC	<unknown>	HIDDEN	3
__GI_sprintf	.symtab	0x413400	80	FUNC	<unknown>	HIDDEN	3
__GI_srandom_r	.symtab	0x41742c	400	FUNC	<unknown>	HIDDEN	3
__GI_stat	.symtab	0x421ee0	136	FUNC	<unknown>	HIDDEN	3
__GI_strcasecmp	.symtab	0x422680	108	FUNC	<unknown>	HIDDEN	3
__GI_strchr	.symtab	0x414d70	248	FUNC	<unknown>	HIDDEN	3
__GI_strchrnul	.symtab	0x41da40	248	FUNC	<unknown>	HIDDEN	3
__GI_strcmp	.symtab	0x414e70	44	FUNC	<unknown>	HIDDEN	3
__GI_strcoll	.symtab	0x414e70	44	FUNC	<unknown>	HIDDEN	3
__GI_strcpy	.symtab	0x414ea0	36	FUNC	<unknown>	HIDDEN	3
__GI_strcspn	.symtab	0x41db40	144	FUNC	<unknown>	HIDDEN	3
__GI_strdup	.symtab	0x422040	140	FUNC	<unknown>	HIDDEN	3
__GI_strlen	.symtab	0x414ed0	184	FUNC	<unknown>	HIDDEN	3
__GI_strncpy	.symtab	0x41fb10	188	FUNC	<unknown>	HIDDEN	3
__GI_strnlen	.symtab	0x414f90	248	FUNC	<unknown>	HIDDEN	3
__GI_strpbrk	.symtab	0x41dd90	64	FUNC	<unknown>	HIDDEN	3
__GI_strrchr	.symtab	0x41dbd0	160	FUNC	<unknown>	HIDDEN	3
__GI_strspn	.symtab	0x41dc70	72	FUNC	<unknown>	HIDDEN	3
__GI_strstr	.symtab	0x415090	256	FUNC	<unknown>	HIDDEN	3
__GI_strtok	.symtab	0x4153a0	32	FUNC	<unknown>	HIDDEN	3
__GI_strtok_r	.symtab	0x41dcc0	208	FUNC	<unknown>	HIDDEN	3
__GI_strtol	.symtab	0x417820	28	FUNC	<unknown>	HIDDEN	3
__GI_sysconf	.symtab	0x417d1c	792	FUNC	<unknown>	HIDDEN	3
__GI_tcgetattr	.symtab	0x41de10	176	FUNC	<unknown>	HIDDEN	3
__GI_time	.symtab	0x413310	16	FUNC	<unknown>	HIDDEN	3
__GI_toupper	.symtab	0x413350	60	FUNC	<unknown>	HIDDEN	3
__GI_uname	.symtab	0x421f70	60	FUNC	<unknown>	HIDDEN	3
__GI_vsnprintf	.symtab	0x413450	248	FUNC	<unknown>	HIDDEN	3
__GI_waitpid	.symtab	0x418e8c	192	FUNC	<unknown>	HIDDEN	3
__GI_wcrtomb	.symtab	0x41af00	108	FUNC	<unknown>	HIDDEN	3
__GI_wcsnrtombs	.symtab	0x41afb0	192	FUNC	<unknown>	HIDDEN	3
__GI_wcsrtombs	.symtab	0x41af70	64	FUNC	<unknown>	HIDDEN	3
__GI_write	.symtab	0x418c8c	192	FUNC	<unknown>	HIDDEN	3
__JCR_END__	.symtab	0x43a244	0	OBJECT	<unknown>	DEFAULT	10
__JCR_LIST__	.symtab	0x43a244	0	OBJECT	<unknown>	DEFAULT	10
__app_fini	.symtab	0x43fddc	4	OBJECT	<unknown>	HIDDEN	16
__atexit_lock	.symtab	0x43aee0	24	OBJECT	<unknown>	DEFAULT	12
__bss_start	.symtab	0x43b5c8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x4191cc	136	FUNC	<unknown>	DEFAULT	3
__close	.symtab	0x418a9c	176	FUNC	<unknown>	DEFAULT	3
__close_nameservers	.symtab	0x421780	220	FUNC	<unknown>	HIDDEN	3
__close_nocancel	.symtab	0x418a74	40	FUNC	<unknown>	DEFAULT	3
__ctype_b	.symtab	0x43adb4	4	OBJECT	<unknown>	DEFAULT	12
__ctype_tolower	.symtab	0x43b044	4	OBJECT	<unknown>	DEFAULT	12
__ctype_toupper	.symtab	0x43adc4	4	OBJECT	<unknown>	DEFAULT	12
__curbrk	.symtab	0x442390	4	OBJECT	<unknown>	HIDDEN	16
__data_start	.symtab	0x43aca0	0	OBJECT	<unknown>	DEFAULT	12
__decode_dotted	.symtab	0x420480	400	FUNC	<unknown>	HIDDEN	3
__decode_header	.symtab	0x4221f0	228	FUNC	<unknown>	HIDDEN	3
__deregister_frame_info	.symtab	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__dns_lookup	.symtab	0x420610	2608	FUNC	<unknown>	HIDDEN	3
__do_global_ctors_aux	.symtab	0x422830	0	FUNC	<unknown>	DEFAULT	3
__do_global_dtors_aux	.symtab	0x400180	0	FUNC	<unknown>	DEFAULT	3
__dso_handle	.symtab	0x43b5c4	0	OBJECT	<unknown>	HIDDEN	14
__encode_dotted	.symtab	0x4226f0	316	FUNC	<unknown>	HIDDEN	3
__encode_header	.symtab	0x4220d0	276	FUNC	<unknown>	HIDDEN	3
__encode_question	.symtab	0x4222e0	172	FUNC	<unknown>	HIDDEN	3
__environ	.symtab	0x43fdd4	4	OBJECT	<unknown>	DEFAULT	16
__errno_location	.symtab	0x413390	28	FUNC	<unknown>	DEFAULT	3
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x43f870	4	OBJECT	<unknown>	HIDDEN	16
__fcntl_nocancel	.symtab	0x412d40	108	FUNC	<unknown>	DEFAULT	3
__fgetc_unlocked	.symtab	0x41d230	388	FUNC	<unknown>	DEFAULT	3
__fini_array_end	.symtab	0x43a234	0	NOTYPE	<unknown>	HIDDEN	7
__fini_array_start	.symtab	0x43a234	0	NOTYPE	<unknown>	HIDDEN	7
__fork	.symtab	0x4180d0	988	FUNC	<unknown>	DEFAULT	3
__fork_generation_pointer	.symtab	0x43b5d0	4	OBJECT	<unknown>	HIDDEN	15
__fork_handlers	.symtab	0x43b5d4	4	OBJECT	<unknown>	HIDDEN	15
__fork_lock	.symtab	0x43f880	4	OBJECT	<unknown>	HIDDEN	16
__get_hosts_byname_r	.symtab	0x421860	104	FUNC	<unknown>	HIDDEN	3
__getdents64	.symtab	0x41f150	436	FUNC	<unknown>	HIDDEN	3
__getpagesize	.symtab	0x41a120	48	FUNC	<unknown>	DEFAULT	3
__getpid	.symtab	0x4186d0	84	FUNC	<unknown>	DEFAULT	3
__glibc_strerror_r	.symtab	0x415190	68	FUNC	<unknown>	DEFAULT	3
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__h_errno_location	.symtab	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__init_array_end	.symtab	0x43a234	0	NOTYPE	<unknown>	HIDDEN	7
__init_array_start	.symtab	0x43a234	0	NOTYPE	<unknown>	HIDDEN	7
__libc_close	.symtab	0x418a9c	176	FUNC	<unknown>	DEFAULT	3
__libc_connect	.symtab	0x4155cc	220	FUNC	<unknown>	DEFAULT	3
__libc_disable_asynccancel	.symtab	0x418f50	136	FUNC	<unknown>	HIDDEN	3
__libc_enable_asynccancel	.symtab	0x418fd8	220	FUNC	<unknown>	HIDDEN	3
__libc_errno	.symtab	0x0	4	TLS	<unknown>	HIDDEN	7
__libc_fcntl	.symtab	0x412dac	268	FUNC	<unknown>	DEFAULT	3
__libc_fork	.symtab	0x4180d0	988	FUNC	<unknown>	DEFAULT	3
__libc_h_errno	.symtab	0x4	4	TLS	<unknown>	HIDDEN	7
__libc_nanosleep	.symtab	0x41a1dc	200	FUNC	<unknown>	DEFAULT	3
__libc_open	.symtab	0x418b8c	192	FUNC	<unknown>	DEFAULT	3
__libc_read	.symtab	0x418d8c	192	FUNC	<unknown>	DEFAULT	3
__libc_recv	.symtab	0x41578c	240	FUNC	<unknown>	DEFAULT	3
__libc_select	.symtab	0x4131c0	260	FUNC	<unknown>	DEFAULT	3
__libc_send	.symtab	0x4158bc	240	FUNC	<unknown>	DEFAULT	3
__libc_sendto	.symtab	0x415a20	280	FUNC	<unknown>	DEFAULT	3
__libc_setup_tls	.symtab	0x41ea38	660	FUNC	<unknown>	DEFAULT	3
__libc_sigaction	.symtab	0x419fa0	28	FUNC	<unknown>	DEFAULT	3
__libc_stack_end	.symtab	0x43fdd0	4	OBJECT	<unknown>	DEFAULT	16
__libc_system	.symtab	0x419e4c	220	FUNC	<unknown>	DEFAULT	3
__libc_waitpid	.symtab	0x418e8c	192	FUNC	<unknown>	DEFAULT	3
__libc_write	.symtab	0x418c8c	192	FUNC	<unknown>	DEFAULT	3
__linkin_atfork	.symtab	0x4184b0	80	FUNC	<unknown>	HIDDEN	3
__lll_lock_wait_private	.symtab	0x4189e0	120	FUNC	<unknown>	HIDDEN	3
__local_nameserver	.symtab	0x429ed0	16	OBJECT	<unknown>	HIDDEN	5
__malloc_consolidate	.symtab	0x4169e4	520	FUNC	<unknown>	HIDDEN	3
__malloc_largebin_index	.symtab	0x415d60	140	FUNC	<unknown>	DEFAULT	3
__malloc_lock	.symtab	0x43ade0	24	OBJECT	<unknown>	DEFAULT	12
__malloc_state	.symtab	0x442430	888	OBJECT	<unknown>	DEFAULT	16
__malloc_trim	.symtab	0x4168c0	292	FUNC	<unknown>	DEFAULT	3
__nameserver	.symtab	0x43b608	4	OBJECT	<unknown>	HIDDEN	15
__nameservers	.symtab	0x43b60c	4	OBJECT	<unknown>	HIDDEN	15
__nptl_deallocate_tsd	.symtab	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__nptl_nthreads	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__open	.symtab	0x418b8c	192	FUNC	<unknown>	DEFAULT	3
__open_etc_hosts	.symtab	0x422390	32	FUNC	<unknown>	HIDDEN	3
__open_nameservers	.symtab	0x421110	1636	FUNC	<unknown>	HIDDEN	3
__open_nocancel	.symtab	0x418b64	40	FUNC	<unknown>	DEFAULT	3
__pagesize	.symtab	0x43fdd8	4	OBJECT	<unknown>	DEFAULT	16
__preinit_array_end	.symtab	0x43a234	0	NOTYPE	<unknown>	HIDDEN	7
__preinit_array_start	.symtab	0x43a234	0	NOTYPE	<unknown>	HIDDEN	7
__progname	.symtab	0x43af04	4	OBJECT	<unknown>	DEFAULT	12
__progname_full	.symtab	0x43af08	4	OBJECT	<unknown>	DEFAULT	12
__pthread_initialize_minimal	.symtab	0x41eccc	28	FUNC	<unknown>	DEFAULT	3
__pthread_mutex_init	.symtab	0x4190c8	8	FUNC	<unknown>	DEFAULT	3
__pthread_mutex_lock	.symtab	0x4190c0	8	FUNC	<unknown>	DEFAULT	3
__pthread_mutex_trylock	.symtab	0x4190c0	8	FUNC	<unknown>	DEFAULT	3
__pthread_mutex_unlock	.symtab	0x4190c0	8	FUNC	<unknown>	DEFAULT	3
__pthread_return_0	.symtab	0x4190c0	8	FUNC	<unknown>	DEFAULT	3
__pthread_unwind	.symtab	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__read	.symtab	0x418d8c	192	FUNC	<unknown>	DEFAULT	3
__read_etc_hosts_r	.symtab	0x4223b0	720	FUNC	<unknown>	HIDDEN	3
__read_nocancel	.symtab	0x418d64	40	FUNC	<unknown>	DEFAULT	3
__register_atfork	.symtab	0x418500	452	FUNC	<unknown>	DEFAULT	3
__register_frame_info	.symtab	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__res_sync	.symtab	0x43b600	4	OBJECT	<unknown>	HIDDEN	15
__resolv_attempts	.symtab	0x43b031	1	OBJECT	<unknown>	HIDDEN	12
__resolv_lock	.symtab	0x4423b0	24	OBJECT	<unknown>	DEFAULT	16
__resolv_timeout	.symtab	0x43b030	1	OBJECT	<unknown>	HIDDEN	12
__rtld_fini	.symtab	0x43fde0	4	OBJECT	<unknown>	HIDDEN	16
__searchdomain	.symtab	0x43b604	4	OBJECT	<unknown>	HIDDEN	15
__searchdomains	.symtab	0x43b610	4	OBJECT	<unknown>	HIDDEN	15
__sigaddset	.symtab	0x415cf8	44	FUNC	<unknown>	DEFAULT	3
__sigdelset	.symtab	0x415d24	48	FUNC	<unknown>	DEFAULT	3
__sigismember	.symtab	0x415cd0	40	FUNC	<unknown>	DEFAULT	3
__sigjmp_save	.symtab	0x421ca0	96	FUNC	<unknown>	HIDDEN	3
__sigsetjmp	.symtab	0x419fe0	36	FUNC	<unknown>	DEFAULT	3
__sigsetjmp_aux	.symtab	0x41ee00	128	FUNC	<unknown>	DEFAULT	3
__start	.symtab	0x4002d0	100	FUNC	<unknown>	DEFAULT	3
__stdin	.symtab	0x43af2c	4	OBJECT	<unknown>	DEFAULT	12
__stdio_READ	.symtab	0x41f560	144	FUNC	<unknown>	HIDDEN	3
__stdio_WRITE	.symtab	0x41f5f0	344	FUNC	<unknown>	HIDDEN	3
__stdio_adjust_position	.symtab	0x41f750	256	FUNC	<unknown>	HIDDEN	3
__stdio_fwrite	.symtab	0x41b850	472	FUNC	<unknown>	HIDDEN	3
__stdio_rfill	.symtab	0x41f850	88	FUNC	<unknown>	HIDDEN	3
__stdio_seek	.symtab	0x41f990	112	FUNC	<unknown>	HIDDEN	3
__stdio_trans2r_o	.symtab	0x41f8b0	220	FUNC	<unknown>	HIDDEN	3
__stdio_trans2w_o	.symtab	0x41bc90	304	FUNC	<unknown>	HIDDEN	3
__stdio_wcommit	.symtab	0x41bdc0	100	FUNC	<unknown>	HIDDEN	3
__stdout	.symtab	0x43af30	4	OBJECT	<unknown>	DEFAULT	12
__sys_connect	.symtab	0x415590	60	FUNC	<unknown>	DEFAULT	3
__sys_recv	.symtab	0x415750	60	FUNC	<unknown>	DEFAULT	3
__sys_send	.symtab	0x415880	60	FUNC	<unknown>	DEFAULT	3
__sys_sendto	.symtab	0x4159b0	112	FUNC	<unknown>	DEFAULT	3
__syscall_error	.symtab	0x41a010	92	FUNC	<unknown>	DEFAULT	3
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_nanosleep	.symtab	0x41a1a0	60	FUNC	<unknown>	DEFAULT	3
__syscall_poll	.symtab	0x421dc0	60	FUNC	<unknown>	DEFAULT	3
__syscall_rt_sigaction	.symtab	0x41a070	60	FUNC	<unknown>	DEFAULT	3
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_select	.symtab	0x413160	96	FUNC	<unknown>	DEFAULT	3
__tls_get_addr	.symtab	0x41ea18	32	FUNC	<unknown>	DEFAULT	3
__uClibc_fini	.symtab	0x419100	204	FUNC	<unknown>	DEFAULT	3
__uClibc_init	.symtab	0x419254	120	FUNC	<unknown>	DEFAULT	3
__uClibc_main	.symtab	0x4192cc	1132	FUNC	<unknown>	DEFAULT	3
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x43af00	4	OBJECT	<unknown>	HIDDEN	12
__waitpid	.symtab	0x418e8c	192	FUNC	<unknown>	DEFAULT	3
__waitpid_nocancel	.symtab	0x418e64	40	FUNC	<unknown>	DEFAULT	3
__write	.symtab	0x418c8c	192	FUNC	<unknown>	DEFAULT	3
__write_nocancel	.symtab	0x418c64	40	FUNC	<unknown>	DEFAULT	3
__xpg_strerror_r	.symtab	0x4151e0	380	FUNC	<unknown>	DEFAULT	3
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__xstat32_conv	.symtab	0x41f068	220	FUNC	<unknown>	HIDDEN	3
__xstat64_conv	.symtab	0x41ef70	248	FUNC	<unknown>	HIDDEN	3
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_bss_custom_printf_spec	.symtab	0x43f660	10	OBJECT	<unknown>	DEFAULT	16
_charpad	.symtab	0x413550	156	FUNC	<unknown>	DEFAULT	3
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_custom_printf_arginfo	.symtab	0x4423d0	40	OBJECT	<unknown>	HIDDEN	16
_custom_printf_handler	.symtab	0x4423f8	40	OBJECT	<unknown>	HIDDEN	16
_custom_printf_spec	.symtab	0x43add0	4	OBJECT	<unknown>	HIDDEN	12
_dl_aux_init	.symtab	0x41ecf0	40	FUNC	<unknown>	DEFAULT	3
_dl_init_static_tls	.symtab	0x43b010	4	OBJECT	<unknown>	DEFAULT	12
_dl_nothread_init_static_tls	.symtab	0x41ed18	148	FUNC	<unknown>	HIDDEN	3
_dl_phdr	.symtab	0x43b5f8	4	OBJECT	<unknown>	DEFAULT	15
_dl_phnum	.symtab	0x43b5fc	4	OBJECT	<unknown>	DEFAULT	15
_dl_tls_dtv_gaps	.symtab	0x43b5ec	1	OBJECT	<unknown>	DEFAULT	15
_dl_tls_dtv_slotinfo_list	.symtab	0x43b5e8	4	OBJECT	<unknown>	DEFAULT	15
_dl_tls_generation	.symtab	0x43b5f0	4	OBJECT	<unknown>	DEFAULT	15
_dl_tls_max_dtv_idx	.symtab	0x43b5e0	4	OBJECT	<unknown>	DEFAULT	15
_dl_tls_setup	.symtab	0x41e9b4	100	FUNC	<unknown>	DEFAULT	3
_dl_tls_static_align	.symtab	0x43b5dc	4	OBJECT	<unknown>	DEFAULT	15
_dl_tls_static_nelem	.symtab	0x43b5f4	4	OBJECT	<unknown>	DEFAULT	15
_dl_tls_static_size	.symtab	0x43b5e4	4	OBJECT	<unknown>	DEFAULT	15
_dl_tls_static_used	.symtab	0x43b5d8	4	OBJECT	<unknown>	DEFAULT	15
_edata	.symtab	0x43b5c8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x4427a8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_exit	.symtab	0x412ec0	76	FUNC	<unknown>	DEFAULT	3
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fbss	.symtab	0x43b5c8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_fdata	.symtab	0x43ac90	0	NOTYPE	<unknown>	DEFAULT	12
_fini	.symtab	0x4228a0	28	FUNC	<unknown>	DEFAULT	4
_fixed_buffers	.symtab	0x43fe50	8192	OBJECT	<unknown>	DEFAULT	16
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x4135ec	232	FUNC	<unknown>	DEFAULT	3
_fpmaxtostr	.symtab	0x41c060	2252	FUNC	<unknown>	HIDDEN	3
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ftext	.symtab	0x400180	0	NOTYPE	<unknown>	DEFAULT	3
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_gp	.symtab	0x443040	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_gp_disp	.symtab	0x0	0	OBJECT	<unknown>	DEFAULT	SHN_UNDEF
_init	.symtab	0x4000ec	28	FUNC	<unknown>	DEFAULT	2
_load_inttype	.symtab	0x41be30	136	FUNC	<unknown>	HIDDEN	3
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_init	.symtab	0x413f70	248	FUNC	<unknown>	HIDDEN	3
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x41437c	1684	FUNC	<unknown>	HIDDEN	3
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x414070	100	FUNC	<unknown>	HIDDEN	3
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x4140e0	548	FUNC	<unknown>	HIDDEN	3
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x414310	108	FUNC	<unknown>	DEFAULT	3
_pthread_cleanup_pop_restore	.symtab	0x4190dc	36	FUNC	<unknown>	DEFAULT	3
_pthread_cleanup_push_defer	.symtab	0x4190d0	12	FUNC	<unknown>	DEFAULT	3
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_setjmp	.symtab	0x419fc0	28	FUNC	<unknown>	DEFAULT	3
_sigintr	.symtab	0x442420	16	OBJECT	<unknown>	HIDDEN	16
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x41b3c0	1168	FUNC	<unknown>	HIDDEN	3
_stdio_init	.symtab	0x41ba30	184	FUNC	<unknown>	HIDDEN	3
_stdio_openlist	.symtab	0x43af34	4	OBJECT	<unknown>	DEFAULT	12
_stdio_openlist_add_lock	.symtab	0x43fe30	12	OBJECT	<unknown>	DEFAULT	16
_stdio_openlist_dec_use	.symtab	0x41cbf0	648	FUNC	<unknown>	HIDDEN	3
_stdio_openlist_del_count	.symtab	0x43fe4c	4	OBJECT	<unknown>	DEFAULT	16
_stdio_openlist_del_lock	.symtab	0x43fe3c	12	OBJECT	<unknown>	DEFAULT	16
_stdio_openlist_use_count	.symtab	0x43fe48	4	OBJECT	<unknown>	DEFAULT	16
_stdio_streams	.symtab	0x43af38	204	OBJECT	<unknown>	DEFAULT	12
_stdio_term	.symtab	0x41bae8	416	FUNC	<unknown>	HIDDEN	3
_stdio_user_locking	.symtab	0x43af10	4	OBJECT	<unknown>	DEFAULT	12
_stdlib_strto_l	.symtab	0x417840	488	FUNC	<unknown>	HIDDEN	3
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x41bec0	68	FUNC	<unknown>	HIDDEN	3
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x428d20	2934	OBJECT	<unknown>	HIDDEN	5
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x41bf10	332	FUNC	<unknown>	HIDDEN	3
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x4136d4	2204	FUNC	<unknown>	HIDDEN	3
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x416ee0	408	FUNC	<unknown>	DEFAULT	3
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
access	.symtab	0x412f10	60	FUNC	<unknown>	DEFAULT	3
access.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
astd	.symtab	0x4067d8	544	FUNC	<unknown>	DEFAULT	3
atcp	.symtab	0x405ec4	2324	FUNC	<unknown>	DEFAULT	3
atoi	.symtab	0x417800	28	FUNC	<unknown>	DEFAULT	3
atol	.symtab	0x417800	28	FUNC	<unknown>	DEFAULT	3
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
audp	.symtab	0x405648	2172	FUNC	<unknown>	DEFAULT	3
bcopy	.symtab	0x415360	32	FUNC	<unknown>	DEFAULT	3
bcopy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
been_there_done_that	.symtab	0x43f860	4	OBJECT	<unknown>	DEFAULT	16
bot.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
brk	.symtab	0x41edb0	80	FUNC	<unknown>	DEFAULT	3
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x415be0	228	FUNC	<unknown>	DEFAULT	3
buf.4497	.symtab	0x43f680	16	OBJECT	<unknown>	DEFAULT	16
buf.6560	.symtab	0x43f690	440	OBJECT	<unknown>	DEFAULT	16
bzero	.symtab	0x415380	28	FUNC	<unknown>	DEFAULT	3
bzero.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
c	.symtab	0x43acb4	4	OBJECT	<unknown>	DEFAULT	12
calloc	.symtab	0x41e380	344	FUNC	<unknown>	DEFAULT	3
calloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
cancel_handler	.symtab	0x419740	368	FUNC	<unknown>	DEFAULT	3
chdir	.symtab	0x412f50	56	FUNC	<unknown>	DEFAULT	3
chdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x418a9c	176	FUNC	<unknown>	DEFAULT	3
closedir	.symtab	0x41a410	292	FUNC	<unknown>	DEFAULT	3
closedir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
closenameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
commServer	.symtab	0x43acc0	4	OBJECT	<unknown>	DEFAULT	12
completed.4786	.symtab	0x43b620	1	OBJECT	<unknown>	DEFAULT	16
connect	.symtab	0x4155cc	220	FUNC	<unknown>	DEFAULT	3
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connectTimeout	.symtab	0x402058	828	FUNC	<unknown>	DEFAULT	3
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
csum	.symtab	0x402630	460	FUNC	<unknown>	DEFAULT	3
currentServer	.symtab	0x43acb0	4	OBJECT	<unknown>	DEFAULT	12
data_start	.symtab	0x43aca0	0	OBJECT	<unknown>	DEFAULT	12
decoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dnslookup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
do_system	.symtab	0x4198b0	1436	FUNC	<unknown>	DEFAULT	3
encoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ	.symtab	0x43fdd4	4	OBJECT	<unknown>	DEFAULT	16
errno	.symtab	0x0	4	TLS	<unknown>	DEFAULT	7
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
estridx	.symtab	0x428c90	126	OBJECT	<unknown>	DEFAULT	5
execve	.symtab	0x41a0b0	60	FUNC	<unknown>	DEFAULT	3
execve.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x417a30	240	FUNC	<unknown>	DEFAULT	3
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x429da8	72	OBJECT	<unknown>	DEFAULT	5
fclose	.symtab	0x41b070	804	FUNC	<unknown>	DEFAULT	3
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x412dac	268	FUNC	<unknown>	DEFAULT	3
fd_to_DIR	.symtab	0x41a540	276	FUNC	<unknown>	DEFAULT	3
fdgets	.symtab	0x400834	292	FUNC	<unknown>	DEFAULT	3
fdopendir	.symtab	0x41a744	228	FUNC	<unknown>	DEFAULT	3
fflush_unlocked	.symtab	0x41ce78	940	FUNC	<unknown>	DEFAULT	3
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc	.symtab	0x41c930	372	FUNC	<unknown>	DEFAULT	3
fgetc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x41d230	388	FUNC	<unknown>	DEFAULT	3
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x41cab0	320	FUNC	<unknown>	DEFAULT	3
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x41d3c0	276	FUNC	<unknown>	DEFAULT	3
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fmt	.symtab	0x429d90	20	OBJECT	<unknown>	DEFAULT	5
fopen	.symtab	0x41b3a0	28	FUNC	<unknown>	DEFAULT	3
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0x4180d0	988	FUNC	<unknown>	DEFAULT	3
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork_handler_pool	.symtab	0x43f884	1348	OBJECT	<unknown>	DEFAULT	16
fputs_unlocked	.symtab	0x414a10	124	FUNC	<unknown>	DEFAULT	3
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x40023c	0	FUNC	<unknown>	DEFAULT	3
free	.symtab	0x416bec	660	FUNC	<unknown>	DEFAULT	3
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x41f310	68	FUNC	<unknown>	DEFAULT	3
fseeko	.symtab	0x41f310	68	FUNC	<unknown>	DEFAULT	3
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x41f360	500	FUNC	<unknown>	DEFAULT	3
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fstat	.symtab	0x41ee80	136	FUNC	<unknown>	DEFAULT	3
fstat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ftcp	.symtab	0x403138	2324	FUNC	<unknown>	DEFAULT	3
fwrite_unlocked	.symtab	0x414a90	268	FUNC	<unknown>	DEFAULT	3
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getArch	.symtab	0x40c0f4	56	FUNC	<unknown>	DEFAULT	3
getHost	.symtab	0x401b40	160	FUNC	<unknown>	DEFAULT	3
getOurIP	.symtab	0x400958	896	FUNC	<unknown>	DEFAULT	3
getPortz	.symtab	0x40c12c	380	FUNC	<unknown>	DEFAULT	3
getRandomIP	.symtab	0x400788	172	FUNC	<unknown>	DEFAULT	3
get_hosts_byname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getc	.symtab	0x41c930	372	FUNC	<unknown>	DEFAULT	3
getc_unlocked	.symtab	0x41d230	388	FUNC	<unknown>	DEFAULT	3
getdents64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdtablesize	.symtab	0x412f90	72	FUNC	<unknown>	DEFAULT	3
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x41a0f0	16	FUNC	<unknown>	DEFAULT	3
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x41a100	16	FUNC	<unknown>	DEFAULT	3
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x41a110	16	FUNC	<unknown>	DEFAULT	3
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname	.symtab	0x415500	28	FUNC	<unknown>	DEFAULT	3
gethostbyname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname2	.symtab	0x415520	104	FUNC	<unknown>	DEFAULT	3
gethostbyname2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname2_r	.symtab	0x41dfc0	948	FUNC	<unknown>	DEFAULT	3
gethostbyname2_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r	.symtab	0x4218d0	968	FUNC	<unknown>	DEFAULT	3
gethostbyname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostname	.symtab	0x421d00	192	FUNC	<unknown>	DEFAULT	3
gethostname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpagesize	.symtab	0x41a120	48	FUNC	<unknown>	DEFAULT	3
getpagesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x4186d0	84	FUNC	<unknown>	DEFAULT	3
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x412fe0	60	FUNC	<unknown>	DEFAULT	3
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockname	.symtab	0x4156b0	60	FUNC	<unknown>	DEFAULT	3
getsockname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x4156f0	96	FUNC	<unknown>	DEFAULT	3
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x41a150	16	FUNC	<unknown>	DEFAULT	3
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gotIP	.symtab	0x43b644	4	OBJECT	<unknown>	DEFAULT	16
h_errno	.symtab	0x4	4	TLS	<unknown>	DEFAULT	7
hlt	.symtab	0x40032c	0	NOTYPE	<unknown>	DEFAULT	3
hoste.6559	.symtab	0x43f848	20	OBJECT	<unknown>	DEFAULT	16
htonl	.symtab	0x4153d0	8	FUNC	<unknown>	DEFAULT	3
htons	.symtab	0x4153d8	8	FUNC	<unknown>	DEFAULT	3
httpattack	.symtab	0x407430	1904	FUNC	<unknown>	DEFAULT	3
i.4714	.symtab	0x43acb8	4	OBJECT	<unknown>	DEFAULT	12
index	.symtab	0x414d70	248	FUNC	<unknown>	DEFAULT	3
inet_addr	.symtab	0x4154b0	72	FUNC	<unknown>	DEFAULT	3
inet_aton	.symtab	0x41dec0	244	FUNC	<unknown>	DEFAULT	3
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa	.symtab	0x41548c	32	FUNC	<unknown>	DEFAULT	3
inet_ntoa.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa_r	.symtab	0x4153e0	172	FUNC	<unknown>	DEFAULT	3
inet_ntop	.symtab	0x42012c	852	FUNC	<unknown>	DEFAULT	3
inet_ntop4	.symtab	0x41ff70	444	FUNC	<unknown>	DEFAULT	3
inet_pton	.symtab	0x41fcb8	696	FUNC	<unknown>	DEFAULT	3
inet_pton4	.symtab	0x41fbd0	232	FUNC	<unknown>	DEFAULT	3
initConnection	.symtab	0x411f10	592	FUNC	<unknown>	DEFAULT	3
init_rand	.symtab	0x400488	300	FUNC	<unknown>	DEFAULT	3
init_static_tls	.symtab	0x41e960	84	FUNC	<unknown>	DEFAULT	3
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initstate	.symtab	0x4171fc	208	FUNC	<unknown>	DEFAULT	3
initstate_r	.symtab	0x4175bc	300	FUNC	<unknown>	DEFAULT	3
intr	.symtab	0x43fdf0	28	OBJECT	<unknown>	DEFAULT	16
ioctl	.symtab	0x413020	248	FUNC	<unknown>	DEFAULT	3
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isatty	.symtab	0x41ddd0	60	FUNC	<unknown>	DEFAULT	3
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isspace	.symtab	0x413320	44	FUNC	<unknown>	DEFAULT	3
isspace.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0x413120	56	FUNC	<unknown>	DEFAULT	3
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
last_id.6617	.symtab	0x43b020	2	OBJECT	<unknown>	DEFAULT	12
last_ns_num.6616	.symtab	0x4423a0	4	OBJECT	<unknown>	DEFAULT	16
libc-cancellation.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc-lowlevellock.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc-tls.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
listFork	.symtab	0x402394	668	FUNC	<unknown>	DEFAULT	3
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lock	.symtab	0x43fe2c	4	OBJECT	<unknown>	DEFAULT	16
lseek64	.symtab	0x421fb0	140	FUNC	<unknown>	DEFAULT	3
macAddress	.symtab	0x43b650	6	OBJECT	<unknown>	DEFAULT	16
main	.symtab	0x412160	3036	FUNC	<unknown>	DEFAULT	3
mainCommSock	.symtab	0x43b640	4	OBJECT	<unknown>	DEFAULT	16
makeIPPacket	.symtab	0x402958	312	FUNC	<unknown>	DEFAULT	3
makeRandomStr	.symtab	0x401be0	268	FUNC	<unknown>	DEFAULT	3
makevsepacket	.symtab	0x403e3c	348	FUNC	<unknown>	DEFAULT	3
malloc	.symtab	0x415dec	2764	FUNC	<unknown>	DEFAULT	3
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
malloc_trim	.symtab	0x416e80	84	FUNC	<unknown>	DEFAULT	3
memchr	.symtab	0x41d4e0	260	FUNC	<unknown>	DEFAULT	3
memchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memcpy	.symtab	0x414ba0	308	FUNC	<unknown>	DEFAULT	3
memmove	.symtab	0x41d5f0	824	FUNC	<unknown>	DEFAULT	3
memmove.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mempcpy	.symtab	0x41fa00	76	FUNC	<unknown>	DEFAULT	3
mempcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memrchr	.symtab	0x41d930	260	FUNC	<unknown>	DEFAULT	3
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x414ce0	144	FUNC	<unknown>	DEFAULT	3
mmap	.symtab	0x419f30	112	FUNC	<unknown>	DEFAULT	3
mmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mremap	.symtab	0x41ef10	96	FUNC	<unknown>	DEFAULT	3
mremap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
munmap	.symtab	0x41a160	60	FUNC	<unknown>	DEFAULT	3
munmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mylock	.symtab	0x43ae00	24	OBJECT	<unknown>	DEFAULT	12
mylock	.symtab	0x43ae20	24	OBJECT	<unknown>	DEFAULT	12
nanosleep	.symtab	0x41a1dc	200	FUNC	<unknown>	DEFAULT	3
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
next_start.1303	.symtab	0x43f670	4	OBJECT	<unknown>	DEFAULT	16
nprocessors_onln	.symtab	0x417b20	508	FUNC	<unknown>	DEFAULT	3
ntohl	.symtab	0x4153c0	8	FUNC	<unknown>	DEFAULT	3
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0x4153c8	8	FUNC	<unknown>	DEFAULT	3
ntop.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
numpids	.symtab	0x43b648	8	OBJECT	<unknown>	DEFAULT	16
object.4798	.symtab	0x43b624	24	OBJECT	<unknown>	DEFAULT	16
open	.symtab	0x418b8c	192	FUNC	<unknown>	DEFAULT	3
opendir	.symtab	0x41a654	240	FUNC	<unknown>	DEFAULT	3
opendir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opennameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ourIP	.symtab	0x43b5c8	4	OBJECT	<unknown>	DEFAULT	15
p.4784	.symtab	0x43ac90	0	OBJECT	<unknown>	DEFAULT	12
parse_config.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pids	.symtab	0x43b5cc	4	OBJECT	<unknown>	DEFAULT	15
poll	.symtab	0x421dfc	220	FUNC	<unknown>	DEFAULT	3
poll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prefix.6318	.symtab	0x428be0	12	OBJECT	<unknown>	DEFAULT	5
print	.symtab	0x401434	1460	FUNC	<unknown>	DEFAULT	3
printchar	.symtab	0x400ea4	184	FUNC	<unknown>	DEFAULT	3
printi	.symtab	0x401198	668	FUNC	<unknown>	DEFAULT	3
prints	.symtab	0x400f5c	572	FUNC	<unknown>	DEFAULT	3
processCmd	.symtab	0x40c2a8	23400	FUNC	<unknown>	DEFAULT	3
program_invocation_name	.symtab	0x43af08	4	OBJECT	<unknown>	DEFAULT	12
program_invocation_short_name	.symtab	0x43af04	4	OBJECT	<unknown>	DEFAULT	12
qual_chars.6326	.symtab	0x428c00	20	OBJECT	<unknown>	DEFAULT	5
quit	.symtab	0x43fe0c	28	OBJECT	<unknown>	DEFAULT	16
raise	.symtab	0x418730	264	FUNC	<unknown>	DEFAULT	3
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x417080	28	FUNC	<unknown>	DEFAULT	3
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand_cmwc	.symtab	0x4005b4	468	FUNC	<unknown>	DEFAULT	3
random	.symtab	0x4170a0	164	FUNC	<unknown>	DEFAULT	3
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x4298a0	40	OBJECT	<unknown>	DEFAULT	5
random_r	.symtab	0x417380	172	FUNC	<unknown>	DEFAULT	3
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randtbl	.symtab	0x43ae38	128	OBJECT	<unknown>	DEFAULT	12
rawmemchr	.symtab	0x41fa50	192	FUNC	<unknown>	DEFAULT	3
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read	.symtab	0x418d8c	192	FUNC	<unknown>	DEFAULT	3
read_etc_hosts_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
readdir64	.symtab	0x41a830	272	FUNC	<unknown>	DEFAULT	3
readdir64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
realloc	.symtab	0x41e4e0	1152	FUNC	<unknown>	DEFAULT	3
realloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
realrand	.symtab	0x411e10	256	FUNC	<unknown>	DEFAULT	3
recv	.symtab	0x41578c	240	FUNC	<unknown>	DEFAULT	3
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recvLine	.symtab	0x401cec	876	FUNC	<unknown>	DEFAULT	3
register-atfork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
resolv_conf_mtime.6599	.symtab	0x4423c8	4	OBJECT	<unknown>	DEFAULT	16
rindex	.symtab	0x41dbd0	160	FUNC	<unknown>	DEFAULT	3
rtcp	.symtab	0x404f7c	1740	FUNC	<unknown>	DEFAULT	3
sa_refcntr	.symtab	0x43fe28	4	OBJECT	<unknown>	DEFAULT	16
sbrk	.symtab	0x41a2b0	164	FUNC	<unknown>	DEFAULT	3
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
select	.symtab	0x4131c0	260	FUNC	<unknown>	DEFAULT	3
select.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send	.symtab	0x4158bc	240	FUNC	<unknown>	DEFAULT	3
send.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sendHLD	.symtab	0x40b96c	1928	FUNC	<unknown>	DEFAULT	3
sendHTTPtwo	.symtab	0x406ca4	684	FUNC	<unknown>	DEFAULT	3
sendKILLALL	.symtab	0x40958c	1208	FUNC	<unknown>	DEFAULT	3
sendPkt	.symtab	0x40b2c0	644	FUNC	<unknown>	DEFAULT	3
sendTLS	.symtab	0x40ac0c	1716	FUNC	<unknown>	DEFAULT	3
senditbudAMP	.symtab	0x400340	328	FUNC	<unknown>	DEFAULT	3
sendnfo	.symtab	0x409c5c	536	FUNC	<unknown>	DEFAULT	3
sendto	.symtab	0x415a20	280	FUNC	<unknown>	DEFAULT	3
sendto.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setjmp_aux.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsid	.symtab	0x4132d0	60	FUNC	<unknown>	DEFAULT	3
setsid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsockopt	.symtab	0x415b40	96	FUNC	<unknown>	DEFAULT	3
setsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate	.symtab	0x417144	184	FUNC	<unknown>	DEFAULT	3
setstate_r	.symtab	0x4176e8	272	FUNC	<unknown>	DEFAULT	3
sigaction	.symtab	0x419fa0	28	FUNC	<unknown>	DEFAULT	3
sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigjmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
signal	.symtab	0x415be0	228	FUNC	<unknown>	DEFAULT	3
signal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigprocmask	.symtab	0x41a360	176	FUNC	<unknown>	DEFAULT	3
sigprocmask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigsetops.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
skip_and_NUL_space	.symtab	0x4210a8	104	FUNC	<unknown>	DEFAULT	3
skip_nospace	.symtab	0x421040	104	FUNC	<unknown>	DEFAULT	3
sleep	.symtab	0x418840	404	FUNC	<unknown>	DEFAULT	3
sleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
snprintf	.symtab	0x4133b0	68	FUNC	<unknown>	DEFAULT	3
snprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket	.symtab	0x415ba0	60	FUNC	<unknown>	DEFAULT	3
socket.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket_connect	.symtab	0x403c80	444	FUNC	<unknown>	DEFAULT	3
sockprintf	.symtab	0x4019e8	344	FUNC	<unknown>	DEFAULT	3
spec_and_mask.6325	.symtab	0x428c14	16	OBJECT	<unknown>	DEFAULT	5
spec_base.6317	.symtab	0x428bec	7	OBJECT	<unknown>	DEFAULT	5
spec_chars.6322	.symtab	0x428c70	21	OBJECT	<unknown>	DEFAULT	5
spec_flags.6321	.symtab	0x428c88	8	OBJECT	<unknown>	DEFAULT	5
spec_or_mask.6324	.symtab	0x428c24	16	OBJECT	<unknown>	DEFAULT	5
spec_ranges.6323	.symtab	0x428c34	9	OBJECT	<unknown>	DEFAULT	5
sprintf	.symtab	0x413400	80	FUNC	<unknown>	DEFAULT	3
sprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
srand	.symtab	0x4172cc	172	FUNC	<unknown>	DEFAULT	3
srandom	.symtab	0x4172cc	172	FUNC	<unknown>	DEFAULT	3
srandom_r	.symtab	0x41742c	400	FUNC	<unknown>	DEFAULT	3
stat	.symtab	0x421ee0	136	FUNC	<unknown>	DEFAULT	3
stat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
static_dtv	.symtab	0x441e50	512	OBJECT	<unknown>	DEFAULT	16
static_map	.symtab	0x442358	52	OBJECT	<unknown>	DEFAULT	16
static_slotinfo	.symtab	0x442050	776	OBJECT	<unknown>	DEFAULT	16
stderr	.symtab	0x43af28	4	OBJECT	<unknown>	DEFAULT	12
stdhexflood	.symtab	0x404b10	536	FUNC	<unknown>	DEFAULT	3
stdin	.symtab	0x43af20	4	OBJECT	<unknown>	DEFAULT	12
stdout	.symtab	0x43af24	4	OBJECT	<unknown>	DEFAULT	12
strcasecmp	.symtab	0x422680	108	FUNC	<unknown>	DEFAULT	3
strcasecmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchr	.symtab	0x414d70	248	FUNC	<unknown>	DEFAULT	3
strchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchrnul	.symtab	0x41da40	248	FUNC	<unknown>	DEFAULT	3
strchrnul.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcmp	.symtab	0x414e70	44	FUNC	<unknown>	DEFAULT	3
strcmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcoll	.symtab	0x414e70	44	FUNC	<unknown>	DEFAULT	3
strcpy	.symtab	0x414ea0	36	FUNC	<unknown>	DEFAULT	3
strcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcspn	.symtab	0x41db40	144	FUNC	<unknown>	DEFAULT	3
strcspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strdup	.symtab	0x422040	140	FUNC	<unknown>	DEFAULT	3
strdup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strerror_r	.symtab	0x4151e0	380	FUNC	<unknown>	DEFAULT	3
strlen	.symtab	0x414ed0	184	FUNC	<unknown>	DEFAULT	3
strlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncpy	.symtab	0x41fb10	188	FUNC	<unknown>	DEFAULT	3
strncpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strnlen	.symtab	0x414f90	248	FUNC	<unknown>	DEFAULT	3
strnlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strpbrk	.symtab	0x41dd90	64	FUNC	<unknown>	DEFAULT	3
strpbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strrchr	.symtab	0x41dbd0	160	FUNC	<unknown>	DEFAULT	3
strrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strspn	.symtab	0x41dc70	72	FUNC	<unknown>	DEFAULT	3
strspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strstr	.symtab	0x415090	256	FUNC	<unknown>	DEFAULT	3
strstr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok	.symtab	0x4153a0	32	FUNC	<unknown>	DEFAULT	3
strtok.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok_r	.symtab	0x41dcc0	208	FUNC	<unknown>	DEFAULT	3
strtok_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtol	.symtab	0x417820	28	FUNC	<unknown>	DEFAULT	3
strtol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sysconf	.symtab	0x417d1c	792	FUNC	<unknown>	DEFAULT	3
sysconf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
system	.symtab	0x419e4c	220	FUNC	<unknown>	DEFAULT	3
system.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcgetattr	.symtab	0x41de10	176	FUNC	<unknown>	DEFAULT	3
tcgetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcpcsum	.symtab	0x4027fc	348	FUNC	<unknown>	DEFAULT	3
time	.symtab	0x413310	16	FUNC	<unknown>	DEFAULT	3
time.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
toupper	.symtab	0x413350	60	FUNC	<unknown>	DEFAULT	3
toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
trim	.symtab	0x400cd8	460	FUNC	<unknown>	DEFAULT	3
type_codes	.symtab	0x428c40	24	OBJECT	<unknown>	DEFAULT	5
type_sizes	.symtab	0x428c58	12	OBJECT	<unknown>	DEFAULT	5
uname	.symtab	0x421f70	60	FUNC	<unknown>	DEFAULT	3
uname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
unknown.1327	.symtab	0x428d10	14	OBJECT	<unknown>	DEFAULT	5
unsafe_state	.symtab	0x43aec0	20	OBJECT	<unknown>	DEFAULT	12
useragents	.symtab	0x43acc4	236	OBJECT	<unknown>	DEFAULT	12
usleep	.symtab	0x418040	144	FUNC	<unknown>	DEFAULT	3
usleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
vseattack	.symtab	0x403f98	2412	FUNC	<unknown>	DEFAULT	3
vsnprintf	.symtab	0x413450	248	FUNC	<unknown>	DEFAULT	3
vsnprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
waitpid	.symtab	0x418e8c	192	FUNC	<unknown>	DEFAULT	3
wcrtomb	.symtab	0x41af00	108	FUNC	<unknown>	DEFAULT	3
wcrtomb.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsnrtombs	.symtab	0x41afb0	192	FUNC	<unknown>	DEFAULT	3
wcsnrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsrtombs	.symtab	0x41af70	64	FUNC	<unknown>	DEFAULT	3
wcsrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
write	.symtab	0x418c8c	192	FUNC	<unknown>	DEFAULT	3
xdigits.4935	.symtab	0x429e64	17	OBJECT	<unknown>	DEFAULT	5
xstatconv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
xtdcustom	.symtab	0x40a12c	536	FUNC	<unknown>	DEFAULT	3

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-08T21:07:14.648832+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56324	162.215.219.170	4444	TCP
2024-10-08T21:07:16.363499+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56326	162.215.219.170	4444	TCP
2024-10-08T21:07:17.919635+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56328	162.215.219.170	4444	TCP
2024-10-08T21:07:19.487360+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56330	162.215.219.170	4444	TCP
2024-10-08T21:07:21.341350+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56332	162.215.219.170	4444	TCP
2024-10-08T21:07:22.905497+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56334	162.215.219.170	4444	TCP
2024-10-08T21:07:24.504334+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56336	162.215.219.170	4444	TCP
2024-10-08T21:07:26.101426+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56338	162.215.219.170	4444	TCP
2024-10-08T21:07:27.691002+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56340	162.215.219.170	4444	TCP
2024-10-08T21:07:29.248021+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56342	162.215.219.170	4444	TCP
2024-10-08T21:07:30.831358+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56344	162.215.219.170	4444	TCP
2024-10-08T21:07:32.393681+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56346	162.215.219.170	4444	TCP
2024-10-08T21:07:34.355539+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56348	162.215.219.170	4444	TCP
2024-10-08T21:07:35.903760+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56350	162.215.219.170	4444	TCP
2024-10-08T21:07:37.473383+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56352	162.215.219.170	4444	TCP
2024-10-08T21:07:39.063960+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56354	162.215.219.170	4444	TCP
2024-10-08T21:07:40.707367+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56356	162.215.219.170	4444	TCP
2024-10-08T21:07:42.280833+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56358	162.215.219.170	4444	TCP
2024-10-08T21:07:43.902679+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56360	162.215.219.170	4444	TCP
2024-10-08T21:07:45.472026+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56362	162.215.219.170	4444	TCP
2024-10-08T21:07:47.064139+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56364	162.215.219.170	4444	TCP
2024-10-08T21:07:48.624842+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56366	162.215.219.170	4444	TCP
2024-10-08T21:07:50.207299+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56368	162.215.219.170	4444	TCP
2024-10-08T21:07:51.785968+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56370	162.215.219.170	4444	TCP
2024-10-08T21:07:53.377473+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56372	162.215.219.170	4444	TCP
2024-10-08T21:07:54.957501+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56374	162.215.219.170	4444	TCP
2024-10-08T21:07:56.536651+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56376	162.215.219.170	4444	TCP
2024-10-08T21:07:58.145787+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56378	162.215.219.170	4444	TCP
2024-10-08T21:07:59.725763+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56380	162.215.219.170	4444	TCP
2024-10-08T21:08:02.016188+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56382	162.215.219.170	4444	TCP
2024-10-08T21:08:03.936465+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56384	162.215.219.170	4444	TCP
2024-10-08T21:08:05.859379+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56386	162.215.219.170	4444	TCP
2024-10-08T21:08:07.425075+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56388	162.215.219.170	4444	TCP
2024-10-08T21:08:08.984797+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56390	162.215.219.170	4444	TCP
2024-10-08T21:08:10.553478+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56392	162.215.219.170	4444	TCP
2024-10-08T21:08:12.141848+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56394	162.215.219.170	4444	TCP
2024-10-08T21:08:13.716251+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56396	162.215.219.170	4444	TCP
2024-10-08T21:08:15.286873+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56398	162.215.219.170	4444	TCP
2024-10-08T21:08:16.844449+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56400	162.215.219.170	4444	TCP
2024-10-08T21:08:18.421203+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56402	162.215.219.170	4444	TCP
2024-10-08T21:08:19.989330+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56404	162.215.219.170	4444	TCP
2024-10-08T21:08:21.561787+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56406	162.215.219.170	4444	TCP
2024-10-08T21:08:23.140874+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56408	162.215.219.170	4444	TCP
2024-10-08T21:08:24.909280+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56410	162.215.219.170	4444	TCP
2024-10-08T21:08:26.504556+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56412	162.215.219.170	4444	TCP
2024-10-08T21:08:28.216560+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56414	162.215.219.170	4444	TCP
2024-10-08T21:08:29.786493+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56416	162.215.219.170	4444	TCP
2024-10-08T21:08:32.121698+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56418	162.215.219.170	4444	TCP
2024-10-08T21:08:33.751910+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56420	162.215.219.170	4444	TCP
2024-10-08T21:08:35.377465+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56422	162.215.219.170	4444	TCP
2024-10-08T21:08:36.954459+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56424	162.215.219.170	4444	TCP
2024-10-08T21:08:38.536703+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56426	162.215.219.170	4444	TCP
2024-10-08T21:08:40.109095+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56428	162.215.219.170	4444	TCP
2024-10-08T21:08:41.702718+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56430	162.215.219.170	4444	TCP
2024-10-08T21:08:43.295914+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56432	162.215.219.170	4444	TCP
2024-10-08T21:08:44.874124+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56434	162.215.219.170	4444	TCP
2024-10-08T21:08:46.441579+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56436	162.215.219.170	4444	TCP
2024-10-08T21:08:48.038456+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56438	162.215.219.170	4444	TCP
2024-10-08T21:08:49.629880+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56440	162.215.219.170	4444	TCP
2024-10-08T21:08:51.187329+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56442	162.215.219.170	4444	TCP
2024-10-08T21:08:52.770352+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56444	162.215.219.170	4444	TCP
2024-10-08T21:08:54.330659+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56446	162.215.219.170	4444	TCP
2024-10-08T21:08:55.891444+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56448	162.215.219.170	4444	TCP
2024-10-08T21:08:57.473829+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56450	162.215.219.170	4444	TCP
2024-10-08T21:08:59.068630+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56452	162.215.219.170	4444	TCP
2024-10-08T21:09:00.675879+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56454	162.215.219.170	4444	TCP
2024-10-08T21:09:02.271875+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56456	162.215.219.170	4444	TCP
2024-10-08T21:09:04.079411+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56458	162.215.219.170	4444	TCP
2024-10-08T21:09:05.642286+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56460	162.215.219.170	4444	TCP
2024-10-08T21:09:07.207000+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56462	162.215.219.170	4444	TCP
2024-10-08T21:09:08.767003+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56464	162.215.219.170	4444	TCP
2024-10-08T21:09:10.345652+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56466	162.215.219.170	4444	TCP
2024-10-08T21:09:12.119893+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56468	162.215.219.170	4444	TCP
2024-10-08T21:09:13.766002+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56470	162.215.219.170	4444	TCP
2024-10-08T21:09:15.348847+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56472	162.215.219.170	4444	TCP
2024-10-08T21:09:16.909991+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56474	162.215.219.170	4444	TCP
2024-10-08T21:09:18.486129+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56476	162.215.219.170	4444	TCP
2024-10-08T21:09:20.080899+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56478	162.215.219.170	4444	TCP
2024-10-08T21:09:21.707126+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56480	162.215.219.170	4444	TCP
2024-10-08T21:09:23.287345+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56482	162.215.219.170	4444	TCP
2024-10-08T21:09:24.864079+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56484	162.215.219.170	4444	TCP
2024-10-08T21:09:26.443968+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56486	162.215.219.170	4444	TCP
2024-10-08T21:09:28.020160+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56488	162.215.219.170	4444	TCP
2024-10-08T21:09:29.579569+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56490	162.215.219.170	4444	TCP
2024-10-08T21:09:31.163832+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56492	162.215.219.170	4444	TCP
2024-10-08T21:09:32.756673+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56494	162.215.219.170	4444	TCP
2024-10-08T21:09:34.326387+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56496	162.215.219.170	4444	TCP
2024-10-08T21:09:35.893114+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56498	162.215.219.170	4444	TCP
2024-10-08T21:09:37.456462+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56500	162.215.219.170	4444	TCP
2024-10-08T21:09:39.017444+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56502	162.215.219.170	4444	TCP
2024-10-08T21:09:40.841462+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56504	162.215.219.170	4444	TCP
2024-10-08T21:09:42.407007+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56506	162.215.219.170	4444	TCP
2024-10-08T21:09:43.987394+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56508	162.215.219.170	4444	TCP
2024-10-08T21:09:45.551973+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56510	162.215.219.170	4444	TCP
2024-10-08T21:09:47.117485+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56512	162.215.219.170	4444	TCP
2024-10-08T21:09:48.698252+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56514	162.215.219.170	4444	TCP
2024-10-08T21:09:50.254212+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56516	162.215.219.170	4444	TCP
2024-10-08T21:09:52.131928+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56518	162.215.219.170	4444	TCP
2024-10-08T21:09:53.701174+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56520	162.215.219.170	4444	TCP
2024-10-08T21:09:55.319875+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56522	162.215.219.170	4444	TCP
2024-10-08T21:09:56.894017+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56524	162.215.219.170	4444	TCP
2024-10-08T21:09:58.454554+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56526	162.215.219.170	4444	TCP
2024-10-08T21:10:00.035119+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56528	162.215.219.170	4444	TCP
2024-10-08T21:10:01.600148+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56530	162.215.219.170	4444	TCP
2024-10-08T21:10:03.342476+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56532	162.215.219.170	4444	TCP
2024-10-08T21:10:04.892137+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56534	162.215.219.170	4444	TCP
2024-10-08T21:10:06.457873+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56536	162.215.219.170	4444	TCP
2024-10-08T21:10:08.092780+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56538	162.215.219.170	4444	TCP
2024-10-08T21:10:09.705419+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56540	162.215.219.170	4444	TCP
2024-10-08T21:10:12.110134+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56542	162.215.219.170	4444	TCP
2024-10-08T21:10:13.713139+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56544	162.215.219.170	4444	TCP
2024-10-08T21:10:15.291361+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56546	162.215.219.170	4444	TCP
2024-10-08T21:10:16.893911+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56548	162.215.219.170	4444	TCP
2024-10-08T21:10:18.490056+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56550	162.215.219.170	4444	TCP
2024-10-08T21:10:20.201887+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56552	162.215.219.170	4444	TCP
2024-10-08T21:10:21.769765+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56554	162.215.219.170	4444	TCP
2024-10-08T21:10:23.329450+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56556	162.215.219.170	4444	TCP
2024-10-08T21:10:24.937771+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56558	162.215.219.170	4444	TCP
2024-10-08T21:10:26.502712+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56560	162.215.219.170	4444	TCP
2024-10-08T21:10:28.082278+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56562	162.215.219.170	4444	TCP
2024-10-08T21:10:29.643273+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56564	162.215.219.170	4444	TCP
2024-10-08T21:10:31.254043+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56566	162.215.219.170	4444	TCP
2024-10-08T21:10:33.738497+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56568	162.215.219.170	4444	TCP
2024-10-08T21:10:35.317742+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56570	162.215.219.170	4444	TCP
2024-10-08T21:10:36.876663+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56572	162.215.219.170	4444	TCP
2024-10-08T21:10:38.439459+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56574	162.215.219.170	4444	TCP
2024-10-08T21:10:40.002313+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56576	162.215.219.170	4444	TCP
2024-10-08T21:10:41.565206+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56578	162.215.219.170	4444	TCP
2024-10-08T21:10:43.146757+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56580	162.215.219.170	4444	TCP
2024-10-08T21:10:44.736494+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56582	162.215.219.170	4444	TCP
2024-10-08T21:10:46.320963+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56584	162.215.219.170	4444	TCP
2024-10-08T21:10:47.899308+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	56586	162.215.219.170	4444	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 21:07:14.030719995 CEST	43928	443	192.168.2.23	91.189.91.42
Oct 8, 2024 21:07:14.642008066 CEST	56324	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:14.647031069 CEST	4444	56324	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:14.647130966 CEST	56324	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:14.648832083 CEST	56324	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:14.653909922 CEST	4444	56324	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:16.357498884 CEST	4444	56324	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:16.357839108 CEST	56324	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:16.358316898 CEST	56326	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:16.362904072 CEST	4444	56324	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:16.363121033 CEST	4444	56326	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:16.363163948 CEST	56326	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:16.363498926 CEST	56326	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:16.369077921 CEST	4444	56326	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:17.913192034 CEST	4444	56326	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:17.913517952 CEST	56326	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:17.914211988 CEST	56328	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:17.918473005 CEST	4444	56326	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:17.919539928 CEST	4444	56328	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:17.919593096 CEST	56328	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:17.919635057 CEST	56328	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:17.925211906 CEST	4444	56328	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:19.481448889 CEST	4444	56328	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:19.481782913 CEST	56328	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:19.482237101 CEST	56330	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:19.486960888 CEST	4444	56328	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:19.487256050 CEST	4444	56330	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:19.487309933 CEST	56330	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:19.487360001 CEST	56330	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:19.492752075 CEST	4444	56330	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:19.661971092 CEST	42836	443	192.168.2.23	91.189.91.43
Oct 8, 2024 21:07:21.197818995 CEST	42516	80	192.168.2.23	109.202.202.202
Oct 8, 2024 21:07:21.334937096 CEST	4444	56330	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:21.335156918 CEST	56330	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:21.335304976 CEST	4444	56330	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:21.335355043 CEST	56330	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:21.335680008 CEST	56332	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:21.340203047 CEST	4444	56330	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:21.341212988 CEST	4444	56332	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:21.341301918 CEST	56332	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:21.341350079 CEST	56332	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:21.346204996 CEST	4444	56332	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:22.899928093 CEST	4444	56332	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:22.900113106 CEST	56332	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:22.900538921 CEST	56334	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:22.904980898 CEST	4444	56332	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:22.905397892 CEST	4444	56334	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:22.905436039 CEST	56334	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:22.905497074 CEST	56334	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:22.910367012 CEST	4444	56334	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:24.498153925 CEST	4444	56334	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:24.498313904 CEST	56334	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:24.499027014 CEST	56336	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:24.503267050 CEST	4444	56334	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:24.504180908 CEST	4444	56336	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:24.504283905 CEST	56336	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:24.504333973 CEST	56336	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:24.509258986 CEST	4444	56336	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:26.091561079 CEST	4444	56336	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:26.091905117 CEST	56336	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:26.092775106 CEST	56338	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:26.100223064 CEST	4444	56336	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:26.101248980 CEST	4444	56338	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:26.101327896 CEST	56338	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:26.101425886 CEST	56338	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:26.107575893 CEST	4444	56338	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:27.684209108 CEST	4444	56338	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:27.684555054 CEST	56338	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:27.685483932 CEST	56340	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:27.689802885 CEST	4444	56338	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:27.690792084 CEST	4444	56340	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:27.690921068 CEST	56340	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:27.691001892 CEST	56340	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:27.697076082 CEST	4444	56340	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:29.241987944 CEST	4444	56340	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:29.242240906 CEST	56340	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:29.242791891 CEST	56342	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:29.247262955 CEST	4444	56340	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:29.247876883 CEST	4444	56342	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:29.247977972 CEST	56342	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:29.248020887 CEST	56342	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:29.253463984 CEST	4444	56342	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:30.824357033 CEST	4444	56342	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:30.824783087 CEST	56342	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:30.825479031 CEST	56344	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:30.830501080 CEST	4444	56342	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:30.831182957 CEST	4444	56344	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:30.831254959 CEST	56344	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:30.831357956 CEST	56344	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:30.836345911 CEST	4444	56344	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:32.386715889 CEST	4444	56344	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:32.387005091 CEST	56344	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:32.388233900 CEST	56346	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:32.391836882 CEST	4444	56344	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:32.393521070 CEST	4444	56346	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:32.393591881 CEST	56346	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:32.393681049 CEST	56346	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:32.398704052 CEST	4444	56346	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:34.349386930 CEST	4444	56346	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:34.349606037 CEST	56346	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:34.349783897 CEST	4444	56346	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:34.349836111 CEST	56346	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:34.350136995 CEST	56348	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:34.355396986 CEST	4444	56346	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:34.355410099 CEST	4444	56348	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:34.355483055 CEST	56348	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:34.355539083 CEST	56348	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:34.363609076 CEST	4444	56348	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:34.763885021 CEST	43928	443	192.168.2.23	91.189.91.42
Oct 8, 2024 21:07:35.897322893 CEST	4444	56348	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:35.897625923 CEST	56348	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:35.898348093 CEST	56350	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:35.902436018 CEST	4444	56348	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:35.903626919 CEST	4444	56350	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:35.903697968 CEST	56350	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:35.903759956 CEST	56350	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:35.909176111 CEST	4444	56350	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:37.466419935 CEST	4444	56350	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:37.466751099 CEST	56350	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:37.467226982 CEST	56352	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:37.472574949 CEST	4444	56350	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:37.473191023 CEST	4444	56352	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:37.473299026 CEST	56352	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:37.473382950 CEST	56352	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:37.478494883 CEST	4444	56352	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:39.058455944 CEST	4444	56352	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:39.058609009 CEST	56352	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:39.059060097 CEST	56354	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:39.063616037 CEST	4444	56352	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:39.063868999 CEST	4444	56354	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:39.063913107 CEST	56354	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:39.063960075 CEST	56354	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:39.069300890 CEST	4444	56354	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:40.701204062 CEST	4444	56354	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:40.701467991 CEST	56354	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:40.701925039 CEST	56356	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:40.706815004 CEST	4444	56354	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:40.707267046 CEST	4444	56356	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:40.707308054 CEST	56356	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:40.707366943 CEST	56356	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:40.712233067 CEST	4444	56356	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:42.273483992 CEST	4444	56356	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:42.273899078 CEST	56356	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:42.275147915 CEST	56358	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:42.278898954 CEST	4444	56356	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:42.280572891 CEST	4444	56358	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:42.280657053 CEST	56358	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:42.280833006 CEST	56358	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:42.285700083 CEST	4444	56358	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:43.892874956 CEST	4444	56358	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:43.893209934 CEST	56358	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:43.893877029 CEST	56360	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:43.901577950 CEST	4444	56358	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:43.902477026 CEST	4444	56360	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:43.902558088 CEST	56360	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:43.902678967 CEST	56360	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:43.910278082 CEST	4444	56360	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:45.465811968 CEST	4444	56360	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:45.466331005 CEST	56360	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:45.466981888 CEST	56362	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:45.471518993 CEST	4444	56360	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:45.471880913 CEST	4444	56362	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:45.471946955 CEST	56362	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:45.472026110 CEST	56362	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:45.477154016 CEST	4444	56362	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:47.050215960 CEST	42836	443	192.168.2.23	91.189.91.43
Oct 8, 2024 21:07:47.058309078 CEST	4444	56362	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:47.058495045 CEST	56362	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:47.058926105 CEST	56364	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:47.063426971 CEST	4444	56362	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:47.064043999 CEST	4444	56364	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:47.064097881 CEST	56364	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:47.064138889 CEST	56364	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:47.069593906 CEST	4444	56364	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:48.618043900 CEST	4444	56364	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:48.618383884 CEST	56364	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:48.618944883 CEST	56366	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:48.624037027 CEST	4444	56364	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:48.624639034 CEST	4444	56366	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:48.624706030 CEST	56366	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:48.624841928 CEST	56366	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:48.631591082 CEST	4444	56366	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:50.200787067 CEST	4444	56366	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:50.201028109 CEST	56366	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:50.201930046 CEST	56368	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:50.206058025 CEST	4444	56366	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:50.207115889 CEST	4444	56368	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:50.207197905 CEST	56368	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:50.207298994 CEST	56368	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:50.213650942 CEST	4444	56368	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:51.145586014 CEST	42516	80	192.168.2.23	109.202.202.202
Oct 8, 2024 21:07:51.779556990 CEST	4444	56368	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:51.779818058 CEST	56368	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:51.780333042 CEST	56370	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:51.785820007 CEST	4444	56368	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:51.785830975 CEST	4444	56370	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:51.785934925 CEST	56370	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:51.785968065 CEST	56370	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:51.791147947 CEST	4444	56370	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:53.371253014 CEST	4444	56370	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:53.371608973 CEST	56370	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:53.372293949 CEST	56372	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:53.376413107 CEST	4444	56370	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:53.377300024 CEST	4444	56372	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:53.377368927 CEST	56372	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:53.377473116 CEST	56372	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:53.382966995 CEST	4444	56372	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:54.948988914 CEST	4444	56372	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:54.949295998 CEST	56372	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:54.950279951 CEST	56374	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:54.956521034 CEST	4444	56372	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:54.957315922 CEST	4444	56374	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:54.957417011 CEST	56374	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:54.957500935 CEST	56374	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:54.963745117 CEST	4444	56374	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:56.530025005 CEST	4444	56374	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:56.530565977 CEST	56374	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:56.531495094 CEST	56376	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:56.535785913 CEST	4444	56374	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:56.536447048 CEST	4444	56376	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:56.536535025 CEST	56376	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:56.536650896 CEST	56376	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:56.541568995 CEST	4444	56376	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:58.139017105 CEST	4444	56376	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:58.139314890 CEST	56376	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:58.140310049 CEST	56378	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:58.144505024 CEST	4444	56376	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:58.145622969 CEST	4444	56378	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:58.145692110 CEST	56378	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:58.145787001 CEST	56378	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:58.150979996 CEST	4444	56378	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:59.719508886 CEST	4444	56378	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:59.719830036 CEST	56378	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:59.720731020 CEST	56380	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:59.725023031 CEST	4444	56378	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:59.725630045 CEST	4444	56380	162.215.219.170	192.168.2.23
Oct 8, 2024 21:07:59.725704908 CEST	56380	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:59.725763083 CEST	56380	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:07:59.730942965 CEST	4444	56380	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:01.771100998 CEST	4444	56380	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:01.771373034 CEST	56380	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:01.773379087 CEST	56382	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:01.774333000 CEST	4444	56380	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:01.774390936 CEST	56380	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:01.775315046 CEST	4444	56380	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:01.775360107 CEST	56380	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:01.980112076 CEST	56380	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:02.015321016 CEST	4444	56380	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:02.015861034 CEST	4444	56382	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:02.016186953 CEST	56382	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:02.016187906 CEST	56382	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:02.017302036 CEST	4444	56380	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:02.017385006 CEST	56380	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:02.021207094 CEST	4444	56382	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:03.648643017 CEST	4444	56382	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:03.648994923 CEST	56382	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:03.649961948 CEST	56384	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:03.932765961 CEST	4444	56382	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:03.932996988 CEST	56382	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:03.936111927 CEST	4444	56382	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:03.936136007 CEST	4444	56384	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:03.936465025 CEST	56384	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:03.936465025 CEST	56384	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:03.941492081 CEST	4444	56384	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:05.849572897 CEST	4444	56384	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:05.849839926 CEST	56384	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:05.850897074 CEST	56386	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:05.851201057 CEST	4444	56384	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:05.851378918 CEST	56384	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:05.859203100 CEST	4444	56384	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:05.859221935 CEST	4444	56386	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:05.859312057 CEST	56386	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:05.859379053 CEST	56386	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:05.864449024 CEST	4444	56386	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:07.418193102 CEST	4444	56386	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:07.418621063 CEST	56386	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:07.419578075 CEST	56388	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:07.423783064 CEST	4444	56386	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:07.424880028 CEST	4444	56388	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:07.424962044 CEST	56388	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:07.425075054 CEST	56388	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:07.430339098 CEST	4444	56388	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:08.977169991 CEST	4444	56388	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:08.977596045 CEST	56388	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:08.978375912 CEST	56390	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:08.983201981 CEST	4444	56388	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:08.984685898 CEST	4444	56390	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:08.984740973 CEST	56390	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:08.984797001 CEST	56390	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:08.990946054 CEST	4444	56390	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:10.546689034 CEST	4444	56390	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:10.547054052 CEST	56390	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:10.547950983 CEST	56392	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:10.552139044 CEST	4444	56390	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:10.553293943 CEST	4444	56392	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:10.553374052 CEST	56392	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:10.553478003 CEST	56392	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:10.558408976 CEST	4444	56392	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:12.135219097 CEST	4444	56392	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:12.135658026 CEST	56392	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:12.136620045 CEST	56394	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:12.141551971 CEST	4444	56392	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:12.141738892 CEST	4444	56394	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:12.141793013 CEST	56394	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:12.141848087 CEST	56394	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:12.146872997 CEST	4444	56394	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:13.709140062 CEST	4444	56394	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:13.709558010 CEST	56394	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:13.710531950 CEST	56396	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:13.714894056 CEST	4444	56394	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:13.716065884 CEST	4444	56396	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:13.716146946 CEST	56396	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:13.716250896 CEST	56396	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:13.721544981 CEST	4444	56396	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:15.279675961 CEST	4444	56396	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:15.280059099 CEST	56396	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:15.280883074 CEST	56398	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:15.286066055 CEST	4444	56396	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:15.286708117 CEST	4444	56398	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:15.286778927 CEST	56398	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:15.286873102 CEST	56398	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:15.294127941 CEST	4444	56398	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:15.718283892 CEST	43928	443	192.168.2.23	91.189.91.42
Oct 8, 2024 21:08:16.838114977 CEST	4444	56398	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:16.838530064 CEST	56398	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:16.839272022 CEST	56400	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:16.843466043 CEST	4444	56398	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:16.844250917 CEST	4444	56400	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:16.844350100 CEST	56400	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:16.844449043 CEST	56400	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:16.849720955 CEST	4444	56400	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:18.414484978 CEST	4444	56400	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:18.414841890 CEST	56400	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:18.415810108 CEST	56402	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:18.420516014 CEST	4444	56400	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:18.421047926 CEST	4444	56402	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:18.421122074 CEST	56402	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:18.421202898 CEST	56402	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:18.426479101 CEST	4444	56402	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:19.981057882 CEST	4444	56402	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:19.981379032 CEST	56402	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:19.982095957 CEST	56404	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:19.986922979 CEST	4444	56402	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:19.989151001 CEST	4444	56404	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:19.989216089 CEST	56404	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:19.989330053 CEST	56404	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:19.994730949 CEST	4444	56404	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:21.555373907 CEST	4444	56404	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:21.555542946 CEST	56404	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:21.556380987 CEST	56406	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:21.560422897 CEST	4444	56404	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:21.561683893 CEST	4444	56406	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:21.561786890 CEST	56406	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:21.561786890 CEST	56406	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:21.566788912 CEST	4444	56406	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:23.133663893 CEST	4444	56406	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:23.134088039 CEST	56406	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:23.135168076 CEST	56408	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:23.139250994 CEST	4444	56406	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:23.140710115 CEST	4444	56408	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:23.140773058 CEST	56408	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:23.140873909 CEST	56408	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:23.145883083 CEST	4444	56408	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:24.898650885 CEST	4444	56408	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:24.899108887 CEST	56408	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:24.900298119 CEST	56410	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:24.908724070 CEST	4444	56408	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:24.909112930 CEST	4444	56410	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:24.909182072 CEST	56410	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:24.909280062 CEST	56410	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:24.914376020 CEST	4444	56410	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:26.498219013 CEST	4444	56410	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:26.498578072 CEST	56410	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:26.499341965 CEST	56412	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:26.503793955 CEST	4444	56410	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:26.504398108 CEST	4444	56412	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:26.504513025 CEST	56412	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:26.504555941 CEST	56412	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:26.509988070 CEST	4444	56412	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:28.210124016 CEST	4444	56412	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:28.210345030 CEST	56412	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:28.211340904 CEST	56414	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:28.215265989 CEST	4444	56412	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:28.216366053 CEST	4444	56414	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:28.216522932 CEST	56414	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:28.216559887 CEST	56414	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:28.221430063 CEST	4444	56414	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:29.780136108 CEST	4444	56414	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:29.780405998 CEST	56414	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:29.781374931 CEST	56416	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:29.785572052 CEST	4444	56414	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:29.786324978 CEST	4444	56416	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:29.786396027 CEST	56416	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:29.786493063 CEST	56416	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:29.791464090 CEST	4444	56416	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:32.108443022 CEST	4444	56416	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:32.108619928 CEST	56416	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:32.109185934 CEST	56418	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:32.109867096 CEST	4444	56416	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:32.109914064 CEST	56416	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:32.110018969 CEST	4444	56416	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:32.110063076 CEST	56416	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:32.119313955 CEST	4444	56416	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:32.121578932 CEST	4444	56418	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:32.121644020 CEST	56418	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:32.121697903 CEST	56418	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:32.127798080 CEST	4444	56418	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:33.741919041 CEST	4444	56418	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:33.742095947 CEST	56418	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:33.743017912 CEST	56420	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:33.750437975 CEST	4444	56418	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:33.751801014 CEST	4444	56420	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:33.751851082 CEST	56420	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:33.751909971 CEST	56420	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:33.757242918 CEST	4444	56420	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:35.371423006 CEST	4444	56420	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:35.371607065 CEST	56420	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:35.372307062 CEST	56422	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:35.376404047 CEST	4444	56420	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:35.377361059 CEST	4444	56422	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:35.377427101 CEST	56422	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:35.377465010 CEST	56422	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:35.382575989 CEST	4444	56422	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:36.946866035 CEST	4444	56422	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:36.947130919 CEST	56422	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:36.948172092 CEST	56424	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:36.952167034 CEST	4444	56422	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:36.954363108 CEST	4444	56424	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:36.954458952 CEST	56424	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:36.954458952 CEST	56424	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:36.959738016 CEST	4444	56424	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:38.530517101 CEST	4444	56424	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:38.530705929 CEST	56424	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:38.531622887 CEST	56426	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:38.536081076 CEST	4444	56424	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:38.536598921 CEST	4444	56426	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:38.536674023 CEST	56426	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:38.536703110 CEST	56426	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:38.541712046 CEST	4444	56426	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:40.102422953 CEST	4444	56426	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:40.102859974 CEST	56426	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:40.102859974 CEST	56426	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:40.103885889 CEST	56428	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:40.108120918 CEST	4444	56426	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:40.108906984 CEST	4444	56428	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:40.108985901 CEST	56428	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:40.109095097 CEST	56428	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:40.114722013 CEST	4444	56428	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:41.696388960 CEST	4444	56428	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:41.696768045 CEST	56428	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:41.697592974 CEST	56430	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:41.701730013 CEST	4444	56428	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:41.702545881 CEST	4444	56430	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:41.702619076 CEST	56430	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:41.702718019 CEST	56430	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:41.708034039 CEST	4444	56430	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:43.289846897 CEST	4444	56430	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:43.290045023 CEST	56430	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:43.290746927 CEST	56432	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:43.294934034 CEST	4444	56430	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:43.295752048 CEST	4444	56432	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:43.295835972 CEST	56432	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:43.295913935 CEST	56432	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:43.301393986 CEST	4444	56432	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:44.868319988 CEST	4444	56432	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:44.868484020 CEST	56432	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:44.869069099 CEST	56434	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:44.873310089 CEST	4444	56432	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:44.873985052 CEST	4444	56434	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:44.874082088 CEST	56434	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:44.874124050 CEST	56434	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:44.879427910 CEST	4444	56434	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:46.435578108 CEST	4444	56434	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:46.435760975 CEST	56434	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:46.436611891 CEST	56436	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:46.440757990 CEST	4444	56434	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:46.441468000 CEST	4444	56436	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:46.441534996 CEST	56436	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:46.441579103 CEST	56436	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:46.447010040 CEST	4444	56436	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:48.032047033 CEST	4444	56436	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:48.032506943 CEST	56436	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:48.033148050 CEST	56438	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:48.037456989 CEST	4444	56436	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:48.038268089 CEST	4444	56438	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:48.038361073 CEST	56438	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:48.038455963 CEST	56438	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:48.043414116 CEST	4444	56438	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:49.623131037 CEST	4444	56438	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:49.623574018 CEST	56438	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:49.624521017 CEST	56440	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:49.628925085 CEST	4444	56438	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:49.629714012 CEST	4444	56440	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:49.629801035 CEST	56440	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:49.629879951 CEST	56440	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:49.635524035 CEST	4444	56440	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:51.181025028 CEST	4444	56440	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:51.181401968 CEST	56440	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:51.181401968 CEST	56440	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:51.182185888 CEST	56442	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:51.186368942 CEST	4444	56440	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:51.187146902 CEST	4444	56442	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:51.187213898 CEST	56442	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:51.187329054 CEST	56442	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:51.192126036 CEST	4444	56442	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:52.763190031 CEST	4444	56442	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:52.763577938 CEST	56442	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:52.764841080 CEST	56444	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:52.768414021 CEST	4444	56442	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:52.770155907 CEST	4444	56444	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:52.770351887 CEST	56444	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:52.770351887 CEST	56444	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:52.775804996 CEST	4444	56444	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:54.323252916 CEST	4444	56444	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:54.323409081 CEST	56444	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:54.324076891 CEST	56446	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:54.328450918 CEST	4444	56444	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:54.329015970 CEST	4444	56446	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:54.329080105 CEST	56446	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:54.330658913 CEST	56446	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:54.338668108 CEST	4444	56446	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:55.884548903 CEST	4444	56446	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:55.884926081 CEST	56446	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:55.885911942 CEST	56448	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:55.890172958 CEST	4444	56446	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:55.891258955 CEST	4444	56448	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:55.891347885 CEST	56448	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:55.891443968 CEST	56448	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:55.896347046 CEST	4444	56448	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:57.466936111 CEST	4444	56448	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:57.467437029 CEST	56448	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:57.468509912 CEST	56450	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:57.472553968 CEST	4444	56448	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:57.473629951 CEST	4444	56450	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:57.473736048 CEST	56450	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:57.473829031 CEST	56450	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:57.479033947 CEST	4444	56450	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:59.062048912 CEST	4444	56450	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:59.062338114 CEST	56450	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:59.063497066 CEST	56452	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:59.067533016 CEST	4444	56450	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:59.068432093 CEST	4444	56452	162.215.219.170	192.168.2.23
Oct 8, 2024 21:08:59.068530083 CEST	56452	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:59.068629980 CEST	56452	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:08:59.073770046 CEST	4444	56452	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:00.665406942 CEST	4444	56452	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:00.665802002 CEST	56452	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:00.666459084 CEST	56454	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:00.675614119 CEST	4444	56452	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:00.675734997 CEST	4444	56454	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:00.675831079 CEST	56454	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:00.675879002 CEST	56454	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:00.682213068 CEST	4444	56454	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:02.265295029 CEST	4444	56454	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:02.265779972 CEST	56454	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:02.266313076 CEST	56456	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:02.270782948 CEST	4444	56454	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:02.271752119 CEST	4444	56456	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:02.271842957 CEST	56456	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:02.271874905 CEST	56456	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:02.277056932 CEST	4444	56456	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:04.072467089 CEST	4444	56456	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:04.072791100 CEST	56456	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:04.073071957 CEST	4444	56456	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:04.073190928 CEST	56456	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:04.074065924 CEST	56458	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:04.077984095 CEST	4444	56456	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:04.079149008 CEST	4444	56458	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:04.079256058 CEST	56458	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:04.079411030 CEST	56458	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:04.085294008 CEST	4444	56458	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:05.635926008 CEST	4444	56458	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:05.636789083 CEST	56458	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:05.636912107 CEST	56460	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:05.642075062 CEST	4444	56458	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:05.642090082 CEST	4444	56460	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:05.642219067 CEST	56460	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:05.642286062 CEST	56460	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:05.648627996 CEST	4444	56460	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:07.200795889 CEST	4444	56460	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:07.201132059 CEST	56460	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:07.201806068 CEST	56462	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:07.206037045 CEST	4444	56460	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:07.206793070 CEST	4444	56462	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:07.206906080 CEST	56462	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:07.207000017 CEST	56462	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:07.212198019 CEST	4444	56462	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:08.759593964 CEST	4444	56462	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:08.760276079 CEST	56462	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:08.761354923 CEST	56464	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:08.765620947 CEST	4444	56462	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:08.766819954 CEST	4444	56464	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:08.766905069 CEST	56464	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:08.767003059 CEST	56464	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:08.771919966 CEST	4444	56464	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:10.339401960 CEST	4444	56464	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:10.339793921 CEST	56464	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:10.340565920 CEST	56466	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:10.345139980 CEST	4444	56464	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:10.345467091 CEST	4444	56466	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:10.345541954 CEST	56466	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:10.345652103 CEST	56466	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:10.350752115 CEST	4444	56466	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:12.113445044 CEST	4444	56466	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:12.113709927 CEST	56466	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:12.114720106 CEST	56468	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:12.119000912 CEST	4444	56466	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:12.119704962 CEST	4444	56468	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:12.119776011 CEST	56468	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:12.119893074 CEST	56468	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:12.126065969 CEST	4444	56468	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:13.758251905 CEST	4444	56468	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:13.758666992 CEST	56468	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:13.760536909 CEST	56470	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:13.764111996 CEST	4444	56468	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:13.765758038 CEST	4444	56470	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:13.765911102 CEST	56470	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:13.766001940 CEST	56470	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:13.772330999 CEST	4444	56470	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:15.341964006 CEST	4444	56470	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:15.342358112 CEST	56470	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:15.343168020 CEST	56472	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:15.347338915 CEST	4444	56470	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:15.348649979 CEST	4444	56472	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:15.348846912 CEST	56472	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:15.348846912 CEST	56472	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:15.354254007 CEST	4444	56472	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:16.902316093 CEST	4444	56472	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:16.902636051 CEST	56472	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:16.903589010 CEST	56474	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:16.908375025 CEST	4444	56472	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:16.909785986 CEST	4444	56474	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:16.909869909 CEST	56474	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:16.909991026 CEST	56474	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:16.917277098 CEST	4444	56474	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:18.478945017 CEST	4444	56474	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:18.479226112 CEST	56474	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:18.480967999 CEST	56476	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:18.484637022 CEST	4444	56474	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:18.486027956 CEST	4444	56476	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:18.486073017 CEST	56476	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:18.486129045 CEST	56476	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:18.496793032 CEST	4444	56476	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:20.073854923 CEST	4444	56476	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:20.074054003 CEST	56476	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:20.074613094 CEST	56478	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:20.079006910 CEST	4444	56476	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:20.080722094 CEST	4444	56478	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:20.080787897 CEST	56478	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:20.080899000 CEST	56478	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:20.086087942 CEST	4444	56478	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:21.699596882 CEST	4444	56478	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:21.699991941 CEST	56478	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:21.701781034 CEST	56480	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:21.705960035 CEST	4444	56478	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:21.706897020 CEST	4444	56480	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:21.707025051 CEST	56480	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:21.707125902 CEST	56480	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:21.712919950 CEST	4444	56480	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:23.280304909 CEST	4444	56480	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:23.280664921 CEST	56480	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:23.281537056 CEST	56482	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:23.285749912 CEST	4444	56480	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:23.287142992 CEST	4444	56482	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:23.287251949 CEST	56482	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:23.287344933 CEST	56482	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:23.293040037 CEST	4444	56482	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:24.857645035 CEST	4444	56482	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:24.857980967 CEST	56482	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:24.858835936 CEST	56484	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:24.863464117 CEST	4444	56482	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:24.863918066 CEST	4444	56484	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:24.863989115 CEST	56484	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:24.864078999 CEST	56484	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:24.869148970 CEST	4444	56484	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:26.436718941 CEST	4444	56484	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:26.437004089 CEST	56484	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:26.438138008 CEST	56486	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:26.442177057 CEST	4444	56484	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:26.443783998 CEST	4444	56486	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:26.443876982 CEST	56486	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:26.443968058 CEST	56486	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:26.448844910 CEST	4444	56486	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:28.013639927 CEST	4444	56486	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:28.014193058 CEST	56486	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:28.015006065 CEST	56488	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:28.019409895 CEST	4444	56486	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:28.019957066 CEST	4444	56488	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:28.020023108 CEST	56488	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:28.020159960 CEST	56488	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:28.025115013 CEST	4444	56488	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:29.573141098 CEST	4444	56488	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:29.573400021 CEST	56488	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:29.574162006 CEST	56490	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:29.578799963 CEST	4444	56488	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:29.579334021 CEST	4444	56490	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:29.579456091 CEST	56490	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:29.579569101 CEST	56490	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:29.585122108 CEST	4444	56490	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:31.155883074 CEST	4444	56490	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:31.156152964 CEST	56490	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:31.157522917 CEST	56492	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:31.161432028 CEST	4444	56490	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:31.163619041 CEST	4444	56492	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:31.163698912 CEST	56492	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:31.163831949 CEST	56492	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:31.168859005 CEST	4444	56492	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:32.749655962 CEST	4444	56492	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:32.750193119 CEST	56492	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:32.751540899 CEST	56494	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:32.755420923 CEST	4444	56492	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:32.756515026 CEST	4444	56494	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:32.756573915 CEST	56494	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:32.756673098 CEST	56494	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:32.761965990 CEST	4444	56494	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:34.311516047 CEST	4444	56494	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:34.311851978 CEST	56494	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:34.313225985 CEST	56496	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:34.324246883 CEST	4444	56494	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:34.326178074 CEST	4444	56496	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:34.326277018 CEST	56496	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:34.326386929 CEST	56496	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:34.335606098 CEST	4444	56496	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:35.884675026 CEST	4444	56496	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:35.885071993 CEST	56496	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:35.886141062 CEST	56498	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:35.892884970 CEST	4444	56496	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:35.892918110 CEST	4444	56498	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:35.892992973 CEST	56498	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:35.893114090 CEST	56498	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:35.899658918 CEST	4444	56498	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:37.449481010 CEST	4444	56498	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:37.449795008 CEST	56498	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:37.450952053 CEST	56500	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:37.455240965 CEST	4444	56498	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:37.456198931 CEST	4444	56500	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:37.456461906 CEST	56500	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:37.456461906 CEST	56500	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:37.461744070 CEST	4444	56500	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:39.010894060 CEST	4444	56500	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:39.011483908 CEST	56500	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:39.012252092 CEST	56502	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:39.016730070 CEST	4444	56500	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:39.017277002 CEST	4444	56502	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:39.017349958 CEST	56502	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:39.017443895 CEST	56502	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:39.022835970 CEST	4444	56502	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:40.834865093 CEST	4444	56502	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:40.834963083 CEST	4444	56502	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:40.835091114 CEST	56502	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:40.835141897 CEST	56502	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:40.836280107 CEST	56504	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:40.840619087 CEST	4444	56502	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:40.841317892 CEST	4444	56504	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:40.841393948 CEST	56504	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:40.841461897 CEST	56504	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:40.847851992 CEST	4444	56504	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:42.400598049 CEST	4444	56504	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:42.400896072 CEST	56504	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:42.401683092 CEST	56506	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:42.405862093 CEST	4444	56504	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:42.406862974 CEST	4444	56506	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:42.407006979 CEST	56506	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:42.407006979 CEST	56506	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:42.412597895 CEST	4444	56506	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:43.980367899 CEST	4444	56506	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:43.980573893 CEST	56506	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:43.981472015 CEST	56508	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:43.985610008 CEST	4444	56506	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:43.987184048 CEST	4444	56508	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:43.987267017 CEST	56508	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:43.987394094 CEST	56508	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:43.992932081 CEST	4444	56508	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:45.545783043 CEST	4444	56508	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:45.546125889 CEST	56508	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:45.546962976 CEST	56510	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:45.551294088 CEST	4444	56508	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:45.551860094 CEST	4444	56510	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:45.551919937 CEST	56510	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:45.551973104 CEST	56510	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:45.557005882 CEST	4444	56510	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:47.109390974 CEST	4444	56510	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:47.109822035 CEST	56510	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:47.111232042 CEST	56512	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:47.115648985 CEST	4444	56510	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:47.117013931 CEST	4444	56512	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:47.117373943 CEST	56512	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:47.117485046 CEST	56512	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:47.122762918 CEST	4444	56512	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:48.688442945 CEST	4444	56512	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:48.689039946 CEST	56512	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:48.690288067 CEST	56514	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:48.696254015 CEST	4444	56512	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:48.697942019 CEST	4444	56514	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:48.698101997 CEST	56514	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:48.698251963 CEST	56514	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:48.703737974 CEST	4444	56514	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:50.245501041 CEST	4444	56514	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:50.246208906 CEST	56514	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:50.248439074 CEST	56516	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:50.251667023 CEST	4444	56514	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:50.253788948 CEST	4444	56516	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:50.254211903 CEST	56516	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:50.254211903 CEST	56516	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:50.259493113 CEST	4444	56516	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:52.124536991 CEST	4444	56516	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:52.124564886 CEST	4444	56516	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:52.124846935 CEST	56516	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:52.125231028 CEST	56516	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:52.126569986 CEST	56518	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:52.130739927 CEST	4444	56516	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:52.131592035 CEST	4444	56518	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:52.131752968 CEST	56518	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:52.131927967 CEST	56518	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:52.137168884 CEST	4444	56518	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:53.693909883 CEST	4444	56518	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:53.694350958 CEST	56518	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:53.695298910 CEST	56520	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:53.700395107 CEST	4444	56518	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:53.700922012 CEST	4444	56520	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:53.701072931 CEST	56520	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:53.701174021 CEST	56520	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:53.706655025 CEST	4444	56520	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:55.311407089 CEST	4444	56520	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:55.311876059 CEST	56520	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:55.314199924 CEST	56522	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:55.317195892 CEST	4444	56520	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:55.319339991 CEST	4444	56522	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:55.319585085 CEST	56522	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:55.319875002 CEST	56522	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:55.325232029 CEST	4444	56522	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:56.887558937 CEST	4444	56522	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:56.888000965 CEST	56522	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:56.888644934 CEST	56524	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:56.893028975 CEST	4444	56522	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:56.893872023 CEST	4444	56524	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:56.893976927 CEST	56524	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:56.894016981 CEST	56524	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:56.899105072 CEST	4444	56524	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:58.448508978 CEST	4444	56524	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:58.448647022 CEST	56524	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:58.449104071 CEST	56526	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:58.454412937 CEST	4444	56524	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:58.454432011 CEST	4444	56526	162.215.219.170	192.168.2.23
Oct 8, 2024 21:09:58.454483986 CEST	56526	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:58.454554081 CEST	56526	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:09:58.459491968 CEST	4444	56526	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:00.028784037 CEST	4444	56526	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:00.029258966 CEST	56526	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:00.029932976 CEST	56528	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:00.034171104 CEST	4444	56526	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:00.034879923 CEST	4444	56528	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:00.035119057 CEST	56528	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:00.035119057 CEST	56528	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:00.040070057 CEST	4444	56528	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:01.592097044 CEST	4444	56528	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:01.592420101 CEST	56528	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:01.592959881 CEST	56530	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:01.598861933 CEST	4444	56528	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:01.600038052 CEST	4444	56530	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:01.600089073 CEST	56530	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:01.600147963 CEST	56530	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:01.607141018 CEST	4444	56530	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:03.334156036 CEST	4444	56530	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:03.334435940 CEST	56530	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:03.335258961 CEST	56532	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:03.341536045 CEST	4444	56530	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:03.342371941 CEST	4444	56532	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:03.342427015 CEST	56532	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:03.342475891 CEST	56532	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:03.349857092 CEST	4444	56532	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:04.885667086 CEST	4444	56532	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:04.886071920 CEST	56532	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:04.886749983 CEST	56534	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:04.891707897 CEST	4444	56532	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:04.891943932 CEST	4444	56534	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:04.892019987 CEST	56534	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:04.892137051 CEST	56534	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:04.897258997 CEST	4444	56534	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:06.451813936 CEST	4444	56534	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:06.452018023 CEST	56534	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:06.452512980 CEST	56536	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:06.456929922 CEST	4444	56534	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:06.457787991 CEST	4444	56536	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:06.457832098 CEST	56536	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:06.457873106 CEST	56536	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:06.466402054 CEST	4444	56536	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:08.086242914 CEST	4444	56536	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:08.086627007 CEST	56536	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:08.087563038 CEST	56538	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:08.091538906 CEST	4444	56536	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:08.092607021 CEST	4444	56538	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:08.092683077 CEST	56538	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:08.092780113 CEST	56538	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:08.098701954 CEST	4444	56538	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:09.698745012 CEST	4444	56538	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:09.699121952 CEST	56538	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:09.700206995 CEST	56540	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:09.705180883 CEST	4444	56538	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:09.705257893 CEST	4444	56540	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:09.705324888 CEST	56540	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:09.705419064 CEST	56540	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:09.710448027 CEST	4444	56540	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:12.099525928 CEST	4444	56540	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:12.099616051 CEST	4444	56540	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:12.099807024 CEST	56540	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:12.099843979 CEST	56540	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:12.099850893 CEST	4444	56540	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:12.099903107 CEST	56540	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:12.100805998 CEST	56542	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:12.109632015 CEST	4444	56540	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:12.109920025 CEST	4444	56542	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:12.110012054 CEST	56542	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:12.110133886 CEST	56542	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:12.115083933 CEST	4444	56542	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:13.705806017 CEST	4444	56542	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:13.706068993 CEST	56542	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:13.707210064 CEST	56544	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:13.711620092 CEST	4444	56542	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:13.712959051 CEST	4444	56544	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:13.713085890 CEST	56544	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:13.713139057 CEST	56544	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:13.718276978 CEST	4444	56544	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:15.285176992 CEST	4444	56544	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:15.285433054 CEST	56544	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:15.286134005 CEST	56546	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:15.290574074 CEST	4444	56544	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:15.291224957 CEST	4444	56546	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:15.291302919 CEST	56546	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:15.291361094 CEST	56546	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:15.296736956 CEST	4444	56546	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:16.886025906 CEST	4444	56546	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:16.886348963 CEST	56546	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:16.887456894 CEST	56548	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:16.891685963 CEST	4444	56546	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:16.893767118 CEST	4444	56548	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:16.893866062 CEST	56548	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:16.893910885 CEST	56548	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:16.899054050 CEST	4444	56548	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:18.483694077 CEST	4444	56548	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:18.483956099 CEST	56548	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:18.484827995 CEST	56550	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:18.488950968 CEST	4444	56548	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:18.489886999 CEST	4444	56550	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:18.489988089 CEST	56550	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:18.490056038 CEST	56550	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:18.495229959 CEST	4444	56550	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:20.195880890 CEST	4444	56550	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:20.196212053 CEST	56550	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:20.196938038 CEST	56552	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:20.201138973 CEST	4444	56550	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:20.201766014 CEST	4444	56552	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:20.201849937 CEST	56552	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:20.201886892 CEST	56552	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:20.207201004 CEST	4444	56552	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:21.761388063 CEST	4444	56552	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:21.761856079 CEST	56552	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:21.762808084 CEST	56554	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:21.769238949 CEST	4444	56552	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:21.769612074 CEST	4444	56554	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:21.769674063 CEST	56554	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:21.769764900 CEST	56554	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:21.774852991 CEST	4444	56554	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:23.323144913 CEST	4444	56554	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:23.323379040 CEST	56554	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:23.323944092 CEST	56556	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:23.328494072 CEST	4444	56554	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:23.329291105 CEST	4444	56556	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:23.329343081 CEST	56556	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:23.329449892 CEST	56556	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:23.334638119 CEST	4444	56556	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:24.929750919 CEST	4444	56556	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:24.930047989 CEST	56556	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:24.930906057 CEST	56558	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:24.936122894 CEST	4444	56556	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:24.937573910 CEST	4444	56558	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:24.937673092 CEST	56558	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:24.937771082 CEST	56558	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:24.944071054 CEST	4444	56558	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:26.495354891 CEST	4444	56558	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:26.495805025 CEST	56558	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:26.497406960 CEST	56560	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:26.501256943 CEST	4444	56558	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:26.502541065 CEST	4444	56560	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:26.502615929 CEST	56560	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:26.502712011 CEST	56560	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:26.508594036 CEST	4444	56560	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:28.075508118 CEST	4444	56560	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:28.075737000 CEST	56560	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:28.076577902 CEST	56562	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:28.080780029 CEST	4444	56560	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:28.082165003 CEST	4444	56562	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:28.082230091 CEST	56562	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:28.082278013 CEST	56562	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:28.087637901 CEST	4444	56562	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:29.635334969 CEST	4444	56562	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:29.635596991 CEST	56562	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:29.635597944 CEST	56562	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:29.636214018 CEST	56564	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:29.643105984 CEST	4444	56562	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:29.643142939 CEST	4444	56564	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:29.643198967 CEST	56564	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:29.643273115 CEST	56564	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:29.648893118 CEST	4444	56564	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:31.247808933 CEST	4444	56564	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:31.248238087 CEST	56564	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:31.248943090 CEST	56566	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:31.253201008 CEST	4444	56564	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:31.253854990 CEST	4444	56566	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:31.253921032 CEST	56566	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:31.254043102 CEST	56566	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:31.259272099 CEST	4444	56566	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:33.444025993 CEST	4444	56566	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:33.444359064 CEST	56566	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:33.444402933 CEST	4444	56566	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:33.444442034 CEST	4444	56566	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:33.444475889 CEST	56566	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:33.444504023 CEST	56566	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:33.445030928 CEST	56568	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:33.655040979 CEST	56566	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:33.738133907 CEST	4444	56566	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:33.738174915 CEST	4444	56566	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:33.738218069 CEST	4444	56568	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:33.738253117 CEST	4444	56566	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:33.738323927 CEST	56568	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:33.738325119 CEST	56566	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:33.738348007 CEST	56566	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:33.738497019 CEST	56568	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:33.743813992 CEST	4444	56568	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:35.311309099 CEST	4444	56568	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:35.311634064 CEST	56568	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:35.312339067 CEST	56570	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:35.317106962 CEST	4444	56568	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:35.317521095 CEST	4444	56570	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:35.317604065 CEST	56570	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:35.317742109 CEST	56570	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:35.323165894 CEST	4444	56570	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:36.870788097 CEST	4444	56570	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:36.871049881 CEST	56570	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:36.871654034 CEST	56572	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:36.876204014 CEST	4444	56570	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:36.876575947 CEST	4444	56572	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:36.876615047 CEST	56572	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:36.876662970 CEST	56572	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:36.881580114 CEST	4444	56572	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:38.432995081 CEST	4444	56572	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:38.433274984 CEST	56572	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:38.434195995 CEST	56574	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:38.438317060 CEST	4444	56572	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:38.439246893 CEST	4444	56574	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:38.439330101 CEST	56574	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:38.439459085 CEST	56574	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:38.444608927 CEST	4444	56574	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:39.995937109 CEST	4444	56574	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:39.996258974 CEST	56574	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:39.996861935 CEST	56576	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:40.001245022 CEST	4444	56574	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:40.002146006 CEST	4444	56576	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:40.002274036 CEST	56576	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:40.002312899 CEST	56576	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:40.007658958 CEST	4444	56576	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:41.558238983 CEST	4444	56576	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:41.558623075 CEST	56576	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:41.559448957 CEST	56578	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:41.564050913 CEST	4444	56576	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:41.565041065 CEST	4444	56578	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:41.565098047 CEST	56578	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:41.565206051 CEST	56578	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:41.570797920 CEST	4444	56578	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:43.140436888 CEST	4444	56578	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:43.140944958 CEST	56578	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:43.141618013 CEST	56580	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:43.145867109 CEST	4444	56578	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:43.146538973 CEST	4444	56580	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:43.146624088 CEST	56580	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:43.146756887 CEST	56580	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:43.151725054 CEST	4444	56580	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:44.730164051 CEST	4444	56580	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:44.730680943 CEST	56580	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:44.731376886 CEST	56582	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:44.735827923 CEST	4444	56580	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:44.736319065 CEST	4444	56582	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:44.736412048 CEST	56582	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:44.736494064 CEST	56582	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:44.741480112 CEST	4444	56582	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:46.313853025 CEST	4444	56582	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:46.314270020 CEST	56582	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:46.315164089 CEST	56584	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:46.319475889 CEST	4444	56582	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:46.320768118 CEST	4444	56584	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:46.320858955 CEST	56584	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:46.320962906 CEST	56584	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:46.326145887 CEST	4444	56584	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:47.892555952 CEST	4444	56584	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:47.892970085 CEST	56584	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:47.893951893 CEST	56586	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:47.898224115 CEST	4444	56584	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:47.899128914 CEST	4444	56586	162.215.219.170	192.168.2.23
Oct 8, 2024 21:10:47.899204016 CEST	56586	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:47.899307966 CEST	56586	4444	192.168.2.23	162.215.219.170
Oct 8, 2024 21:10:47.904722929 CEST	4444	56586	162.215.219.170	192.168.2.23

System Behavior

Analysis Process: lln4e2EfeB.elf PID: 6211, Parent PID: 6131

General

Start time (UTC):	19:07:13
Start date (UTC):	08/10/2024
Path:	/tmp/lln4e2EfeB.elf
Arguments:	/tmp/lln4e2EfeB.elf
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: lln4e2EfeB.elf PID: 6213, Parent PID: 6211

General

Start time (UTC):	19:07:14
Start date (UTC):	08/10/2024
Path:	/tmp/lln4e2EfeB.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: lln4e2EfeB.elf PID: 6215, Parent PID: 6213

General

Start time (UTC):	19:07:14
Start date (UTC):	08/10/2024
Path:	/tmp/lln4e2EfeB.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping or `net view` using Net .
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report lln4e2EfeB.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Threatname: Gafgyt

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.pSovwR (deleted)

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: lln4e2EfeB.elf PID: 6211, Parent PID: 6131

General

Chronological Activities

Analysis Process: lln4e2EfeB.elf PID: 6213, Parent PID: 6211

General

Chronological Activities

Analysis Process: lln4e2EfeB.elf PID: 6215, Parent PID: 6213

General

Chronological Activities

Linux Analysis Report
lln4e2EfeB.elf