Edit tour

Linux Analysis Report
rkF1LTQVdi.elf

Overview

General Information

Sample name:	rkF1LTQVdi.elf renamed because original name is a hash value
Original sample name:	b813f066d458837d59d7d515e20e5596.elf
Analysis ID:	1532253
MD5:	b813f066d458837d59d7d515e20e5596
SHA1:	a01cabd9cc36271a9f6505a01cb3b10737a225b8
SHA256:	1a58bf62d288351f3ff52933417dbabdb5a1d71c3d45d16d7367dadbce9b70e4
Tags:	32elfintelmirai
Infos:

Detection

Mirai

Score:	84
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Contains symbols with names commonly found in malware

Machine Learning detection for sample

Sample deletes itself

Detected TCP or UDP traffic on non-standard ports

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1532253
Start date and time:	2024-10-12 22:56:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	rkF1LTQVdi.elf renamed because original name is a hash value
Original Sample Name:	b813f066d458837d59d7d515e20e5596.elf
Detection:	MAL
Classification:	mal84.troj.evad.linELF@0/0@49/0

Runtime Messages

Command:	/tmp/rkF1LTQVdi.elf
PID:	5432
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	listening to fbot
Standard Error:

Process Tree

system is lnxubuntu20

rkF1LTQVdi.elf (PID: 5432, Parent: 5356, MD5: b813f066d458837d59d7d515e20e5596) Arguments: /tmp/rkF1LTQVdi.elf

rkF1LTQVdi.elf New Fork (PID: 5433, Parent: 5432)

rkF1LTQVdi.elf New Fork (PID: 5434, Parent: 5432)

rkF1LTQVdi.elf New Fork (PID: 5435, Parent: 5434)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
rkF1LTQVdi.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
rkF1LTQVdi.elf	Linux_Trojan_Mirai_122ff2e6	unknown	unknown	0x68e3:$a: 24 EB 15 89 F0 83 C8 01 EB 03 8B 5B 08 3B 43 04 72 F8 8B 4B 0C 89
rkF1LTQVdi.elf	Linux_Trojan_Mirai_99d78950	unknown	unknown	0x17b9:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1890:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1960:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1cce:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1e51:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00
rkF1LTQVdi.elf	Linux_Trojan_Mirai_fa48b592	unknown	unknown	0x9dc5:$a: 31 C0 BA 01 00 00 00 B9 01 00 00 00 03 04 24 89 D7 31 D2 F7 F7 0F
rkF1LTQVdi.elf	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x5802:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88

Memory Dumps

Source	Rule	Description	Author	Strings
5435.1.0000000008048000.0000000008053000.r-x.sdmp	Linux_Trojan_Mirai_122ff2e6	unknown	unknown	0x68e3:$a: 24 EB 15 89 F0 83 C8 01 EB 03 8B 5B 08 3B 43 04 72 F8 8B 4B 0C 89
5435.1.0000000008048000.0000000008053000.r-x.sdmp	Linux_Trojan_Mirai_99d78950	unknown	unknown	0x17b9:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1890:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1960:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1cce:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1e51:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00
5435.1.0000000008048000.0000000008053000.r-x.sdmp	Linux_Trojan_Mirai_fa48b592	unknown	unknown	0x9dc5:$a: 31 C0 BA 01 00 00 00 B9 01 00 00 00 03 04 24 89 D7 31 D2 F7 F7 0F
5435.1.0000000008048000.0000000008053000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x5802:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
5433.1.0000000008048000.0000000008053000.r-x.sdmp	Linux_Trojan_Mirai_122ff2e6	unknown	unknown	0x68e3:$a: 24 EB 15 89 F0 83 C8 01 EB 03 8B 5B 08 3B 43 04 72 F8 8B 4B 0C 89
5433.1.0000000008048000.0000000008053000.r-x.sdmp	Linux_Trojan_Mirai_99d78950	unknown	unknown	0x17b9:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1890:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1960:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1cce:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1e51:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00
5433.1.0000000008048000.0000000008053000.r-x.sdmp	Linux_Trojan_Mirai_fa48b592	unknown	unknown	0x9dc5:$a: 31 C0 BA 01 00 00 00 B9 01 00 00 00 03 04 24 89 D7 31 D2 F7 F7 0F
5433.1.0000000008048000.0000000008053000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x5802:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
5432.1.0000000008048000.0000000008053000.r-x.sdmp	Linux_Trojan_Mirai_122ff2e6	unknown	unknown	0x68e3:$a: 24 EB 15 89 F0 83 C8 01 EB 03 8B 5B 08 3B 43 04 72 F8 8B 4B 0C 89
5432.1.0000000008048000.0000000008053000.r-x.sdmp	Linux_Trojan_Mirai_99d78950	unknown	unknown	0x17b9:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1890:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1960:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1cce:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1e51:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00
5432.1.0000000008048000.0000000008053000.r-x.sdmp	Linux_Trojan_Mirai_fa48b592	unknown	unknown	0x9dc5:$a: 31 C0 BA 01 00 00 00 B9 01 00 00 00 03 04 24 89 D7 31 D2 F7 F7 0F
5432.1.0000000008048000.0000000008053000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x5802:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
Click to see the 7 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: rkF1LTQVdi.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: rkF1LTQVdi.elf	ReversingLabs: Detection: 60%
Source: rkF1LTQVdi.elf	Virustotal: Detection: 43%			Perma Link

Machine Learning detection for sample

Source: rkF1LTQVdi.elf

Joe Sandbox ML: detected

Source: global traffic

TCP traffic: 192.168.2.13:45044 -> 93.123.85.140:31337

Source: global traffic

DNS traffic detected: DNS query: drumev.eu

System Summary

Malicious sample detected (through community Yara rule)

Source: rkF1LTQVdi.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_122ff2e6 Author: unknown
Source: rkF1LTQVdi.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
Source: rkF1LTQVdi.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_fa48b592 Author: unknown
Source: rkF1LTQVdi.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 5435.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_122ff2e6 Author: unknown
Source: 5435.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
Source: 5435.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa48b592 Author: unknown
Source: 5435.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 5433.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_122ff2e6 Author: unknown
Source: 5433.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
Source: 5433.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa48b592 Author: unknown
Source: 5433.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 5432.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_122ff2e6 Author: unknown
Source: 5432.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
Source: 5432.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa48b592 Author: unknown
Source: 5432.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown

Contains symbols with names commonly found in malware

Source: ELF static info symbol of initial sample	Name: attack.c
Source: ELF static info symbol of initial sample	Name: attack_get_opt_int
Source: ELF static info symbol of initial sample	Name: attack_get_opt_ip
Source: ELF static info symbol of initial sample	Name: attack_get_opt_str
Source: ELF static info symbol of initial sample	Name: attack_init
Source: ELF static info symbol of initial sample	Name: attack_method_http
Source: ELF static info symbol of initial sample	Name: attack_method_tcpack
Source: ELF static info symbol of initial sample	Name: attack_method_tcpsyn
Source: ELF static info symbol of initial sample	Name: attack_method_udpgeneric
Source: ELF static info symbol of initial sample	Name: attack_method_udpplain

Source: rkF1LTQVdi.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_122ff2e6 reference_sample = c7dd999a033fa3edc1936785b87cd69ce2f5cac5a084ddfaf527a1094e718bc4, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3c9ffd7537e30a21eefa6c174f801264b92a85a1bc73e34e6dc9e29f84658348, id = 122ff2e6-56e6-4aa8-a3ec-c19d31eb1f80, last_modified = 2021-09-16
Source: rkF1LTQVdi.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
Source: rkF1LTQVdi.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_fa48b592 reference_sample = c9e33befeec133720b3ba40bb3cd7f636aad80f72f324c5fe65ac7af271c49ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 8838d2752b310dbf7d12f6cf023244aaff4fdf5b55cf1e3b71843210df0fcf88, id = fa48b592-8d80-45af-a3e4-232695b8f5dd, last_modified = 2021-09-16
Source: rkF1LTQVdi.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 5435.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_122ff2e6 reference_sample = c7dd999a033fa3edc1936785b87cd69ce2f5cac5a084ddfaf527a1094e718bc4, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3c9ffd7537e30a21eefa6c174f801264b92a85a1bc73e34e6dc9e29f84658348, id = 122ff2e6-56e6-4aa8-a3ec-c19d31eb1f80, last_modified = 2021-09-16
Source: 5435.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
Source: 5435.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa48b592 reference_sample = c9e33befeec133720b3ba40bb3cd7f636aad80f72f324c5fe65ac7af271c49ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 8838d2752b310dbf7d12f6cf023244aaff4fdf5b55cf1e3b71843210df0fcf88, id = fa48b592-8d80-45af-a3e4-232695b8f5dd, last_modified = 2021-09-16
Source: 5435.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 5433.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_122ff2e6 reference_sample = c7dd999a033fa3edc1936785b87cd69ce2f5cac5a084ddfaf527a1094e718bc4, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3c9ffd7537e30a21eefa6c174f801264b92a85a1bc73e34e6dc9e29f84658348, id = 122ff2e6-56e6-4aa8-a3ec-c19d31eb1f80, last_modified = 2021-09-16
Source: 5433.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
Source: 5433.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa48b592 reference_sample = c9e33befeec133720b3ba40bb3cd7f636aad80f72f324c5fe65ac7af271c49ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 8838d2752b310dbf7d12f6cf023244aaff4fdf5b55cf1e3b71843210df0fcf88, id = fa48b592-8d80-45af-a3e4-232695b8f5dd, last_modified = 2021-09-16
Source: 5433.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 5432.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_122ff2e6 reference_sample = c7dd999a033fa3edc1936785b87cd69ce2f5cac5a084ddfaf527a1094e718bc4, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3c9ffd7537e30a21eefa6c174f801264b92a85a1bc73e34e6dc9e29f84658348, id = 122ff2e6-56e6-4aa8-a3ec-c19d31eb1f80, last_modified = 2021-09-16
Source: 5432.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
Source: 5432.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa48b592 reference_sample = c9e33befeec133720b3ba40bb3cd7f636aad80f72f324c5fe65ac7af271c49ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 8838d2752b310dbf7d12f6cf023244aaff4fdf5b55cf1e3b71843210df0fcf88, id = fa48b592-8d80-45af-a3e4-232695b8f5dd, last_modified = 2021-09-16
Source: 5432.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26

Source: classification engine

Classification label: mal84.troj.evad.linELF@0/0@49/0

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/rkF1LTQVdi.elf (PID: 5432)

File: /tmp/rkF1LTQVdi.elf

Jump to behavior

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match

File source: rkF1LTQVdi.elf, type: SAMPLE

Remote Access Functionality

Yara detected Mirai

Source: Yara match

File source: rkF1LTQVdi.elf, type: SAMPLE

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 File Deletion	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
rkF1LTQVdi.elf	61%	ReversingLabs	Linux.Backdoor.Mirai
rkF1LTQVdi.elf	44%	Virustotal		Browse
rkF1LTQVdi.elf	100%	Avira	EXP/ELF.Mirai.M
rkF1LTQVdi.elf	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
drumev.eu	93.123.85.140	true	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
93.123.85.140	drumev.eu	Bulgaria		43561	NET1-ASBG	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
93.123.85.140	gIZ1HFds2y.elf	Get hash	malicious	Mirai	Browse
	WiT9fhQAMr.elf	Get hash	malicious	Unknown	Browse
	cVtkSwoYAC.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	5smI0bod9g.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	YEyJiVhE6B.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	mf3iQi8rW7.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	RyELGNtI56.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	QsD8ELgChf.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	7m1uCqHKh2.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	52ErF0zM1V.elf	Get hash	malicious	Gafgyt, Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
drumev.eu	gIZ1HFds2y.elf	Get hash	malicious	Mirai	Browse	93.123.85.140
drumev.eu	WiT9fhQAMr.elf	Get hash	malicious	Unknown	Browse	93.123.85.140

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
NET1-ASBG	gIZ1HFds2y.elf	Get hash	malicious	Mirai	Browse	93.123.85.140
	WiT9fhQAMr.elf	Get hash	malicious	Unknown	Browse	93.123.85.140
	na.elf	Get hash	malicious	Gafgyt, Mirai	Browse	93.123.85.7
	na.elf	Get hash	malicious	Mirai	Browse	93.123.85.144
	na.elf	Get hash	malicious	Mirai	Browse	93.123.85.144
	na.elf	Get hash	malicious	Mirai	Browse	93.123.85.144
	N0xJhHp6pc.elf	Get hash	malicious	Mirai	Browse	93.123.85.144
	x0gGYx3yGe.elf	Get hash	malicious	Mirai	Browse	93.123.85.144
	OxsKbRJ60C.elf	Get hash	malicious	Mirai	Browse	93.123.85.144
	boatnet.arm.elf	Get hash	malicious	Mirai	Browse	93.123.85.144

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, not stripped
Entropy (8bit):	6.301895830755701
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	rkF1LTQVdi.elf
File size:	67'896 bytes
MD5:	b813f066d458837d59d7d515e20e5596
SHA1:	a01cabd9cc36271a9f6505a01cb3b10737a225b8
SHA256:	1a58bf62d288351f3ff52933417dbabdb5a1d71c3d45d16d7367dadbce9b70e4
SHA512:	3ccee4ea01e7bd1d987079a1948958738aadc166915c31274970b2a1c4ef8cebaed0888d0bcd11c4a6e8551cb9cdb926eb3630ce1e874d215cf3ebbfe4ea2b50
SSDEEP:	768:ISim0ETe1AGzgEdtIskA1yRNj31dHwoZDZ+LS3hTMyKyYzjY6zOJblUmkjHDL:ISim9M1dtIs1yRNj311/DZ+LmzqYYjjL
TLSH:	E9633B4592A2E6F3D8821F3515E3EB321731E8772B5D5E03E3ADAEF45E81588704B21D
File Content Preview:	.ELF........................4...4.......4. ...(.....................<...<....................0...0..x....8..............L...L5..L5..................Q.td............................U..S............h........[]...$.............U......=.7...t..5....p5.....p5.

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8048184
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	4
Section Header Offset:	49716
Section Header Size:	40
Number of Section Headers:	19
Header String Table Index:	16

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80480b4	0xb4	0x1c	0x0	0x6	AX	0	0	1
.text	PROGBITS	0x80480d0	0xd0	0xa1e7	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x80522b7	0xa2b7	0x17	0x0	0x6	AX	0	0	1
.rodata	PROGBITS	0x80522d0	0xa2d0	0xc6c	0x0	0x2	A	0	0	4
.eh_frame	PROGBITS	0x8053000	0xb000	0x54c	0x0	0x3	WA	0	0	4
.tbss	NOBITS	0x805354c	0xb54c	0x8	0x0	0x403	WAT	0	0	4
.ctors	PROGBITS	0x805354c	0xb54c	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x8053554	0xb554	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x805355c	0xb55c	0x4	0x0	0x3	WA	0	0	4
.got.plt	PROGBITS	0x8053560	0xb560	0xc	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x805356c	0xb56c	0x20c	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x8053780	0xb778	0x3098	0x0	0x3	WA	0	0	32
.stab	PROGBITS	0x0	0xb778	0xfc	0xc	0x0		14	0	4
.stabstr	STRTAB	0x0	0xb874	0xdb	0x0	0x0		0	0	1
.comment	PROGBITS	0x0	0xb94f	0x85e	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0xc1ad	0x84	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0xc52c	0x26e0	0x10	0x0		18	232	4
.strtab	STRTAB	0x0	0xec0c	0x1d2c	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8048000	0x8048000	0xaf3c	0xaf3c	6.4422	0x5	R E	0x1000	.init .text .fini .rodata
LOAD	0xb000	0x8053000	0x8053000	0x778	0x3818	4.6877	0x6	RW	0x1000	.eh_frame .tbss .ctors .dtors .jcr .got.plt .data .bss
TLS	0xb54c	0x805354c	0x805354c	0x0	0x8	0.0000	0x4	R	0x4	.tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x80480b4	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80480d0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x80522b7	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x80522d0	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x8053000	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x805354c	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x805354c	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x8053554	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x805355c	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x8053560	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x805356c	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x8053780	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
C.11.5136	.symtab	0x8052808	24	OBJECT	<unknown>	DEFAULT	4
LOCAL_ADDR	.symtab	0x8056280	4	OBJECT	<unknown>	DEFAULT	12
POPBX1	.symtab	0x805016f	0	NOTYPE	<unknown>	DEFAULT	2
POPBX1	.symtab	0x80501cf	0	NOTYPE	<unknown>	DEFAULT	2
POPBX1	.symtab	0x805022f	0	NOTYPE	<unknown>	DEFAULT	2
PUSHBX1	.symtab	0x805015b	0	NOTYPE	<unknown>	DEFAULT	2
PUSHBX1	.symtab	0x80501bb	0	NOTYPE	<unknown>	DEFAULT	2
PUSHBX1	.symtab	0x805021b	0	NOTYPE	<unknown>	DEFAULT	2
RESTBX1	.symtab	0x8050119	0	NOTYPE	<unknown>	DEFAULT	2
SAVEBX1	.symtab	0x805010c	0	NOTYPE	<unknown>	DEFAULT	2
_Exit	.symtab	0x8050724	66	FUNC	<unknown>	DEFAULT	2
_GLOBAL_OFFSET_TABLE_	.symtab	0x8053560	0	OBJECT	<unknown>	HIDDEN	10
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_L_lock_103	.symtab	0x8051002	16	FUNC	<unknown>	DEFAULT	2
_L_lock_12	.symtab	0x8051873	16	FUNC	<unknown>	DEFAULT	2
_L_lock_140	.symtab	0x80518b3	16	FUNC	<unknown>	DEFAULT	2
_L_lock_160	.symtab	0x80518d3	16	FUNC	<unknown>	DEFAULT	2
_L_lock_17	.symtab	0x805155e	10	FUNC	<unknown>	DEFAULT	2
_L_lock_18	.symtab	0x8050fc8	13	FUNC	<unknown>	DEFAULT	2
_L_lock_191	.symtab	0x80518f3	13	FUNC	<unknown>	DEFAULT	2
_L_lock_198	.symtab	0x80512d0	16	FUNC	<unknown>	DEFAULT	2
_L_lock_209	.symtab	0x80512e0	16	FUNC	<unknown>	DEFAULT	2
_L_lock_29	.symtab	0x8051883	16	FUNC	<unknown>	DEFAULT	2
_L_lock_32	.symtab	0x80514d1	10	FUNC	<unknown>	DEFAULT	2
_L_lock_54	.symtab	0x8050fd5	16	FUNC	<unknown>	DEFAULT	2
_L_lock_70	.symtab	0x804ff7c	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_102	.symtab	0x80518a3	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_113	.symtab	0x8051012	13	FUNC	<unknown>	DEFAULT	2
_L_unlock_152	.symtab	0x80518c3	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_167	.symtab	0x804ff8c	13	FUNC	<unknown>	DEFAULT	2
_L_unlock_170	.symtab	0x80518e3	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_225	.symtab	0x80512f0	13	FUNC	<unknown>	DEFAULT	2
_L_unlock_232	.symtab	0x8051900	13	FUNC	<unknown>	DEFAULT	2
_L_unlock_235	.symtab	0x80512fd	13	FUNC	<unknown>	DEFAULT	2
_L_unlock_40	.symtab	0x8051568	10	FUNC	<unknown>	DEFAULT	2
_L_unlock_61	.symtab	0x80514db	10	FUNC	<unknown>	DEFAULT	2
_L_unlock_66	.symtab	0x8050fe5	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_83	.symtab	0x8050ff5	13	FUNC	<unknown>	DEFAULT	2
_L_unlock_86	.symtab	0x8051893	16	FUNC	<unknown>	DEFAULT	2
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x8053550	0	OBJECT	<unknown>	DEFAULT	7
__CTOR_LIST__	.symtab	0x805354c	0	OBJECT	<unknown>	DEFAULT	7
__C_ctype_b	.symtab	0x8053688	4	OBJECT	<unknown>	DEFAULT	11
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x8052c3c	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x8053558	0	OBJECT	<unknown>	DEFAULT	8
__DTOR_LIST__	.symtab	0x8053554	0	OBJECT	<unknown>	DEFAULT	8
__EH_FRAME_BEGIN__	.symtab	0x8053000	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x8053548	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x8053688	4	OBJECT	<unknown>	HIDDEN	11
__GI___close	.symtab	0x8050100	80	FUNC	<unknown>	HIDDEN	2
__GI___close_nocancel	.symtab	0x805010a	27	FUNC	<unknown>	HIDDEN	2
__GI___ctype_b	.symtab	0x805368c	4	OBJECT	<unknown>	HIDDEN	11
__GI___errno_location	.symtab	0x804e210	13	FUNC	<unknown>	HIDDEN	2
__GI___fcntl_nocancel	.symtab	0x804dc54	83	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x8051910	204	FUNC	<unknown>	HIDDEN	2
__GI___libc_close	.symtab	0x8050100	80	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x804dca7	153	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x8050150	91	FUNC	<unknown>	HIDDEN	2
__GI___libc_read	.symtab	0x8050210	91	FUNC	<unknown>	HIDDEN	2
__GI___libc_write	.symtab	0x80501b0	91	FUNC	<unknown>	HIDDEN	2
__GI___open	.symtab	0x8050150	91	FUNC	<unknown>	HIDDEN	2
__GI___open_nocancel	.symtab	0x805015a	33	FUNC	<unknown>	HIDDEN	2
__GI___read	.symtab	0x8050210	91	FUNC	<unknown>	HIDDEN	2
__GI___read_nocancel	.symtab	0x805021a	33	FUNC	<unknown>	HIDDEN	2
__GI___sigaddset	.symtab	0x804e694	32	FUNC	<unknown>	HIDDEN	2
__GI___sigdelset	.symtab	0x804e6b4	32	FUNC	<unknown>	HIDDEN	2
__GI___sigismember	.symtab	0x804e670	36	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x8050343	56	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x80503a7	39	FUNC	<unknown>	HIDDEN	2
__GI___write	.symtab	0x80501b0	91	FUNC	<unknown>	HIDDEN	2
__GI___write_nocancel	.symtab	0x80501ba	33	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x8050724	66	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x804f610	191	FUNC	<unknown>	HIDDEN	2
__GI_bind	.symtab	0x804e2c4	40	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x8051f74	44	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x8050100	80	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0x804df94	130	FUNC	<unknown>	HIDDEN	2
__GI_config_close	.symtab	0x8050df2	44	FUNC	<unknown>	HIDDEN	2
__GI_config_open	.symtab	0x8050e1e	44	FUNC	<unknown>	HIDDEN	2
__GI_config_read	.symtab	0x8050b88	618	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x804e2ec	84	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x804fa40	93	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x8050e4c	380	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x804dca7	153	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x80516b4	447	FUNC	<unknown>	HIDDEN	2
__GI_fgetc	.symtab	0x8051440	145	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x8051910	204	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x80514e8	118	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x80519dc	94	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x8051020	21	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x804fd70	524	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x8050768	70	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x8051910	204	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x8050834	32	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x8050854	8	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x805085c	8	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x8050864	8	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x805086c	19	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x804ff9c	49	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x8050880	43	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x804e340	40	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x80508ac	8	FUNC	<unknown>	HIDDEN	2
__GI_inet_addr	.symtab	0x804e2a4	31	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x8051bc8	148	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x804f903	155	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x804dd48	139	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x8051b4c	27	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x804ddd4	43	FUNC	<unknown>	HIDDEN	2
__GI_listen	.symtab	0x804e3a0	32	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x8052228	90	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x804e244	41	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x8051a3c	37	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x8052208	30	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x804e270	50	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x80506a4	27	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x80508b4	59	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x80508f0	43	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x8050945	61	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x8050150	91	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0x804e0a0	132	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x804ffd0	100	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x804f6d8	66	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x804f804	95	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x8050210	91	FUNC	<unknown>	HIDDEN	2
__GI_readdir	.symtab	0x804e190	127	FUNC	<unknown>	HIDDEN	2
__GI_readdir64	.symtab	0x8050b04	129	FUNC	<unknown>	HIDDEN	2
__GI_readlink	.symtab	0x804de00	47	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x804e3c0	92	FUNC	<unknown>	HIDDEN	2
__GI_recvfrom	.symtab	0x804e41c	108	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x8050984	64	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x804de69	108	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x804e488	92	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x804e4e4	108	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x804ded8	31	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x804e550	56	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x804f99e	161	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x805062f	80	FUNC	<unknown>	HIDDEN	2
__GI_sigaddset	.symtab	0x804e5b0	34	FUNC	<unknown>	HIDDEN	2
__GI_sigemptyset	.symtab	0x804e5d4	20	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x804e5e8	136	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x804def8	97	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x8050034	195	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x804e588	40	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x804f863	160	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x8051a64	30	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul	.symtab	0x8051a84	25	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x8051aa0	29	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x8051aa0	29	FUNC	<unknown>	HIDDEN	2
__GI_strcspn	.symtab	0x8051af0	45	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x8051ac0	19	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x8051ad4	26	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x8051b20	42	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x804fb64	523	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x8051b68	96	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x804df5c	16	FUNC	<unknown>	HIDDEN	2
__GI_times	.symtab	0x80509c4	16	FUNC	<unknown>	HIDDEN	2
__GI_unlink	.symtab	0x804df6c	39	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x80501b0	91	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x805355c	0	OBJECT	<unknown>	DEFAULT	9
__JCR_LIST__	.symtab	0x805355c	0	OBJECT	<unknown>	DEFAULT	9
__app_fini	.symtab	0x8053d18	4	OBJECT	<unknown>	HIDDEN	12
__atexit_lock	.symtab	0x8053664	24	OBJECT	<unknown>	DEFAULT	11
__bss_start	.symtab	0x8053778	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x805037b	44	FUNC	<unknown>	DEFAULT	2
__close	.symtab	0x8050100	80	FUNC	<unknown>	DEFAULT	2
__close_nocancel	.symtab	0x805010a	27	FUNC	<unknown>	DEFAULT	2
__ctype_b	.symtab	0x805368c	4	OBJECT	<unknown>	DEFAULT	11
__curbrk	.symtab	0x805627c	4	OBJECT	<unknown>	HIDDEN	12
__deregister_frame_info_bases	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__do_global_ctors_aux	.symtab	0x8052290	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x80480e0	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x805356c	0	OBJECT	<unknown>	HIDDEN	11
__environ	.symtab	0x8053d10	4	OBJECT	<unknown>	DEFAULT	12
__errno_location	.symtab	0x804e210	13	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x80537c0	4	OBJECT	<unknown>	HIDDEN	12
__fcntl_nocancel	.symtab	0x804dc54	83	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x8051910	204	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x805354c	0	NOTYPE	<unknown>	HIDDEN	6
__fini_array_start	.symtab	0x805354c	0	NOTYPE	<unknown>	HIDDEN	6
__fork	.symtab	0x804fd70	524	FUNC	<unknown>	DEFAULT	2
__fork_generation_pointer	.symtab	0x80567e8	4	OBJECT	<unknown>	HIDDEN	12
__fork_handlers	.symtab	0x80567ec	4	OBJECT	<unknown>	HIDDEN	12
__fork_lock	.symtab	0x80537c4	4	OBJECT	<unknown>	HIDDEN	12
__get_pc_thunk_bx	.symtab	0x80480d0	0	FUNC	<unknown>	HIDDEN	2
__getdents	.symtab	0x80507b0	131	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x8051fa0	280	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x805086c	19	FUNC	<unknown>	DEFAULT	2
__getpid	.symtab	0x804ff9c	49	FUNC	<unknown>	DEFAULT	2
__h_errno_location	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__init_array_end	.symtab	0x805354c	0	NOTYPE	<unknown>	HIDDEN	6
__init_array_start	.symtab	0x805354c	0	NOTYPE	<unknown>	HIDDEN	6
__libc_close	.symtab	0x8050100	80	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x804e2ec	84	FUNC	<unknown>	DEFAULT	2
__libc_disable_asynccancel	.symtab	0x805026c	86	FUNC	<unknown>	HIDDEN	2
__libc_enable_asynccancel	.symtab	0x80502c2	79	FUNC	<unknown>	HIDDEN	2
__libc_errno	.symtab	0x0	4	TLS	<unknown>	HIDDEN	6
__libc_fcntl	.symtab	0x804dca7	153	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x804fd70	524	FUNC	<unknown>	DEFAULT	2
__libc_h_errno	.symtab	0x4	4	TLS	<unknown>	HIDDEN	6
__libc_nanosleep	.symtab	0x8050945	61	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x8050150	91	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x8050210	91	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x804e3c0	92	FUNC	<unknown>	DEFAULT	2
__libc_recvfrom	.symtab	0x804e41c	108	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x804de69	108	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x804e488	92	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x804e4e4	108	FUNC	<unknown>	DEFAULT	2
__libc_setup_tls	.symtab	0x8051d0a	513	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x805062f	80	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x8053d0c	4	OBJECT	<unknown>	DEFAULT	12
__libc_write	.symtab	0x80501b0	91	FUNC	<unknown>	DEFAULT	2
__lll_lock_wait_private	.symtab	0x8051c60	40	FUNC	<unknown>	HIDDEN	2
__lll_unlock_wake_private	.symtab	0x8051c90	32	FUNC	<unknown>	HIDDEN	2
__malloc_consolidate	.symtab	0x804f2e9	379	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x804e6d4	38	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x8053588	24	OBJECT	<unknown>	DEFAULT	11
__malloc_state	.symtab	0x8056470	888	OBJECT	<unknown>	DEFAULT	12
__malloc_trim	.symtab	0x804f26c	125	FUNC	<unknown>	DEFAULT	2
__nptl_deallocate_tsd	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__nptl_nthreads	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__open	.symtab	0x8050150	91	FUNC	<unknown>	DEFAULT	2
__open_nocancel	.symtab	0x805015a	33	FUNC	<unknown>	DEFAULT	2
__pagesize	.symtab	0x8053d14	4	OBJECT	<unknown>	DEFAULT	12
__preinit_array_end	.symtab	0x805354c	0	NOTYPE	<unknown>	HIDDEN	6
__preinit_array_start	.symtab	0x805354c	0	NOTYPE	<unknown>	HIDDEN	6
__progname	.symtab	0x8053680	4	OBJECT	<unknown>	DEFAULT	11
__progname_full	.symtab	0x8053684	4	OBJECT	<unknown>	DEFAULT	11
__pthread_initialize_minimal	.symtab	0x8051f0b	15	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_init	.symtab	0x8050317	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x8050314	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x8050314	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x8050314	3	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x8050314	3	FUNC	<unknown>	DEFAULT	2
__pthread_unwind	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__read	.symtab	0x8050210	91	FUNC	<unknown>	DEFAULT	2
__read_nocancel	.symtab	0x805021a	33	FUNC	<unknown>	DEFAULT	2
__register_frame_info_bases	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__restore	.symtab	0x8050627	0	NOTYPE	<unknown>	DEFAULT	2
__restore_rt	.symtab	0x8050620	0	NOTYPE	<unknown>	DEFAULT	2
__rtld_fini	.symtab	0x8053d1c	4	OBJECT	<unknown>	HIDDEN	12
__sigaddset	.symtab	0x804e694	32	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x804e6b4	32	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x804e670	36	FUNC	<unknown>	DEFAULT	2
__socketcall	.symtab	0x80506c0	43	FUNC	<unknown>	HIDDEN	2
__socketcall.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__stdin	.symtab	0x805369c	4	OBJECT	<unknown>	DEFAULT	11
__stdio_READ	.symtab	0x80520b8	62	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x80520f8	139	FUNC	<unknown>	HIDDEN	2
__stdio_rfill	.symtab	0x8052184	37	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x80521ac	92	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x8051418	37	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x80536a0	4	OBJECT	<unknown>	DEFAULT	11
__syscall_error	.symtab	0x8050610	15	FUNC	<unknown>	HIDDEN	2
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_nanosleep	.symtab	0x805091c	41	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction	.symtab	0x80506ec	53	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_select	.symtab	0x804de30	57	FUNC	<unknown>	DEFAULT	2
__uClibc_fini	.symtab	0x8050343	56	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x80503a7	39	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x80503ce	577	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x805367c	4	OBJECT	<unknown>	HIDDEN	11
__write	.symtab	0x80501b0	91	FUNC	<unknown>	DEFAULT	2
__write_nocancel	.symtab	0x80501ba	33	FUNC	<unknown>	DEFAULT	2
__xstat32_conv	.symtab	0x8050a77	138	FUNC	<unknown>	HIDDEN	2
__xstat64_conv	.symtab	0x80509d4	163	FUNC	<unknown>	HIDDEN	2
_dl_aux_init	.symtab	0x8051f1c	18	FUNC	<unknown>	DEFAULT	2
_dl_nothread_init_static_tls	.symtab	0x8051f2e	68	FUNC	<unknown>	HIDDEN	2
_dl_phdr	.symtab	0x8056810	4	OBJECT	<unknown>	DEFAULT	12
_dl_phnum	.symtab	0x8056814	4	OBJECT	<unknown>	DEFAULT	12
_dl_tls_dtv_gaps	.symtab	0x8056804	1	OBJECT	<unknown>	DEFAULT	12
_dl_tls_dtv_slotinfo_list	.symtab	0x8056800	4	OBJECT	<unknown>	DEFAULT	12
_dl_tls_generation	.symtab	0x8056808	4	OBJECT	<unknown>	DEFAULT	12
_dl_tls_max_dtv_idx	.symtab	0x80567f8	4	OBJECT	<unknown>	DEFAULT	12
_dl_tls_setup	.symtab	0x8051cda	48	FUNC	<unknown>	DEFAULT	2
_dl_tls_static_align	.symtab	0x80567f4	4	OBJECT	<unknown>	DEFAULT	12
_dl_tls_static_nelem	.symtab	0x805680c	4	OBJECT	<unknown>	DEFAULT	12
_dl_tls_static_size	.symtab	0x80567fc	4	OBJECT	<unknown>	DEFAULT	12
_dl_tls_static_used	.symtab	0x80567f0	4	OBJECT	<unknown>	DEFAULT	12
_edata	.symtab	0x8053778	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x8056818	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_exit	.symtab	0x8050724	66	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x80522b7	0	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x8053d40	8192	OBJECT	<unknown>	DEFAULT	12
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_init	.symtab	0x80480b4	0	FUNC	<unknown>	DEFAULT	1
_pthread_cleanup_pop_restore	.symtab	0x805032c	23	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x805031a	18	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_setjmp	.symtab	0x8050680	34	FUNC	<unknown>	DEFAULT	2
_sigintr	.symtab	0x8056468	8	OBJECT	<unknown>	HIDDEN	12
_start	.symtab	0x8048184	34	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x8051038	664	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x805130c	59	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x80536a4	4	OBJECT	<unknown>	DEFAULT	11
_stdio_openlist_add_lock	.symtab	0x8053d20	12	OBJECT	<unknown>	DEFAULT	12
_stdio_openlist_dec_use	.symtab	0x8051574	320	FUNC	<unknown>	HIDDEN	2
_stdio_openlist_del_count	.symtab	0x8053d3c	4	OBJECT	<unknown>	DEFAULT	12
_stdio_openlist_del_lock	.symtab	0x8053d2c	12	OBJECT	<unknown>	DEFAULT	12
_stdio_openlist_use_count	.symtab	0x8053d38	4	OBJECT	<unknown>	DEFAULT	12
_stdio_streams	.symtab	0x80536ac	204	OBJECT	<unknown>	DEFAULT	11
_stdio_term	.symtab	0x8051347	208	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x80536a8	4	OBJECT	<unknown>	DEFAULT	11
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x804f610	191	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
anti_gdb_entry	.symtab	0x804bd80	11	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack_get_opt_int	.symtab	0x80485b0	109	FUNC	<unknown>	DEFAULT	2
attack_get_opt_ip	.symtab	0x8048540	101	FUNC	<unknown>	DEFAULT	2
attack_get_opt_str	.symtab	0x80481b0	92	FUNC	<unknown>	DEFAULT	2
attack_init	.symtab	0x8048620	392	FUNC	<unknown>	DEFAULT	2
attack_method_http	.symtab	0x80487b0	7497	FUNC	<unknown>	DEFAULT	2
attack_method_tcpack	.symtab	0x804a7b0	1471	FUNC	<unknown>	DEFAULT	2
attack_method_tcpsyn	.symtab	0x804ad70	1526	FUNC	<unknown>	DEFAULT	2
attack_method_udpgeneric	.symtab	0x804b370	688	FUNC	<unknown>	DEFAULT	2
attack_method_udpplain	.symtab	0x804a500	683	FUNC	<unknown>	DEFAULT	2
attack_parse	.symtab	0x80482d0	613	FUNC	<unknown>	DEFAULT	2
attack_start	.symtab	0x8048210	192	FUNC	<unknown>	DEFAULT	2
attacks.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
been_there_done_that	.symtab	0x80537bc	1	OBJECT	<unknown>	DEFAULT	12
bind	.symtab	0x804e2c4	40	FUNC	<unknown>	DEFAULT	2
bind.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
brk	.symtab	0x8051f74	44	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x804e5e8	136	FUNC	<unknown>	DEFAULT	2
calloc	.symtab	0x804ee84	236	FUNC	<unknown>	DEFAULT	2
calloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
checksum.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
checksum_generic	.symtab	0x804b620	70	FUNC	<unknown>	DEFAULT	2
checksum_tcpudp	.symtab	0x804b670	169	FUNC	<unknown>	DEFAULT	2
clock	.symtab	0x804e220	34	FUNC	<unknown>	DEFAULT	2
clock.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x8050100	80	FUNC	<unknown>	DEFAULT	2
closedir	.symtab	0x804df94	130	FUNC	<unknown>	DEFAULT	2
closedir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
completed.4963	.symtab	0x8053780	1	OBJECT	<unknown>	DEFAULT	12
connect	.symtab	0x804e2ec	84	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ensure_single_instance	.symtab	0x804bd90	311	FUNC	<unknown>	DEFAULT	2
environ	.symtab	0x8053d10	4	OBJECT	<unknown>	DEFAULT	12
errno	.symtab	0x0	4	TLS	<unknown>	DEFAULT	6
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x804fa40	93	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fclose	.symtab	0x8050e4c	380	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x804dca7	153	FUNC	<unknown>	DEFAULT	2
fd_ctrl	.symtab	0x8053574	4	OBJECT	<unknown>	DEFAULT	11
fd_serv	.symtab	0x8053578	4	OBJECT	<unknown>	DEFAULT	11
fd_to_DIR	.symtab	0x804e018	136	FUNC	<unknown>	DEFAULT	2
fdopendir	.symtab	0x804e124	108	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x80516b4	447	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc	.symtab	0x8051440	145	FUNC	<unknown>	DEFAULT	2
fgetc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x8051910	204	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x80514e8	118	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x80519dc	94	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fopen	.symtab	0x8051020	21	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0x804fd70	524	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork_handler_pool	.symtab	0x80537c8	1348	OBJECT	<unknown>	DEFAULT	12
frame_dummy	.symtab	0x8048130	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x804f464	399	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fstat	.symtab	0x8050768	70	FUNC	<unknown>	DEFAULT	2
fstat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getc	.symtab	0x8051440	145	FUNC	<unknown>	DEFAULT	2
getc_unlocked	.symtab	0x8051910	204	FUNC	<unknown>	DEFAULT	2
getdents.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdents64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdtablesize	.symtab	0x8050834	32	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x8050854	8	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x805085c	8	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x8050864	8	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpagesize	.symtab	0x805086c	19	FUNC	<unknown>	DEFAULT	2
getpagesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x804ff9c	49	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getppid	.symtab	0x804dd40	8	FUNC	<unknown>	DEFAULT	2
getppid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x8050880	43	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockname	.symtab	0x804e340	40	FUNC	<unknown>	DEFAULT	2
getsockname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x804e368	56	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x80508ac	8	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
h_errno	.symtab	0x4	4	TLS	<unknown>	DEFAULT	6
index	.symtab	0x8051a64	30	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x804e2a4	31	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x8051bc8	148	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
init_static_tls	.symtab	0x8051cb0	42	FUNC	<unknown>	DEFAULT	2
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initstate	.symtab	0x804f771	85	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x804f903	155	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x804dd48	139	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isatty	.symtab	0x8051b4c	27	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0x804ddd4	43	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
killer.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
killer_kill_by_port	.symtab	0x804b720	1621	FUNC	<unknown>	DEFAULT	2
libc-cancellation.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc-tls.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
listen	.symtab	0x804e3a0	32	FUNC	<unknown>	DEFAULT	2
listen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
local_bind.4588	.symtab	0x8053580	1	OBJECT	<unknown>	DEFAULT	11
lseek64	.symtab	0x8052228	90	FUNC	<unknown>	DEFAULT	2
main	.symtab	0x804c030	1674	FUNC	<unknown>	DEFAULT	2
main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
malloc	.symtab	0x804e6fa	1928	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
malloc_trim	.symtab	0x804f5f3	29	FUNC	<unknown>	DEFAULT	2
memcpy	.symtab	0x804e244	41	FUNC	<unknown>	DEFAULT	2
memcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memmove	.symtab	0x8051a3c	37	FUNC	<unknown>	DEFAULT	2
memmove.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mempcpy	.symtab	0x8052208	30	FUNC	<unknown>	DEFAULT	2
mempcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x804e270	50	FUNC	<unknown>	DEFAULT	2
memset.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
methods	.symtab	0x80537a0	4	OBJECT	<unknown>	DEFAULT	12
methods_len	.symtab	0x805379c	1	OBJECT	<unknown>	DEFAULT	12
mmap	.symtab	0x80506a4	27	FUNC	<unknown>	DEFAULT	2
mremap	.symtab	0x80508b4	59	FUNC	<unknown>	DEFAULT	2
mremap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
munmap	.symtab	0x80508f0	43	FUNC	<unknown>	DEFAULT	2
munmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mylock	.symtab	0x80535a0	24	OBJECT	<unknown>	DEFAULT	11
mylock	.symtab	0x80535b8	24	OBJECT	<unknown>	DEFAULT	11
nanosleep	.symtab	0x8050945	61	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
nprocessors_onln	.symtab	0x804faa0	196	FUNC	<unknown>	DEFAULT	2
object.4975	.symtab	0x8053784	24	OBJECT	<unknown>	DEFAULT	12
open	.symtab	0x8050150	91	FUNC	<unknown>	DEFAULT	2
opendir	.symtab	0x804e0a0	132	FUNC	<unknown>	DEFAULT	2
opendir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
p.4961	.symtab	0x8053570	0	OBJECT	<unknown>	DEFAULT	11
parse_config.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pending_connection	.symtab	0x80537a8	1	OBJECT	<unknown>	DEFAULT	12
program_invocation_name	.symtab	0x8053684	4	OBJECT	<unknown>	DEFAULT	11
program_invocation_short_name	.symtab	0x8053680	4	OBJECT	<unknown>	DEFAULT	11
pseudo_cancel	.symtab	0x8050125	0	NOTYPE	<unknown>	DEFAULT	2
pseudo_cancel	.symtab	0x805017b	0	NOTYPE	<unknown>	DEFAULT	2
pseudo_cancel	.symtab	0x80501db	0	NOTYPE	<unknown>	DEFAULT	2
pseudo_cancel	.symtab	0x805023b	0	NOTYPE	<unknown>	DEFAULT	2
pseudo_end	.symtab	0x805014f	0	NOTYPE	<unknown>	DEFAULT	2
pseudo_end	.symtab	0x80501aa	0	NOTYPE	<unknown>	DEFAULT	2
pseudo_end	.symtab	0x805020a	0	NOTYPE	<unknown>	DEFAULT	2
pseudo_end	.symtab	0x805026a	0	NOTYPE	<unknown>	DEFAULT	2
raise	.symtab	0x804ffd0	100	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x804f6d0	5	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand_init	.symtab	0x804c700	63	FUNC	<unknown>	DEFAULT	2
rand_next	.symtab	0x804c6c0	64	FUNC	<unknown>	DEFAULT	2
rand_str	.symtab	0x804c740	218	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x804f6d8	66	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x8052820	10	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x804f804	95	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randtbl	.symtab	0x80535e4	128	OBJECT	<unknown>	DEFAULT	11
read	.symtab	0x8050210	91	FUNC	<unknown>	DEFAULT	2
readdir	.symtab	0x804e190	127	FUNC	<unknown>	DEFAULT	2
readdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
readdir64	.symtab	0x8050b04	129	FUNC	<unknown>	DEFAULT	2
readdir64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
readlink	.symtab	0x804de00	47	FUNC	<unknown>	DEFAULT	2
readlink.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
realloc	.symtab	0x804ef70	763	FUNC	<unknown>	DEFAULT	2
realloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recv	.symtab	0x804e3c0	92	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recvfrom	.symtab	0x804e41c	108	FUNC	<unknown>	DEFAULT	2
recvfrom.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
register-atfork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
resolv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
resolv_entries_free	.symtab	0x804c820	52	FUNC	<unknown>	DEFAULT	2
resolv_lookup	.symtab	0x804c860	1192	FUNC	<unknown>	DEFAULT	2
resolve_cnc_addr	.symtab	0x804bed0	138	FUNC	<unknown>	DEFAULT	2
resolve_func	.symtab	0x805357c	4	OBJECT	<unknown>	DEFAULT	11
rindex	.symtab	0x8051ad4	26	FUNC	<unknown>	DEFAULT	2
sbrk	.symtab	0x8050984	64	FUNC	<unknown>	DEFAULT	2
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
select	.symtab	0x804de69	108	FUNC	<unknown>	DEFAULT	2
select.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send	.symtab	0x804e488	92	FUNC	<unknown>	DEFAULT	2
send.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sendto	.symtab	0x804e4e4	108	FUNC	<unknown>	DEFAULT	2
sendto.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsid	.symtab	0x804ded8	31	FUNC	<unknown>	DEFAULT	2
setsid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsockopt	.symtab	0x804e550	56	FUNC	<unknown>	DEFAULT	2
setsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate	.symtab	0x804f71a	87	FUNC	<unknown>	DEFAULT	2
setstate_r	.symtab	0x804f99e	161	FUNC	<unknown>	DEFAULT	2
sigaction	.symtab	0x805062f	80	FUNC	<unknown>	DEFAULT	2
sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigaddset	.symtab	0x804e5b0	34	FUNC	<unknown>	DEFAULT	2
sigaddset.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigempty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigemptyset	.symtab	0x804e5d4	20	FUNC	<unknown>	DEFAULT	2
signal	.symtab	0x804e5e8	136	FUNC	<unknown>	DEFAULT	2
signal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigprocmask	.symtab	0x804def8	97	FUNC	<unknown>	DEFAULT	2
sigprocmask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigsetops.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sleep	.symtab	0x8050034	195	FUNC	<unknown>	DEFAULT	2
sleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket	.symtab	0x804e588	40	FUNC	<unknown>	DEFAULT	2
socket.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
srand	.symtab	0x804f7c6	61	FUNC	<unknown>	DEFAULT	2
srandom	.symtab	0x804f7c6	61	FUNC	<unknown>	DEFAULT	2
srandom_r	.symtab	0x804f863	160	FUNC	<unknown>	DEFAULT	2
srv_addr	.symtab	0x8056284	16	OBJECT	<unknown>	DEFAULT	12
static_dtv	.symtab	0x8055d40	512	OBJECT	<unknown>	DEFAULT	12
static_map	.symtab	0x8056248	52	OBJECT	<unknown>	DEFAULT	12
static_slotinfo	.symtab	0x8055f40	776	OBJECT	<unknown>	DEFAULT	12
stderr	.symtab	0x8053698	4	OBJECT	<unknown>	DEFAULT	11
stdin	.symtab	0x8053690	4	OBJECT	<unknown>	DEFAULT	11
stdout	.symtab	0x8053694	4	OBJECT	<unknown>	DEFAULT	11
strchr	.symtab	0x8051a64	30	FUNC	<unknown>	DEFAULT	2
strchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchrnul	.symtab	0x8051a84	25	FUNC	<unknown>	DEFAULT	2
strchrnul.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcmp	.symtab	0x8051aa0	29	FUNC	<unknown>	DEFAULT	2
strcmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcoll	.symtab	0x8051aa0	29	FUNC	<unknown>	DEFAULT	2
strcspn	.symtab	0x8051af0	45	FUNC	<unknown>	DEFAULT	2
strcspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strlen	.symtab	0x8051ac0	19	FUNC	<unknown>	DEFAULT	2
strlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strrchr	.symtab	0x8051ad4	26	FUNC	<unknown>	DEFAULT	2
strrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strspn	.symtab	0x8051b20	42	FUNC	<unknown>	DEFAULT	2
strspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sysconf	.symtab	0x804fb64	523	FUNC	<unknown>	DEFAULT	2
sysconf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
table	.symtab	0x80562a0	456	OBJECT	<unknown>	DEFAULT	12
table.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
table_init	.symtab	0x804ce40	2389	FUNC	<unknown>	DEFAULT	2
table_key	.symtab	0x8053584	4	OBJECT	<unknown>	DEFAULT	11
table_lock_val	.symtab	0x804cd40	114	FUNC	<unknown>	DEFAULT	2
table_retrieve_val	.symtab	0x804cd10	38	FUNC	<unknown>	DEFAULT	2
table_unlock_val	.symtab	0x804cdc0	114	FUNC	<unknown>	DEFAULT	2
tcgetattr	.symtab	0x8051b68	96	FUNC	<unknown>	DEFAULT	2
tcgetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
time	.symtab	0x804df5c	16	FUNC	<unknown>	DEFAULT	2
time.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
times	.symtab	0x80509c4	16	FUNC	<unknown>	DEFAULT	2
times.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
unlink	.symtab	0x804df6c	39	FUNC	<unknown>	DEFAULT	2
unlink.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
unsafe_state	.symtab	0x80535d0	20	OBJECT	<unknown>	DEFAULT	11
util.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
util_atoi	.symtab	0x804d8a0	245	FUNC	<unknown>	DEFAULT	2
util_fdgets	.symtab	0x804d9a0	76	FUNC	<unknown>	DEFAULT	2
util_itoa	.symtab	0x804db90	195	FUNC	<unknown>	DEFAULT	2
util_local_addr	.symtab	0x804d9f0	120	FUNC	<unknown>	DEFAULT	2
util_memcpy	.symtab	0x804d800	34	FUNC	<unknown>	DEFAULT	2
util_memsearch	.symtab	0x804d850	69	FUNC	<unknown>	DEFAULT	2
util_strcmp	.symtab	0x804daf0	73	FUNC	<unknown>	DEFAULT	2
util_strcpy	.symtab	0x804d7c0	50	FUNC	<unknown>	DEFAULT	2
util_stristr	.symtab	0x804da70	121	FUNC	<unknown>	DEFAULT	2
util_strlen	.symtab	0x804d7a0	24	FUNC	<unknown>	DEFAULT	2
util_strncmp	.symtab	0x804db40	79	FUNC	<unknown>	DEFAULT	2
util_zero	.symtab	0x804d830	26	FUNC	<unknown>	DEFAULT	2
w	.symtab	0x80537b8	4	OBJECT	<unknown>	DEFAULT	12
watchdog_maintain	.symtab	0x804bf60	208	FUNC	<unknown>	DEFAULT	2
watchdog_pid	.symtab	0x80537a4	4	OBJECT	<unknown>	DEFAULT	12
write	.symtab	0x80501b0	91	FUNC	<unknown>	DEFAULT	2
x	.symtab	0x80537ac	4	OBJECT	<unknown>	DEFAULT	12
xstatconv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
y	.symtab	0x80537b0	4	OBJECT	<unknown>	DEFAULT	12
z	.symtab	0x80537b4	4	OBJECT	<unknown>	DEFAULT	12

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 12, 2024 22:56:57.705466986 CEST	45044	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:56:57.710288048 CEST	31337	45044	93.123.85.140	192.168.2.13
Oct 12, 2024 22:56:57.710347891 CEST	45044	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:56:57.710381031 CEST	45044	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:56:57.715162992 CEST	31337	45044	93.123.85.140	192.168.2.13
Oct 12, 2024 22:56:57.715202093 CEST	45044	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:56:57.720079899 CEST	31337	45044	93.123.85.140	192.168.2.13
Oct 12, 2024 22:56:59.340699911 CEST	31337	45044	93.123.85.140	192.168.2.13
Oct 12, 2024 22:56:59.341221094 CEST	45044	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:56:59.346853971 CEST	31337	45044	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:00.349503040 CEST	45046	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:00.354285002 CEST	31337	45046	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:00.354346037 CEST	45046	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:00.354346037 CEST	45046	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:00.359127045 CEST	31337	45046	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:00.359184027 CEST	45046	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:00.364015102 CEST	31337	45046	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:01.981319904 CEST	31337	45046	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:01.981553078 CEST	45046	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:01.986582994 CEST	31337	45046	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:02.991753101 CEST	45048	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:02.997010946 CEST	31337	45048	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:02.997246981 CEST	45048	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:02.997246981 CEST	45048	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:03.002141953 CEST	31337	45048	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:03.002883911 CEST	45048	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:03.007751942 CEST	31337	45048	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:04.843724012 CEST	31337	45048	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:04.843900919 CEST	45048	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:04.848781109 CEST	31337	45048	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:04.848824978 CEST	45048	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:04.849059105 CEST	31337	45048	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:05.852444887 CEST	45050	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:05.857314110 CEST	31337	45050	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:05.857455969 CEST	45050	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:05.857500076 CEST	45050	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:05.862802982 CEST	31337	45050	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:05.862884998 CEST	45050	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:05.867712021 CEST	31337	45050	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:07.496732950 CEST	31337	45050	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:07.497083902 CEST	45050	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:07.502099991 CEST	31337	45050	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:08.509542942 CEST	45052	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:08.515798092 CEST	31337	45052	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:08.515917063 CEST	45052	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:08.515969992 CEST	45052	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:08.524550915 CEST	31337	45052	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:08.524609089 CEST	45052	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:08.533009052 CEST	31337	45052	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:10.135911942 CEST	31337	45052	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:10.136113882 CEST	45052	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:10.140954971 CEST	31337	45052	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:11.144619942 CEST	45054	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:11.149419069 CEST	31337	45054	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:11.149507999 CEST	45054	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:11.149559021 CEST	45054	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:11.154542923 CEST	31337	45054	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:11.154592991 CEST	45054	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:11.159440041 CEST	31337	45054	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:12.792028904 CEST	31337	45054	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:12.792325974 CEST	45054	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:12.797291040 CEST	31337	45054	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:13.800647974 CEST	45056	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:13.805517912 CEST	31337	45056	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:13.805649042 CEST	45056	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:13.805663109 CEST	45056	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:13.810611010 CEST	31337	45056	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:13.810688019 CEST	45056	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:13.815489054 CEST	31337	45056	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:15.453814983 CEST	31337	45056	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:15.454073906 CEST	45056	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:15.459026098 CEST	31337	45056	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:16.463541985 CEST	45058	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:16.468512058 CEST	31337	45058	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:16.468563080 CEST	45058	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:16.468588114 CEST	45058	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:16.473606110 CEST	31337	45058	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:16.473659039 CEST	45058	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:16.478579998 CEST	31337	45058	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:18.089207888 CEST	31337	45058	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:18.089411974 CEST	45058	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:18.094259977 CEST	31337	45058	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:19.097692013 CEST	45060	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:19.102991104 CEST	31337	45060	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:19.103096962 CEST	45060	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:19.103156090 CEST	45060	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:19.108195066 CEST	31337	45060	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:19.108313084 CEST	45060	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:19.113593102 CEST	31337	45060	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:20.763457060 CEST	31337	45060	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:20.763717890 CEST	45060	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:20.769772053 CEST	31337	45060	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:21.772916079 CEST	45062	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:21.777795076 CEST	31337	45062	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:21.777935028 CEST	45062	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:21.777935028 CEST	45062	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:21.782737017 CEST	31337	45062	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:21.782887936 CEST	45062	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:21.787790060 CEST	31337	45062	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:23.401904106 CEST	31337	45062	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:23.402091026 CEST	45062	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:23.407000065 CEST	31337	45062	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:24.410660982 CEST	45064	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:24.415481091 CEST	31337	45064	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:24.415554047 CEST	45064	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:24.415632010 CEST	45064	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:24.420452118 CEST	31337	45064	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:24.420516968 CEST	45064	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:24.425317049 CEST	31337	45064	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:26.063621044 CEST	31337	45064	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:26.063851118 CEST	45064	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:26.068814993 CEST	31337	45064	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:27.072037935 CEST	45066	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:27.076865911 CEST	31337	45066	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:27.076989889 CEST	45066	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:27.077033043 CEST	45066	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:27.082006931 CEST	31337	45066	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:27.082078934 CEST	45066	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:27.086880922 CEST	31337	45066	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:28.718312025 CEST	31337	45066	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:28.718600988 CEST	45066	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:28.723463058 CEST	31337	45066	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:29.726802111 CEST	45068	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:29.731630087 CEST	31337	45068	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:29.731713057 CEST	45068	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:29.731748104 CEST	45068	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:29.736576080 CEST	31337	45068	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:29.736639023 CEST	45068	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:29.741416931 CEST	31337	45068	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:31.375926971 CEST	31337	45068	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:31.376261950 CEST	45068	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:31.381180048 CEST	31337	45068	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:32.384658098 CEST	45070	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:32.389534950 CEST	31337	45070	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:32.389630079 CEST	45070	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:32.389651060 CEST	45070	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:32.394539118 CEST	31337	45070	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:32.394604921 CEST	45070	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:32.399517059 CEST	31337	45070	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:34.028472900 CEST	31337	45070	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:34.028701067 CEST	45070	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:34.033515930 CEST	31337	45070	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:35.037627935 CEST	45072	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:35.042385101 CEST	31337	45072	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:35.042519093 CEST	45072	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:35.042551994 CEST	45072	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:35.047348976 CEST	31337	45072	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:35.047418118 CEST	45072	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:35.052264929 CEST	31337	45072	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:36.691817045 CEST	31337	45072	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:36.692212105 CEST	45072	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:36.697271109 CEST	31337	45072	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:37.701656103 CEST	45074	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:37.706552029 CEST	31337	45074	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:37.706633091 CEST	45074	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:37.706748009 CEST	45074	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:37.711534977 CEST	31337	45074	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:37.711596966 CEST	45074	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:37.716425896 CEST	31337	45074	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:39.346757889 CEST	31337	45074	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:39.347037077 CEST	45074	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:39.351979971 CEST	31337	45074	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:40.356991053 CEST	45076	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:40.361838102 CEST	31337	45076	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:40.361958981 CEST	45076	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:40.361994028 CEST	45076	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:40.367019892 CEST	31337	45076	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:40.367084026 CEST	45076	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:40.372087002 CEST	31337	45076	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:41.995421886 CEST	31337	45076	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:41.995853901 CEST	45076	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:42.000647068 CEST	31337	45076	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:43.479739904 CEST	45078	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:43.487706900 CEST	31337	45078	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:43.487766027 CEST	45078	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:43.487807035 CEST	45078	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:43.494863033 CEST	31337	45078	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:43.494915009 CEST	45078	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:43.499744892 CEST	31337	45078	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:45.140028000 CEST	31337	45078	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:45.140171051 CEST	45078	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:45.144958019 CEST	31337	45078	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:46.148713112 CEST	45080	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:46.153556108 CEST	31337	45080	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:46.153646946 CEST	45080	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:46.153723001 CEST	45080	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:46.158559084 CEST	31337	45080	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:46.158627987 CEST	45080	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:46.163465977 CEST	31337	45080	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:47.794140100 CEST	31337	45080	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:47.794368982 CEST	45080	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:47.799271107 CEST	31337	45080	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:48.803519011 CEST	45082	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:48.808578968 CEST	31337	45082	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:48.808702946 CEST	45082	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:48.808816910 CEST	45082	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:48.814440012 CEST	31337	45082	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:48.814517975 CEST	45082	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:48.819369078 CEST	31337	45082	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:50.433350086 CEST	31337	45082	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:50.433640957 CEST	45082	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:50.438492060 CEST	31337	45082	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:51.442522049 CEST	45084	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:51.447504997 CEST	31337	45084	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:51.447643042 CEST	45084	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:51.447643042 CEST	45084	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:51.452965975 CEST	31337	45084	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:51.453088045 CEST	45084	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:51.458141088 CEST	31337	45084	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:53.093187094 CEST	31337	45084	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:53.093380928 CEST	45084	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:53.098165035 CEST	31337	45084	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:54.102191925 CEST	45086	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:54.107125044 CEST	31337	45086	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:54.107255936 CEST	45086	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:54.107296944 CEST	45086	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:54.112664938 CEST	31337	45086	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:54.112746954 CEST	45086	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:54.117674112 CEST	31337	45086	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:55.747602940 CEST	31337	45086	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:55.748241901 CEST	45086	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:55.753153086 CEST	31337	45086	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:56.756397963 CEST	45088	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:56.761370897 CEST	31337	45088	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:56.761450052 CEST	45088	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:56.761491060 CEST	45088	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:56.766370058 CEST	31337	45088	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:56.766413927 CEST	45088	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:56.771176100 CEST	31337	45088	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:58.408504963 CEST	31337	45088	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:58.408675909 CEST	45088	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:58.413559914 CEST	31337	45088	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:59.419570923 CEST	45090	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:59.426709890 CEST	31337	45090	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:59.426800966 CEST	45090	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:59.426863909 CEST	45090	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:59.433420897 CEST	31337	45090	93.123.85.140	192.168.2.13
Oct 12, 2024 22:57:59.433489084 CEST	45090	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:57:59.439110994 CEST	31337	45090	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:01.094510078 CEST	31337	45090	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:01.094654083 CEST	45090	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:01.099576950 CEST	31337	45090	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:02.103004932 CEST	45092	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:02.107840061 CEST	31337	45092	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:02.107947111 CEST	45092	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:02.107966900 CEST	45092	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:02.112917900 CEST	31337	45092	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:02.113002062 CEST	45092	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:02.117774010 CEST	31337	45092	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:03.747922897 CEST	31337	45092	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:03.748403072 CEST	45092	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:03.753305912 CEST	31337	45092	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:04.758219004 CEST	45094	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:04.763576984 CEST	31337	45094	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:04.763672113 CEST	45094	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:04.763756990 CEST	45094	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:04.769320965 CEST	31337	45094	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:04.769413948 CEST	45094	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:04.774616003 CEST	31337	45094	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:06.406985998 CEST	31337	45094	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:06.407342911 CEST	45094	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:06.412503004 CEST	31337	45094	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:07.420295000 CEST	45096	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:07.425508976 CEST	31337	45096	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:07.425642967 CEST	45096	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:07.425755978 CEST	45096	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:07.430593967 CEST	31337	45096	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:07.430661917 CEST	45096	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:07.435519934 CEST	31337	45096	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:09.060610056 CEST	31337	45096	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:09.061064959 CEST	45096	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:09.067564964 CEST	31337	45096	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:10.070509911 CEST	45098	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:10.075525999 CEST	31337	45098	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:10.075647116 CEST	45098	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:10.075679064 CEST	45098	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:10.080487967 CEST	31337	45098	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:10.080585003 CEST	45098	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:10.085345984 CEST	31337	45098	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:11.736865997 CEST	31337	45098	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:11.737586021 CEST	45098	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:11.742897987 CEST	31337	45098	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:12.749695063 CEST	45100	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:12.755094051 CEST	31337	45100	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:12.755464077 CEST	45100	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:12.755464077 CEST	45100	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:12.760881901 CEST	31337	45100	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:12.761224985 CEST	45100	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:12.766383886 CEST	31337	45100	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:14.391123056 CEST	31337	45100	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:14.391448021 CEST	45100	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:14.396311045 CEST	31337	45100	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:15.401170969 CEST	45102	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:15.406007051 CEST	31337	45102	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:15.406233072 CEST	45102	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:15.406440020 CEST	45102	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:15.411623001 CEST	31337	45102	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:15.411897898 CEST	45102	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:15.416816950 CEST	31337	45102	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:17.043869019 CEST	31337	45102	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:17.044172049 CEST	45102	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:17.049082994 CEST	31337	45102	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:18.054332018 CEST	45104	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:18.059741020 CEST	31337	45104	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:18.060126066 CEST	45104	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:18.060209990 CEST	45104	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:18.065643072 CEST	31337	45104	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:18.065854073 CEST	45104	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:18.071177959 CEST	31337	45104	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:19.685600996 CEST	31337	45104	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:19.685996056 CEST	45104	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:19.691060066 CEST	31337	45104	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:20.696201086 CEST	45106	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:20.701287031 CEST	31337	45106	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:20.701390982 CEST	45106	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:20.701467991 CEST	45106	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:20.706907034 CEST	31337	45106	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:20.707416058 CEST	45106	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:20.712852955 CEST	31337	45106	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:22.346395969 CEST	31337	45106	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:22.347059011 CEST	45106	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:22.352440119 CEST	31337	45106	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:23.415045977 CEST	45108	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:23.421191931 CEST	31337	45108	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:23.421336889 CEST	45108	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:23.421433926 CEST	45108	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:23.426316977 CEST	31337	45108	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:23.426476955 CEST	45108	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:23.431515932 CEST	31337	45108	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:25.062709093 CEST	31337	45108	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:25.063218117 CEST	45108	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:25.068329096 CEST	31337	45108	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:26.073060036 CEST	45110	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:26.078149080 CEST	31337	45110	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:26.078422070 CEST	45110	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:26.078423023 CEST	45110	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:26.083405018 CEST	31337	45110	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:26.083749056 CEST	45110	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:26.088752031 CEST	31337	45110	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:27.699750900 CEST	31337	45110	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:27.699913979 CEST	45110	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:27.705291986 CEST	31337	45110	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:28.708940983 CEST	45112	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:28.713887930 CEST	31337	45112	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:28.713959932 CEST	45112	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:28.714035988 CEST	45112	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:28.718859911 CEST	31337	45112	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:28.718924046 CEST	45112	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:28.723849058 CEST	31337	45112	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:30.342313051 CEST	31337	45112	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:30.342607975 CEST	45112	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:30.347454071 CEST	31337	45112	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:31.352516890 CEST	45114	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:31.357867002 CEST	31337	45114	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:31.358269930 CEST	45114	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:31.358269930 CEST	45114	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:31.364034891 CEST	31337	45114	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:31.364294052 CEST	45114	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:31.369693041 CEST	31337	45114	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:33.028167009 CEST	31337	45114	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:33.028796911 CEST	45114	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:33.034142971 CEST	31337	45114	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:34.039757013 CEST	45116	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:34.045320034 CEST	31337	45116	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:34.045675993 CEST	45116	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:34.045675993 CEST	45116	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:34.051168919 CEST	31337	45116	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:34.051412106 CEST	45116	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:34.056971073 CEST	31337	45116	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:35.674274921 CEST	31337	45116	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:35.674762964 CEST	45116	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:35.680711031 CEST	31337	45116	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:36.684370995 CEST	45118	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:36.689609051 CEST	31337	45118	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:36.689796925 CEST	45118	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:36.689821959 CEST	45118	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:36.695202112 CEST	31337	45118	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:36.695440054 CEST	45118	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:36.700691938 CEST	31337	45118	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:38.372723103 CEST	31337	45118	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:38.373083115 CEST	45118	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:38.378619909 CEST	31337	45118	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:39.383416891 CEST	45120	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:39.388705969 CEST	31337	45120	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:39.388994932 CEST	45120	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:39.389286995 CEST	45120	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:39.394201040 CEST	31337	45120	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:39.394393921 CEST	45120	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:39.399300098 CEST	31337	45120	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:41.072650909 CEST	31337	45120	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:41.073380947 CEST	45120	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:41.078218937 CEST	31337	45120	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:42.083781958 CEST	45122	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:42.089226961 CEST	31337	45122	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:42.089518070 CEST	45122	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:42.089518070 CEST	45122	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:42.094755888 CEST	31337	45122	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:42.095067024 CEST	45122	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:42.100446939 CEST	31337	45122	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:43.773574114 CEST	31337	45122	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:43.773909092 CEST	45122	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:43.778923988 CEST	31337	45122	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:44.785207033 CEST	45124	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:44.790906906 CEST	31337	45124	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:44.791040897 CEST	45124	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:44.791172981 CEST	45124	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:44.796549082 CEST	31337	45124	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:44.797002077 CEST	45124	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:44.802438021 CEST	31337	45124	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:46.476531029 CEST	31337	45124	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:46.476843119 CEST	45124	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:46.481700897 CEST	31337	45124	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:47.485805988 CEST	45126	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:47.491101980 CEST	31337	45126	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:47.491504908 CEST	45126	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:47.491504908 CEST	45126	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:47.496979952 CEST	31337	45126	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:47.497224092 CEST	45126	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:47.502348900 CEST	31337	45126	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:49.183357000 CEST	31337	45126	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:49.183676958 CEST	45126	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:49.188687086 CEST	31337	45126	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:50.191615105 CEST	45128	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:50.196530104 CEST	31337	45128	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:50.196623087 CEST	45128	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:50.196674109 CEST	45128	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:50.201481104 CEST	31337	45128	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:50.201560020 CEST	45128	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:50.206451893 CEST	31337	45128	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:51.882951975 CEST	31337	45128	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:51.883114100 CEST	45128	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:51.893978119 CEST	31337	45128	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:52.890985966 CEST	45130	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:52.895781040 CEST	31337	45130	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:52.895895958 CEST	45130	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:52.895895958 CEST	45130	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:52.900774002 CEST	31337	45130	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:52.900851011 CEST	31337	45130	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:52.900897026 CEST	45130	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:52.905745029 CEST	31337	45130	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:53.908308983 CEST	45132	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:53.913253069 CEST	31337	45132	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:53.913305044 CEST	45132	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:53.913336039 CEST	45132	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:53.918126106 CEST	31337	45132	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:53.918169022 CEST	45132	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:53.923005104 CEST	31337	45132	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:55.578243017 CEST	31337	45132	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:55.578644037 CEST	45132	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:55.583784103 CEST	31337	45132	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:56.587691069 CEST	45134	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:56.592623949 CEST	31337	45134	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:56.592717886 CEST	45134	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:56.592756987 CEST	45134	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:56.597556114 CEST	31337	45134	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:56.597623110 CEST	45134	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:56.602458000 CEST	31337	45134	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:58.277163029 CEST	31337	45134	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:58.277467012 CEST	45134	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:58.282340050 CEST	31337	45134	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:59.285197020 CEST	45136	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:59.290091038 CEST	31337	45136	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:59.290170908 CEST	45136	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:59.290185928 CEST	45136	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:59.295124054 CEST	31337	45136	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:59.295169115 CEST	45136	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:58:59.295551062 CEST	31337	45136	93.123.85.140	192.168.2.13
Oct 12, 2024 22:58:59.299981117 CEST	31337	45136	93.123.85.140	192.168.2.13
Oct 12, 2024 22:59:00.304498911 CEST	45138	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:59:00.309459925 CEST	31337	45138	93.123.85.140	192.168.2.13
Oct 12, 2024 22:59:00.309540033 CEST	45138	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:59:00.309602976 CEST	45138	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:59:00.314393044 CEST	31337	45138	93.123.85.140	192.168.2.13
Oct 12, 2024 22:59:00.314456940 CEST	45138	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:59:00.314593077 CEST	31337	45138	93.123.85.140	192.168.2.13
Oct 12, 2024 22:59:00.319287062 CEST	31337	45138	93.123.85.140	192.168.2.13
Oct 12, 2024 22:59:01.323894024 CEST	45140	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:59:01.328774929 CEST	31337	45140	93.123.85.140	192.168.2.13
Oct 12, 2024 22:59:01.328864098 CEST	45140	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:59:01.328917980 CEST	45140	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:59:01.333723068 CEST	31337	45140	93.123.85.140	192.168.2.13
Oct 12, 2024 22:59:01.333780050 CEST	45140	31337	192.168.2.13	93.123.85.140
Oct 12, 2024 22:59:01.333892107 CEST	31337	45140	93.123.85.140	192.168.2.13
Oct 12, 2024 22:59:01.338627100 CEST	31337	45140	93.123.85.140	192.168.2.13

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 12, 2024 22:56:57.698127031 CEST	35460	53	192.168.2.13	8.8.8.8
Oct 12, 2024 22:56:57.705389977 CEST	53	35460	8.8.8.8	192.168.2.13
Oct 12, 2024 22:57:00.342437983 CEST	43565	53	192.168.2.13	8.8.8.8
Oct 12, 2024 22:57:00.349410057 CEST	53	43565	8.8.8.8	192.168.2.13
Oct 12, 2024 22:57:02.983295918 CEST	58105	53	192.168.2.13	8.8.8.8
Oct 12, 2024 22:57:02.991548061 CEST	53	58105	8.8.8.8	192.168.2.13
Oct 12, 2024 22:57:05.845215082 CEST	39878	53	192.168.2.13	8.8.8.8
Oct 12, 2024 22:57:05.852355003 CEST	53	39878	8.8.8.8	192.168.2.13
Oct 12, 2024 22:57:08.498533010 CEST	47821	53	192.168.2.13	8.8.8.8
Oct 12, 2024 22:57:08.509408951 CEST	53	47821	8.8.8.8	192.168.2.13
Oct 12, 2024 22:57:11.137394905 CEST	36127	53	192.168.2.13	8.8.8.8
Oct 12, 2024 22:57:11.144493103 CEST	53	36127	8.8.8.8	192.168.2.13
Oct 12, 2024 22:57:13.793430090 CEST	40086	53	192.168.2.13	8.8.8.8
Oct 12, 2024 22:57:13.800559044 CEST	53	40086	8.8.8.8	192.168.2.13
Oct 12, 2024 22:57:16.455701113 CEST	45262	53	192.168.2.13	8.8.8.8
Oct 12, 2024 22:57:16.463453054 CEST	53	45262	8.8.8.8	192.168.2.13
Oct 12, 2024 22:57:19.090866089 CEST	48265	53	192.168.2.13	8.8.8.8
Oct 12, 2024 22:57:19.097520113 CEST	53	48265	8.8.8.8	192.168.2.13
Oct 12, 2024 22:57:21.765321016 CEST	35297	53	192.168.2.13	8.8.8.8
Oct 12, 2024 22:57:21.772360086 CEST	53	35297	8.8.8.8	192.168.2.13
Oct 12, 2024 22:57:24.403598070 CEST	41784	53	192.168.2.13	8.8.8.8
Oct 12, 2024 22:57:24.410434961 CEST	53	41784	8.8.8.8	192.168.2.13
Oct 12, 2024 22:57:27.065113068 CEST	54848	53	192.168.2.13	8.8.8.8
Oct 12, 2024 22:57:27.071908951 CEST	53	54848	8.8.8.8	192.168.2.13
Oct 12, 2024 22:57:29.720264912 CEST	60919	53	192.168.2.13	8.8.8.8
Oct 12, 2024 22:57:29.726667881 CEST	53	60919	8.8.8.8	192.168.2.13
Oct 12, 2024 22:57:32.377779007 CEST	48959	53	192.168.2.13	8.8.8.8
Oct 12, 2024 22:57:32.384583950 CEST	53	48959	8.8.8.8	192.168.2.13
Oct 12, 2024 22:57:35.030719995 CEST	48254	53	192.168.2.13	8.8.8.8
Oct 12, 2024 22:57:35.037482977 CEST	53	48254	8.8.8.8	192.168.2.13
Oct 12, 2024 22:57:37.694276094 CEST	54183	53	192.168.2.13	8.8.8.8
Oct 12, 2024 22:57:37.701498985 CEST	53	54183	8.8.8.8	192.168.2.13
Oct 12, 2024 22:57:40.349333048 CEST	34883	53	192.168.2.13	8.8.8.8
Oct 12, 2024 22:57:40.356854916 CEST	53	34883	8.8.8.8	192.168.2.13
Oct 12, 2024 22:57:42.997862101 CEST	55837	53	192.168.2.13	8.8.8.8
Oct 12, 2024 22:57:43.479496956 CEST	53	55837	8.8.8.8	192.168.2.13
Oct 12, 2024 22:57:46.141453028 CEST	52739	53	192.168.2.13	8.8.8.8
Oct 12, 2024 22:57:46.148576975 CEST	53	52739	8.8.8.8	192.168.2.13
Oct 12, 2024 22:57:48.796129942 CEST	37409	53	192.168.2.13	8.8.8.8
Oct 12, 2024 22:57:48.803316116 CEST	53	37409	8.8.8.8	192.168.2.13
Oct 12, 2024 22:57:51.435355902 CEST	55059	53	192.168.2.13	8.8.8.8
Oct 12, 2024 22:57:51.442312002 CEST	53	55059	8.8.8.8	192.168.2.13
Oct 12, 2024 22:57:54.094727993 CEST	38010	53	192.168.2.13	8.8.8.8
Oct 12, 2024 22:57:54.102091074 CEST	53	38010	8.8.8.8	192.168.2.13
Oct 12, 2024 22:57:56.749897003 CEST	34214	53	192.168.2.13	8.8.8.8
Oct 12, 2024 22:57:56.756273031 CEST	53	34214	8.8.8.8	192.168.2.13
Oct 12, 2024 22:57:59.410079002 CEST	48820	53	192.168.2.13	8.8.8.8
Oct 12, 2024 22:57:59.419339895 CEST	53	48820	8.8.8.8	192.168.2.13
Oct 12, 2024 22:58:02.095709085 CEST	45175	53	192.168.2.13	8.8.8.8
Oct 12, 2024 22:58:02.102920055 CEST	53	45175	8.8.8.8	192.168.2.13
Oct 12, 2024 22:58:04.750456095 CEST	42018	53	192.168.2.13	8.8.8.8
Oct 12, 2024 22:58:04.758100986 CEST	53	42018	8.8.8.8	192.168.2.13
Oct 12, 2024 22:58:07.408782959 CEST	53639	53	192.168.2.13	8.8.8.8
Oct 12, 2024 22:58:07.419989109 CEST	53	53639	8.8.8.8	192.168.2.13
Oct 12, 2024 22:58:10.063469887 CEST	45808	53	192.168.2.13	8.8.8.8
Oct 12, 2024 22:58:10.070384026 CEST	53	45808	8.8.8.8	192.168.2.13
Oct 12, 2024 22:58:12.741524935 CEST	38198	53	192.168.2.13	8.8.8.8
Oct 12, 2024 22:58:12.749567032 CEST	53	38198	8.8.8.8	192.168.2.13
Oct 12, 2024 22:58:15.393726110 CEST	33633	53	192.168.2.13	8.8.8.8
Oct 12, 2024 22:58:15.400847912 CEST	53	33633	8.8.8.8	192.168.2.13
Oct 12, 2024 22:58:18.046988010 CEST	38550	53	192.168.2.13	8.8.8.8
Oct 12, 2024 22:58:18.054076910 CEST	53	38550	8.8.8.8	192.168.2.13
Oct 12, 2024 22:58:20.688708067 CEST	45986	53	192.168.2.13	8.8.8.8
Oct 12, 2024 22:58:20.696007967 CEST	53	45986	8.8.8.8	192.168.2.13
Oct 12, 2024 22:58:23.350966930 CEST	47412	53	192.168.2.13	8.8.8.8
Oct 12, 2024 22:58:23.414849997 CEST	53	47412	8.8.8.8	192.168.2.13
Oct 12, 2024 22:58:26.065466881 CEST	34853	53	192.168.2.13	8.8.8.8
Oct 12, 2024 22:58:26.072864056 CEST	53	34853	8.8.8.8	192.168.2.13
Oct 12, 2024 22:58:28.701555014 CEST	56022	53	192.168.2.13	8.8.8.8
Oct 12, 2024 22:58:28.708813906 CEST	53	56022	8.8.8.8	192.168.2.13
Oct 12, 2024 22:58:31.345411062 CEST	59485	53	192.168.2.13	8.8.8.8
Oct 12, 2024 22:58:31.352277994 CEST	53	59485	8.8.8.8	192.168.2.13
Oct 12, 2024 22:58:34.031709909 CEST	51349	53	192.168.2.13	8.8.8.8
Oct 12, 2024 22:58:34.039556980 CEST	53	51349	8.8.8.8	192.168.2.13
Oct 12, 2024 22:58:36.676418066 CEST	37316	53	192.168.2.13	8.8.8.8
Oct 12, 2024 22:58:36.684031963 CEST	53	37316	8.8.8.8	192.168.2.13
Oct 12, 2024 22:58:39.375348091 CEST	51644	53	192.168.2.13	8.8.8.8
Oct 12, 2024 22:58:39.382781029 CEST	53	51644	8.8.8.8	192.168.2.13
Oct 12, 2024 22:58:42.076534986 CEST	35093	53	192.168.2.13	8.8.8.8
Oct 12, 2024 22:58:42.083379984 CEST	53	35093	8.8.8.8	192.168.2.13
Oct 12, 2024 22:58:44.776859045 CEST	57411	53	192.168.2.13	8.8.8.8
Oct 12, 2024 22:58:44.784671068 CEST	53	57411	8.8.8.8	192.168.2.13
Oct 12, 2024 22:58:47.478168964 CEST	48809	53	192.168.2.13	8.8.8.8
Oct 12, 2024 22:58:47.485591888 CEST	53	48809	8.8.8.8	192.168.2.13
Oct 12, 2024 22:58:50.184961081 CEST	57779	53	192.168.2.13	8.8.8.8
Oct 12, 2024 22:58:50.191472054 CEST	53	57779	8.8.8.8	192.168.2.13
Oct 12, 2024 22:58:52.884450912 CEST	33260	53	192.168.2.13	8.8.8.8
Oct 12, 2024 22:58:52.890887976 CEST	53	33260	8.8.8.8	192.168.2.13
Oct 12, 2024 22:58:53.901990891 CEST	37002	53	192.168.2.13	8.8.8.8
Oct 12, 2024 22:58:53.908229113 CEST	53	37002	8.8.8.8	192.168.2.13
Oct 12, 2024 22:58:56.579926968 CEST	47170	53	192.168.2.13	8.8.8.8
Oct 12, 2024 22:58:56.587606907 CEST	53	47170	8.8.8.8	192.168.2.13
Oct 12, 2024 22:58:59.278707027 CEST	47406	53	192.168.2.13	8.8.8.8
Oct 12, 2024 22:58:59.285116911 CEST	53	47406	8.8.8.8	192.168.2.13
Oct 12, 2024 22:59:00.296823025 CEST	42170	53	192.168.2.13	8.8.8.8
Oct 12, 2024 22:59:00.304203033 CEST	53	42170	8.8.8.8	192.168.2.13
Oct 12, 2024 22:59:01.316065073 CEST	46501	53	192.168.2.13	8.8.8.8
Oct 12, 2024 22:59:01.323764086 CEST	53	46501	8.8.8.8	192.168.2.13

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 12, 2024 22:56:57.698127031 CEST	192.168.2.13	8.8.8.8	0x9c6d	Standard query (0)	drumev.eu	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:57:00.342437983 CEST	192.168.2.13	8.8.8.8	0x3ac2	Standard query (0)	drumev.eu	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:57:02.983295918 CEST	192.168.2.13	8.8.8.8	0xf826	Standard query (0)	drumev.eu	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:57:05.845215082 CEST	192.168.2.13	8.8.8.8	0x9417	Standard query (0)	drumev.eu	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:57:08.498533010 CEST	192.168.2.13	8.8.8.8	0x61fa	Standard query (0)	drumev.eu	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:57:11.137394905 CEST	192.168.2.13	8.8.8.8	0xae88	Standard query (0)	drumev.eu	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:57:13.793430090 CEST	192.168.2.13	8.8.8.8	0x6208	Standard query (0)	drumev.eu	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:57:16.455701113 CEST	192.168.2.13	8.8.8.8	0x3c7f	Standard query (0)	drumev.eu	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:57:19.090866089 CEST	192.168.2.13	8.8.8.8	0x5267	Standard query (0)	drumev.eu	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:57:21.765321016 CEST	192.168.2.13	8.8.8.8	0x695d	Standard query (0)	drumev.eu	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:57:24.403598070 CEST	192.168.2.13	8.8.8.8	0x562c	Standard query (0)	drumev.eu	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:57:27.065113068 CEST	192.168.2.13	8.8.8.8	0x191b	Standard query (0)	drumev.eu	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:57:29.720264912 CEST	192.168.2.13	8.8.8.8	0xda49	Standard query (0)	drumev.eu	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:57:32.377779007 CEST	192.168.2.13	8.8.8.8	0x5421	Standard query (0)	drumev.eu	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:57:35.030719995 CEST	192.168.2.13	8.8.8.8	0x5eeb	Standard query (0)	drumev.eu	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:57:37.694276094 CEST	192.168.2.13	8.8.8.8	0x4fe	Standard query (0)	drumev.eu	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:57:40.349333048 CEST	192.168.2.13	8.8.8.8	0x7c3b	Standard query (0)	drumev.eu	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:57:42.997862101 CEST	192.168.2.13	8.8.8.8	0x42dd	Standard query (0)	drumev.eu	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:57:46.141453028 CEST	192.168.2.13	8.8.8.8	0x5601	Standard query (0)	drumev.eu	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:57:48.796129942 CEST	192.168.2.13	8.8.8.8	0xe81f	Standard query (0)	drumev.eu	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:57:51.435355902 CEST	192.168.2.13	8.8.8.8	0x3219	Standard query (0)	drumev.eu	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:57:54.094727993 CEST	192.168.2.13	8.8.8.8	0x29a2	Standard query (0)	drumev.eu	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:57:56.749897003 CEST	192.168.2.13	8.8.8.8	0x9bfc	Standard query (0)	drumev.eu	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:57:59.410079002 CEST	192.168.2.13	8.8.8.8	0xa937	Standard query (0)	drumev.eu	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:58:02.095709085 CEST	192.168.2.13	8.8.8.8	0x5dbe	Standard query (0)	drumev.eu	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:58:04.750456095 CEST	192.168.2.13	8.8.8.8	0x352b	Standard query (0)	drumev.eu	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:58:07.408782959 CEST	192.168.2.13	8.8.8.8	0x2060	Standard query (0)	drumev.eu	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:58:10.063469887 CEST	192.168.2.13	8.8.8.8	0x6cd8	Standard query (0)	drumev.eu	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:58:12.741524935 CEST	192.168.2.13	8.8.8.8	0xe335	Standard query (0)	drumev.eu	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:58:15.393726110 CEST	192.168.2.13	8.8.8.8	0x5403	Standard query (0)	drumev.eu	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:58:18.046988010 CEST	192.168.2.13	8.8.8.8	0x1ce2	Standard query (0)	drumev.eu	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:58:20.688708067 CEST	192.168.2.13	8.8.8.8	0x5592	Standard query (0)	drumev.eu	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:58:23.350966930 CEST	192.168.2.13	8.8.8.8	0xef9b	Standard query (0)	drumev.eu	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:58:26.065466881 CEST	192.168.2.13	8.8.8.8	0x2b3c	Standard query (0)	drumev.eu	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:58:28.701555014 CEST	192.168.2.13	8.8.8.8	0x45f9	Standard query (0)	drumev.eu	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:58:31.345411062 CEST	192.168.2.13	8.8.8.8	0xd965	Standard query (0)	drumev.eu	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:58:34.031709909 CEST	192.168.2.13	8.8.8.8	0xa136	Standard query (0)	drumev.eu	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:58:36.676418066 CEST	192.168.2.13	8.8.8.8	0x5737	Standard query (0)	drumev.eu	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:58:39.375348091 CEST	192.168.2.13	8.8.8.8	0x6a6e	Standard query (0)	drumev.eu	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:58:42.076534986 CEST	192.168.2.13	8.8.8.8	0xf831	Standard query (0)	drumev.eu	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:58:44.776859045 CEST	192.168.2.13	8.8.8.8	0xa81d	Standard query (0)	drumev.eu	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:58:47.478168964 CEST	192.168.2.13	8.8.8.8	0x68f2	Standard query (0)	drumev.eu	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:58:50.184961081 CEST	192.168.2.13	8.8.8.8	0x287f	Standard query (0)	drumev.eu	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:58:52.884450912 CEST	192.168.2.13	8.8.8.8	0xd26e	Standard query (0)	drumev.eu	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:58:53.901990891 CEST	192.168.2.13	8.8.8.8	0x7e3b	Standard query (0)	drumev.eu	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:58:56.579926968 CEST	192.168.2.13	8.8.8.8	0xf8d	Standard query (0)	drumev.eu	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:58:59.278707027 CEST	192.168.2.13	8.8.8.8	0xe7d0	Standard query (0)	drumev.eu	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:59:00.296823025 CEST	192.168.2.13	8.8.8.8	0xf926	Standard query (0)	drumev.eu	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:59:01.316065073 CEST	192.168.2.13	8.8.8.8	0xf917	Standard query (0)	drumev.eu	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 12, 2024 22:56:57.705389977 CEST	8.8.8.8	192.168.2.13	0x9c6d	No error (0)	drumev.eu	93.123.85.140	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:57:00.349410057 CEST	8.8.8.8	192.168.2.13	0x3ac2	No error (0)	drumev.eu	93.123.85.140	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:57:02.991548061 CEST	8.8.8.8	192.168.2.13	0xf826	No error (0)	drumev.eu	93.123.85.140	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:57:05.852355003 CEST	8.8.8.8	192.168.2.13	0x9417	No error (0)	drumev.eu	93.123.85.140	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:57:08.509408951 CEST	8.8.8.8	192.168.2.13	0x61fa	No error (0)	drumev.eu	93.123.85.140	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:57:11.144493103 CEST	8.8.8.8	192.168.2.13	0xae88	No error (0)	drumev.eu	93.123.85.140	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:57:13.800559044 CEST	8.8.8.8	192.168.2.13	0x6208	No error (0)	drumev.eu	93.123.85.140	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:57:16.463453054 CEST	8.8.8.8	192.168.2.13	0x3c7f	No error (0)	drumev.eu	93.123.85.140	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:57:19.097520113 CEST	8.8.8.8	192.168.2.13	0x5267	No error (0)	drumev.eu	93.123.85.140	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:57:21.772360086 CEST	8.8.8.8	192.168.2.13	0x695d	No error (0)	drumev.eu	93.123.85.140	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:57:24.410434961 CEST	8.8.8.8	192.168.2.13	0x562c	No error (0)	drumev.eu	93.123.85.140	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:57:27.071908951 CEST	8.8.8.8	192.168.2.13	0x191b	No error (0)	drumev.eu	93.123.85.140	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:57:29.726667881 CEST	8.8.8.8	192.168.2.13	0xda49	No error (0)	drumev.eu	93.123.85.140	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:57:32.384583950 CEST	8.8.8.8	192.168.2.13	0x5421	No error (0)	drumev.eu	93.123.85.140	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:57:35.037482977 CEST	8.8.8.8	192.168.2.13	0x5eeb	No error (0)	drumev.eu	93.123.85.140	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:57:37.701498985 CEST	8.8.8.8	192.168.2.13	0x4fe	No error (0)	drumev.eu	93.123.85.140	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:57:40.356854916 CEST	8.8.8.8	192.168.2.13	0x7c3b	No error (0)	drumev.eu	93.123.85.140	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:57:43.479496956 CEST	8.8.8.8	192.168.2.13	0x42dd	No error (0)	drumev.eu	93.123.85.140	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:57:46.148576975 CEST	8.8.8.8	192.168.2.13	0x5601	No error (0)	drumev.eu	93.123.85.140	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:57:48.803316116 CEST	8.8.8.8	192.168.2.13	0xe81f	No error (0)	drumev.eu	93.123.85.140	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:57:51.442312002 CEST	8.8.8.8	192.168.2.13	0x3219	No error (0)	drumev.eu	93.123.85.140	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:57:54.102091074 CEST	8.8.8.8	192.168.2.13	0x29a2	No error (0)	drumev.eu	93.123.85.140	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:57:56.756273031 CEST	8.8.8.8	192.168.2.13	0x9bfc	No error (0)	drumev.eu	93.123.85.140	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:57:59.419339895 CEST	8.8.8.8	192.168.2.13	0xa937	No error (0)	drumev.eu	93.123.85.140	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:58:02.102920055 CEST	8.8.8.8	192.168.2.13	0x5dbe	No error (0)	drumev.eu	93.123.85.140	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:58:04.758100986 CEST	8.8.8.8	192.168.2.13	0x352b	No error (0)	drumev.eu	93.123.85.140	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:58:07.419989109 CEST	8.8.8.8	192.168.2.13	0x2060	No error (0)	drumev.eu	93.123.85.140	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:58:10.070384026 CEST	8.8.8.8	192.168.2.13	0x6cd8	No error (0)	drumev.eu	93.123.85.140	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:58:12.749567032 CEST	8.8.8.8	192.168.2.13	0xe335	No error (0)	drumev.eu	93.123.85.140	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:58:15.400847912 CEST	8.8.8.8	192.168.2.13	0x5403	No error (0)	drumev.eu	93.123.85.140	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:58:18.054076910 CEST	8.8.8.8	192.168.2.13	0x1ce2	No error (0)	drumev.eu	93.123.85.140	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:58:20.696007967 CEST	8.8.8.8	192.168.2.13	0x5592	No error (0)	drumev.eu	93.123.85.140	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:58:23.414849997 CEST	8.8.8.8	192.168.2.13	0xef9b	No error (0)	drumev.eu	93.123.85.140	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:58:26.072864056 CEST	8.8.8.8	192.168.2.13	0x2b3c	No error (0)	drumev.eu	93.123.85.140	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:58:28.708813906 CEST	8.8.8.8	192.168.2.13	0x45f9	No error (0)	drumev.eu	93.123.85.140	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:58:31.352277994 CEST	8.8.8.8	192.168.2.13	0xd965	No error (0)	drumev.eu	93.123.85.140	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:58:34.039556980 CEST	8.8.8.8	192.168.2.13	0xa136	No error (0)	drumev.eu	93.123.85.140	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:58:36.684031963 CEST	8.8.8.8	192.168.2.13	0x5737	No error (0)	drumev.eu	93.123.85.140	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:58:39.382781029 CEST	8.8.8.8	192.168.2.13	0x6a6e	No error (0)	drumev.eu	93.123.85.140	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:58:42.083379984 CEST	8.8.8.8	192.168.2.13	0xf831	No error (0)	drumev.eu	93.123.85.140	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:58:44.784671068 CEST	8.8.8.8	192.168.2.13	0xa81d	No error (0)	drumev.eu	93.123.85.140	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:58:47.485591888 CEST	8.8.8.8	192.168.2.13	0x68f2	No error (0)	drumev.eu	93.123.85.140	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:58:50.191472054 CEST	8.8.8.8	192.168.2.13	0x287f	No error (0)	drumev.eu	93.123.85.140	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:58:52.890887976 CEST	8.8.8.8	192.168.2.13	0xd26e	No error (0)	drumev.eu	93.123.85.140	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:58:53.908229113 CEST	8.8.8.8	192.168.2.13	0x7e3b	No error (0)	drumev.eu	93.123.85.140	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:58:56.587606907 CEST	8.8.8.8	192.168.2.13	0xf8d	No error (0)	drumev.eu	93.123.85.140	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:58:59.285116911 CEST	8.8.8.8	192.168.2.13	0xe7d0	No error (0)	drumev.eu	93.123.85.140	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:59:00.304203033 CEST	8.8.8.8	192.168.2.13	0xf926	No error (0)	drumev.eu	93.123.85.140	A (IP address)	IN (0x0001)	false
Oct 12, 2024 22:59:01.323764086 CEST	8.8.8.8	192.168.2.13	0xf917	No error (0)	drumev.eu	93.123.85.140	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: rkF1LTQVdi.elf PID: 5432, Parent PID: 5356

General

Start time (UTC):	20:56:56
Start date (UTC):	12/10/2024
Path:	/tmp/rkF1LTQVdi.elf
Arguments:	/tmp/rkF1LTQVdi.elf
File size:	67896 bytes
MD5 hash:	b813f066d458837d59d7d515e20e5596

Chronological Activities

Analysis Process: rkF1LTQVdi.elf PID: 5433, Parent PID: 5432

General

Start time (UTC):	20:56:56
Start date (UTC):	12/10/2024
Path:	/tmp/rkF1LTQVdi.elf
Arguments:	-
File size:	67896 bytes
MD5 hash:	b813f066d458837d59d7d515e20e5596

Chronological Activities

Analysis Process: rkF1LTQVdi.elf PID: 5434, Parent PID: 5432

General

Start time (UTC):	20:56:56
Start date (UTC):	12/10/2024
Path:	/tmp/rkF1LTQVdi.elf
Arguments:	-
File size:	67896 bytes
MD5 hash:	b813f066d458837d59d7d515e20e5596

Chronological Activities

Analysis Process: rkF1LTQVdi.elf PID: 5435, Parent PID: 5434

General

Start time (UTC):	20:56:56
Start date (UTC):	12/10/2024
Path:	/tmp/rkF1LTQVdi.elf
Arguments:	-
File size:	67896 bytes
MD5 hash:	b813f066d458837d59d7d515e20e5596

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report rkF1LTQVdi.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: rkF1LTQVdi.elf PID: 5432, Parent PID: 5356

General

Chronological Activities

Analysis Process: rkF1LTQVdi.elf PID: 5433, Parent PID: 5432

General

Chronological Activities

Analysis Process: rkF1LTQVdi.elf PID: 5434, Parent PID: 5432

General

Chronological Activities

Analysis Process: rkF1LTQVdi.elf PID: 5435, Parent PID: 5434

General

Chronological Activities

Linux Analysis Report
rkF1LTQVdi.elf