Edit tour

Linux Analysis Report
s-h.4-.Sakura.elf

Overview

General Information

Sample name:	s-h.4-.Sakura.elf
Analysis ID:	1632535
MD5:	2c83e4090c03252157dc5846637f5317
SHA1:	ffd4c4da68f428c64e3ce1f011af1268acc2c2b9
SHA256:	f13ce45650aa219828fc0b8cdeb05f5c9086e41effc4fe43467895dff0f20666
Tags:	elfuser-abuse_ch
Infos:

Detection

Gafgyt, Mirai

Score:	100
Range:	0 - 100

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Gafgyt

Yara detected Mirai

Contains symbols with names commonly found in malware

Opens /proc/net/* files useful for finding connected devices and routers

Detected TCP or UDP traffic on non-standard ports

Sample contains strings that are user agent strings indicative of HTTP manipulation

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1632535
Start date and time:	2025-03-08 06:02:16 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 18s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	s-h.4-.Sakura.elf
Detection:	MAL
Classification:	mal100.spre.troj.linELF@0/0@0/0

Warnings

VT rate limit hit for: 104.248.115.71:606

Runtime Messages

Command:	/tmp/s-h.4-.Sakura.elf
PID:	6245
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

s-h.4-.Sakura.elf (PID: 6245, Parent: 6167, MD5: 8943e5f8f8c280467b4472c15ae93ba9) Arguments: /tmp/s-h.4-.Sakura.elf

s-h.4-.Sakura.elf New Fork (PID: 6249, Parent: 6245)

s-h.4-.Sakura.elf New Fork (PID: 6251, Parent: 6249)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
s-h.4-.Sakura.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
s-h.4-.Sakura.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
s-h.4-.Sakura.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xdd34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdd48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdd5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdd70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdd84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdd98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xddac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xddc0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xddd4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdde8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xddfc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xde10:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xde24:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xde38:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xde4c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xde60:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xde74:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xde88:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xde9c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdeb0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdec4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
6249.1.00007f3514400000.00007f3514410000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6249.1.00007f3514400000.00007f3514410000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xdd34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdd48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdd5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdd70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdd84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdd98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xddac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xddc0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xddd4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdde8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xddfc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xde10:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xde24:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xde38:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xde4c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xde60:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xde74:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xde88:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xde9c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdeb0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdec4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6245.1.00007f3514400000.00007f3514410000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6245.1.00007f3514400000.00007f3514410000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xdd34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdd48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdd5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdd70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdd84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdd98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xddac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xddc0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xddd4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdde8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xddfc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xde10:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xde24:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xde38:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xde4c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xde60:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xde74:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xde88:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xde9c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdeb0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdec4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: s-h.4-.Sakura.elf PID: 6245	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: s-h.4-.Sakura.elf PID: 6245	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x78e9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x78fd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7911:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7925:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7939:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x794d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7961:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7975:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7989:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x799d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x79b1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x79c5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x79d9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x79ed:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7a01:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7a15:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7a29:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7a3d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7a51:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7a65:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7a79:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: s-h.4-.Sakura.elf PID: 6249	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: s-h.4-.Sakura.elf PID: 6249	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x131f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1333:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1347:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x135b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x136f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1383:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1397:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13ab:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13bf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13d3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13e7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13fb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x140f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1423:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1437:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x144b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x145f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1473:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1487:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x149b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14af:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 3 entries

Suricata Signatures

ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-08T06:03:12.033346+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48612	104.248.115.71	606	TCP
2025-03-08T06:03:13.451018+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48614	104.248.115.71	606	TCP
2025-03-08T06:03:14.946409+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48616	104.248.115.71	606	TCP
2025-03-08T06:03:16.413916+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48618	104.248.115.71	606	TCP
2025-03-08T06:03:17.805443+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48620	104.248.115.71	606	TCP
2025-03-08T06:03:19.214903+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48622	104.248.115.71	606	TCP
2025-03-08T06:03:20.618717+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48624	104.248.115.71	606	TCP
2025-03-08T06:03:22.041792+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48626	104.248.115.71	606	TCP
2025-03-08T06:03:23.466554+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48628	104.248.115.71	606	TCP
2025-03-08T06:03:24.868901+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48630	104.248.115.71	606	TCP
2025-03-08T06:03:26.255927+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48632	104.248.115.71	606	TCP
2025-03-08T06:03:27.650212+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48634	104.248.115.71	606	TCP
2025-03-08T06:03:29.077118+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48636	104.248.115.71	606	TCP
2025-03-08T06:03:30.479540+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48638	104.248.115.71	606	TCP
2025-03-08T06:03:31.952034+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48640	104.248.115.71	606	TCP
2025-03-08T06:03:33.526117+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48642	104.248.115.71	606	TCP
2025-03-08T06:03:34.958728+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48644	104.248.115.71	606	TCP
2025-03-08T06:03:36.352489+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48646	104.248.115.71	606	TCP
2025-03-08T06:03:37.824448+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48648	104.248.115.71	606	TCP
2025-03-08T06:03:39.228181+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48650	104.248.115.71	606	TCP
2025-03-08T06:03:40.700019+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48652	104.248.115.71	606	TCP
2025-03-08T06:03:42.124527+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48654	104.248.115.71	606	TCP
2025-03-08T06:03:43.525223+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48656	104.248.115.71	606	TCP
2025-03-08T06:03:44.935769+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48658	104.248.115.71	606	TCP
2025-03-08T06:03:46.339626+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48660	104.248.115.71	606	TCP
2025-03-08T06:03:47.744820+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48662	104.248.115.71	606	TCP
2025-03-08T06:03:49.150719+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48664	104.248.115.71	606	TCP
2025-03-08T06:03:50.560018+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48666	104.248.115.71	606	TCP
2025-03-08T06:03:51.963683+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48668	104.248.115.71	606	TCP
2025-03-08T06:03:53.370480+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48670	104.248.115.71	606	TCP
2025-03-08T06:03:54.779471+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48672	104.248.115.71	606	TCP
2025-03-08T06:03:56.181909+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48674	104.248.115.71	606	TCP
2025-03-08T06:03:57.590009+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48676	104.248.115.71	606	TCP
2025-03-08T06:03:59.035086+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48678	104.248.115.71	606	TCP
2025-03-08T06:04:00.885247+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48680	104.248.115.71	606	TCP
2025-03-08T06:04:02.295197+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48682	104.248.115.71	606	TCP
2025-03-08T06:04:03.732481+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48684	104.248.115.71	606	TCP
2025-03-08T06:04:05.137628+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48686	104.248.115.71	606	TCP
2025-03-08T06:04:06.544043+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48688	104.248.115.71	606	TCP
2025-03-08T06:04:07.949836+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48690	104.248.115.71	606	TCP
2025-03-08T06:04:09.355530+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48692	104.248.115.71	606	TCP
2025-03-08T06:04:10.760376+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48694	104.248.115.71	606	TCP
2025-03-08T06:04:12.167408+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48696	104.248.115.71	606	TCP
2025-03-08T06:04:13.594235+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48698	104.248.115.71	606	TCP
2025-03-08T06:04:15.013949+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48700	104.248.115.71	606	TCP
2025-03-08T06:04:16.436249+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48702	104.248.115.71	606	TCP
2025-03-08T06:04:17.839148+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48704	104.248.115.71	606	TCP
2025-03-08T06:04:19.247055+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48706	104.248.115.71	606	TCP
2025-03-08T06:04:20.653127+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48708	104.248.115.71	606	TCP
2025-03-08T06:04:22.057995+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48710	104.248.115.71	606	TCP
2025-03-08T06:04:23.498208+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48712	104.248.115.71	606	TCP
2025-03-08T06:04:25.024666+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48714	104.248.115.71	606	TCP
2025-03-08T06:04:26.479084+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48716	104.248.115.71	606	TCP
2025-03-08T06:04:27.886885+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48718	104.248.115.71	606	TCP
2025-03-08T06:04:29.299304+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48720	104.248.115.71	606	TCP
2025-03-08T06:04:30.698361+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48722	104.248.115.71	606	TCP
2025-03-08T06:04:32.106368+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48724	104.248.115.71	606	TCP
2025-03-08T06:04:33.511643+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48726	104.248.115.71	606	TCP
2025-03-08T06:04:34.917246+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48728	104.248.115.71	606	TCP
2025-03-08T06:04:36.324879+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48730	104.248.115.71	606	TCP
2025-03-08T06:04:37.738934+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48732	104.248.115.71	606	TCP
2025-03-08T06:04:39.137423+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48734	104.248.115.71	606	TCP
2025-03-08T06:04:40.565423+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48736	104.248.115.71	606	TCP
2025-03-08T06:04:41.966978+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48738	104.248.115.71	606	TCP
2025-03-08T06:04:43.370013+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48740	104.248.115.71	606	TCP
2025-03-08T06:04:44.777117+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48742	104.248.115.71	606	TCP
2025-03-08T06:04:46.275402+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48744	104.248.115.71	606	TCP
2025-03-08T06:04:47.699301+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48746	104.248.115.71	606	TCP
2025-03-08T06:04:49.186007+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48748	104.248.115.71	606	TCP
2025-03-08T06:04:50.656368+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48750	104.248.115.71	606	TCP
2025-03-08T06:04:52.060278+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48752	104.248.115.71	606	TCP
2025-03-08T06:04:53.465423+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48754	104.248.115.71	606	TCP
2025-03-08T06:04:54.874388+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48756	104.248.115.71	606	TCP
2025-03-08T06:04:56.299729+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48758	104.248.115.71	606	TCP
2025-03-08T06:04:57.700201+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48760	104.248.115.71	606	TCP
2025-03-08T06:04:59.262775+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48762	104.248.115.71	606	TCP
2025-03-08T06:05:00.670680+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48764	104.248.115.71	606	TCP
2025-03-08T06:05:02.073849+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48766	104.248.115.71	606	TCP
2025-03-08T06:05:03.484054+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48768	104.248.115.71	606	TCP
2025-03-08T06:05:04.888233+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48770	104.248.115.71	606	TCP
2025-03-08T06:05:06.299140+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48772	104.248.115.71	606	TCP
2025-03-08T06:05:07.702990+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48774	104.248.115.71	606	TCP
2025-03-08T06:05:09.137435+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48776	104.248.115.71	606	TCP
2025-03-08T06:05:10.552133+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48778	104.248.115.71	606	TCP
2025-03-08T06:05:12.169762+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48780	104.248.115.71	606	TCP
2025-03-08T06:05:13.576059+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48782	104.248.115.71	606	TCP
2025-03-08T06:05:14.982125+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48784	104.248.115.71	606	TCP
2025-03-08T06:05:16.424416+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48786	104.248.115.71	606	TCP
2025-03-08T06:05:17.824770+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48788	104.248.115.71	606	TCP
2025-03-08T06:05:19.231140+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48790	104.248.115.71	606	TCP
2025-03-08T06:05:20.669385+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48792	104.248.115.71	606	TCP
2025-03-08T06:05:22.075744+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48794	104.248.115.71	606	TCP
2025-03-08T06:05:23.503762+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48796	104.248.115.71	606	TCP
2025-03-08T06:05:24.923831+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48798	104.248.115.71	606	TCP
2025-03-08T06:05:26.325806+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48800	104.248.115.71	606	TCP
2025-03-08T06:05:27.733327+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48802	104.248.115.71	606	TCP
2025-03-08T06:05:29.201129+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48804	104.248.115.71	606	TCP
2025-03-08T06:05:30.607844+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48806	104.248.115.71	606	TCP
2025-03-08T06:05:32.066555+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48808	104.248.115.71	606	TCP
2025-03-08T06:05:33.511852+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48810	104.248.115.71	606	TCP
2025-03-08T06:05:34.923163+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48812	104.248.115.71	606	TCP
2025-03-08T06:05:36.345576+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48814	104.248.115.71	606	TCP
2025-03-08T06:05:37.903413+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48816	104.248.115.71	606	TCP
2025-03-08T06:05:39.450871+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48818	104.248.115.71	606	TCP
2025-03-08T06:05:40.858377+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48820	104.248.115.71	606	TCP
2025-03-08T06:05:42.301833+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48822	104.248.115.71	606	TCP
2025-03-08T06:05:43.702813+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48824	104.248.115.71	606	TCP
2025-03-08T06:05:45.106811+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48826	104.248.115.71	606	TCP
2025-03-08T06:05:46.513142+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48828	104.248.115.71	606	TCP
2025-03-08T06:05:47.924208+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48830	104.248.115.71	606	TCP
2025-03-08T06:05:49.324829+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48832	104.248.115.71	606	TCP
2025-03-08T06:05:50.733881+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48834	104.248.115.71	606	TCP
2025-03-08T06:05:52.139668+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48836	104.248.115.71	606	TCP
2025-03-08T06:05:53.544989+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48838	104.248.115.71	606	TCP
2025-03-08T06:05:55.028351+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48840	104.248.115.71	606	TCP
2025-03-08T06:05:56.472896+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48842	104.248.115.71	606	TCP
2025-03-08T06:05:57.906149+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48844	104.248.115.71	606	TCP
2025-03-08T06:05:59.479927+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48846	104.248.115.71	606	TCP
2025-03-08T06:06:01.013346+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48848	104.248.115.71	606	TCP
2025-03-08T06:06:02.418712+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48850	104.248.115.71	606	TCP
2025-03-08T06:06:03.825452+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48852	104.248.115.71	606	TCP
2025-03-08T06:06:05.232952+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48854	104.248.115.71	606	TCP
2025-03-08T06:06:06.638528+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48856	104.248.115.71	606	TCP
2025-03-08T06:06:08.044269+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48858	104.248.115.71	606	TCP
2025-03-08T06:06:09.454649+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48860	104.248.115.71	606	TCP
2025-03-08T06:06:10.855570+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48862	104.248.115.71	606	TCP
2025-03-08T06:06:12.265110+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48864	104.248.115.71	606	TCP
2025-03-08T06:06:13.671744+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48866	104.248.115.71	606	TCP
2025-03-08T06:06:16.109470+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48868	104.248.115.71	606	TCP
2025-03-08T06:06:17.536869+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48870	104.248.115.71	606	TCP
2025-03-08T06:06:19.008379+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48872	104.248.115.71	606	TCP
2025-03-08T06:06:20.499124+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48874	104.248.115.71	606	TCP
2025-03-08T06:06:21.908239+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48876	104.248.115.71	606	TCP
2025-03-08T06:06:23.310676+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48878	104.248.115.71	606	TCP
2025-03-08T06:06:24.725655+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48880	104.248.115.71	606	TCP
2025-03-08T06:06:26.331528+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48882	104.248.115.71	606	TCP
2025-03-08T06:06:27.769075+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48884	104.248.115.71	606	TCP
2025-03-08T06:06:29.232140+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48886	104.248.115.71	606	TCP
2025-03-08T06:06:30.638112+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48888	104.248.115.71	606	TCP
2025-03-08T06:06:32.059756+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48890	104.248.115.71	606	TCP
2025-03-08T06:06:33.466117+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48892	104.248.115.71	606	TCP
2025-03-08T06:06:34.894988+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48894	104.248.115.71	606	TCP
2025-03-08T06:06:36.300521+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48896	104.248.115.71	606	TCP
2025-03-08T06:06:37.700437+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48898	104.248.115.71	606	TCP
2025-03-08T06:06:39.108531+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48900	104.248.115.71	606	TCP
2025-03-08T06:06:40.515599+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48902	104.248.115.71	606	TCP
2025-03-08T06:06:41.921719+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48904	104.248.115.71	606	TCP
2025-03-08T06:06:43.342055+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48906	104.248.115.71	606	TCP
2025-03-08T06:06:44.826285+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48908	104.248.115.71	606	TCP
2025-03-08T06:06:46.233792+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48910	104.248.115.71	606	TCP
2025-03-08T06:06:47.716657+0100	2846526	1	A Network Trojan was detected	192.168.2.23	48912	104.248.115.71	606	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: s-h.4-.Sakura.elf

Avira: detected

Found malware configuration

Source: s-h.4-.Sakura.elf

Malware Configuration Extractor: Gafgyt {"C2 url": "104.248.115.71:606"}

Multi AV Scanner detection for submitted file

Source: s-h.4-.Sakura.elf	ReversingLabs: Detection: 63%
Source: s-h.4-.Sakura.elf	Virustotal: Detection: 68%			Perma Link

Spreading

Opens /proc/net/* files useful for finding connected devices and routers

Source: /tmp/s-h.4-.Sakura.elf (PID: 6245)

Opens: /proc/net/route

Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48614 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48648 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48682 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48698 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48684 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48620 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48710 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48758 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48718 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48836 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48762 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48746 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48794 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48630 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48668 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48880 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48894 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48646 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48830 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48654 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48732 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48788 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48806 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48618 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48680 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48640 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48750 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48784 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48846 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48692 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48632 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48716 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48782 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48664 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48720 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48638 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48660 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48748 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48650 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48704 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48810 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48708 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48656 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48826 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48722 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48714 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48674 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48840 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48756 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48666 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48728 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48868 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48866 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48818 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48738 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48878 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48696 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48752 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48802 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48798 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48612 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48850 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48772 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48744 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48874 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48742 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48832 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48624 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48770 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48870 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48890 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48774 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48872 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48778 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48792 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48822 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48864 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48694 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48670 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48902 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48690 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48844 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48734 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48702 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48854 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48912 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48812 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48628 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48658 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48706 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48760 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48676 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48634 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48862 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48860 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48724 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48780 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48814 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48726 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48884 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48736 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48910 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48900 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48834 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48888 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48828 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48626 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48754 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48908 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48842 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48796 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48688 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48672 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48858 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48816 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48730 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48644 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48882 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48892 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48616 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48678 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48906 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48804 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48786 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48622 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48800 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48856 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48808 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48652 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48898 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48712 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48838 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48768 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48776 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48886 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48790 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48740 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48896 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48662 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48766 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48876 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48642 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48824 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48686 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48764 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48852 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48820 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48904 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48848 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48636 -> 104.248.115.71:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:48700 -> 104.248.115.71:606

Source: global traffic

TCP traffic: 192.168.2.23:48612 -> 104.248.115.71:606

Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443

Source: unknown	TCP traffic detected without corresponding DNS query: 104.248.115.71
Source: unknown	TCP traffic detected without corresponding DNS query: 104.248.115.71
Source: unknown	TCP traffic detected without corresponding DNS query: 104.248.115.71
Source: unknown	TCP traffic detected without corresponding DNS query: 104.248.115.71
Source: unknown	TCP traffic detected without corresponding DNS query: 104.248.115.71
Source: unknown	TCP traffic detected without corresponding DNS query: 104.248.115.71
Source: unknown	TCP traffic detected without corresponding DNS query: 104.248.115.71
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 104.248.115.71
Source: unknown	TCP traffic detected without corresponding DNS query: 104.248.115.71
Source: unknown	TCP traffic detected without corresponding DNS query: 104.248.115.71
Source: unknown	TCP traffic detected without corresponding DNS query: 104.248.115.71
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 104.248.115.71
Source: unknown	TCP traffic detected without corresponding DNS query: 104.248.115.71
Source: unknown	TCP traffic detected without corresponding DNS query: 104.248.115.71
Source: unknown	TCP traffic detected without corresponding DNS query: 104.248.115.71
Source: unknown	TCP traffic detected without corresponding DNS query: 104.248.115.71
Source: unknown	TCP traffic detected without corresponding DNS query: 104.248.115.71
Source: unknown	TCP traffic detected without corresponding DNS query: 104.248.115.71
Source: unknown	TCP traffic detected without corresponding DNS query: 104.248.115.71
Source: unknown	TCP traffic detected without corresponding DNS query: 104.248.115.71
Source: unknown	TCP traffic detected without corresponding DNS query: 104.248.115.71
Source: unknown	TCP traffic detected without corresponding DNS query: 104.248.115.71
Source: unknown	TCP traffic detected without corresponding DNS query: 104.248.115.71
Source: unknown	TCP traffic detected without corresponding DNS query: 104.248.115.71
Source: unknown	TCP traffic detected without corresponding DNS query: 104.248.115.71
Source: unknown	TCP traffic detected without corresponding DNS query: 104.248.115.71
Source: unknown	TCP traffic detected without corresponding DNS query: 104.248.115.71
Source: unknown	TCP traffic detected without corresponding DNS query: 104.248.115.71
Source: unknown	TCP traffic detected without corresponding DNS query: 104.248.115.71
Source: unknown	TCP traffic detected without corresponding DNS query: 104.248.115.71
Source: unknown	TCP traffic detected without corresponding DNS query: 104.248.115.71
Source: unknown	TCP traffic detected without corresponding DNS query: 104.248.115.71
Source: unknown	TCP traffic detected without corresponding DNS query: 104.248.115.71
Source: unknown	TCP traffic detected without corresponding DNS query: 104.248.115.71
Source: unknown	TCP traffic detected without corresponding DNS query: 104.248.115.71
Source: unknown	TCP traffic detected without corresponding DNS query: 104.248.115.71
Source: unknown	TCP traffic detected without corresponding DNS query: 104.248.115.71
Source: unknown	TCP traffic detected without corresponding DNS query: 104.248.115.71
Source: unknown	TCP traffic detected without corresponding DNS query: 104.248.115.71
Source: unknown	TCP traffic detected without corresponding DNS query: 104.248.115.71
Source: unknown	TCP traffic detected without corresponding DNS query: 104.248.115.71
Source: unknown	TCP traffic detected without corresponding DNS query: 104.248.115.71
Source: unknown	TCP traffic detected without corresponding DNS query: 104.248.115.71
Source: unknown	TCP traffic detected without corresponding DNS query: 104.248.115.71
Source: unknown	TCP traffic detected without corresponding DNS query: 104.248.115.71
Source: unknown	TCP traffic detected without corresponding DNS query: 104.248.115.71
Source: unknown	TCP traffic detected without corresponding DNS query: 104.248.115.71
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: s-h.4-.Sakura.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6249.1.00007f3514400000.00007f3514410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6245.1.00007f3514400000.00007f3514410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: s-h.4-.Sakura.elf PID: 6245, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: s-h.4-.Sakura.elf PID: 6249, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Contains symbols with names commonly found in malware

Source: ELF static info symbol of initial sample

Name: vseattack

Source: s-h.4-.Sakura.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6249.1.00007f3514400000.00007f3514410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6245.1.00007f3514400000.00007f3514410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: s-h.4-.Sakura.elf PID: 6245, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: s-h.4-.Sakura.elf PID: 6249, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.spre.troj.linELF@0/0@0/0

Source: s-h.4-.Sakura.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-sh4/gcc-core/gcc/config/sh/lib1funcs.asm
Source: s-h.4-.Sakura.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-sh4/gcc-core/gcc/config/sh/lib1funcs.asm
Source: s-h.4-.Sakura.elf	ELF static info symbol of initial sample: libc/string/sh/sh4/memcpy.S
Source: s-h.4-.Sakura.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/sh/crt1.S
Source: s-h.4-.Sakura.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/sh/crti.S
Source: s-h.4-.Sakura.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/sh/crtn.S

Source: /tmp/s-h.4-.Sakura.elf (PID: 6245)

Queries kernel information via 'uname':

Jump to behavior

Source: s-h.4-.Sakura.elf, 6245.1.00007ffdc951b000.00007ffdc953c000.rw-.sdmp, s-h.4-.Sakura.elf, 6249.1.00007ffdc951b000.00007ffdc953c000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-sh4/tmp/s-h.4-.Sakura.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/s-h.4-.Sakura.elf
Source: s-h.4-.Sakura.elf, 6245.1.00007ffdc951b000.00007ffdc953c000.rw-.sdmp, s-h.4-.Sakura.elf, 6249.1.00007ffdc951b000.00007ffdc953c000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sh4
Source: s-h.4-.Sakura.elf, 6245.1.000055896fb0f000.000055896fb72000.rw-.sdmp, s-h.4-.Sakura.elf, 6249.1.000055896fb0f000.000055896fb72000.rw-.sdmp	Binary or memory string: U5!/etc/qemu-binfmt/sh4
Source: s-h.4-.Sakura.elf, 6245.1.000055896fb0f000.000055896fb72000.rw-.sdmp, s-h.4-.Sakura.elf, 6249.1.000055896fb0f000.000055896fb72000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sh4

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match

File source: s-h.4-.Sakura.elf, type: SAMPLE

Yara detected Mirai

Source: Yara match	File source: s-h.4-.Sakura.elf, type: SAMPLE
Source: Yara match	File source: 6249.1.00007f3514400000.00007f3514410000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6245.1.00007f3514400000.00007f3514410000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: s-h.4-.Sakura.elf PID: 6245, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: s-h.4-.Sakura.elf PID: 6249, type: MEMORYSTR

Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.71 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36

Remote Access Functionality

Yara detected Gafgyt

Source: Yara match

File source: s-h.4-.Sakura.elf, type: SAMPLE

Yara detected Mirai

Source: Yara match	File source: s-h.4-.Sakura.elf, type: SAMPLE
Source: Yara match	File source: 6249.1.00007f3514400000.00007f3514410000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6245.1.00007f3514400000.00007f3514410000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: s-h.4-.Sakura.elf PID: 6245, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: s-h.4-.Sakura.elf PID: 6249, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	1 Remote System Discovery	Remote Desktop Protocol	Data from Removable Media	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

Threatname: Gafgyt

{"C2 url": "104.248.115.71:606"}

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
s-h.4-.Sakura.elf	63%	ReversingLabs	Linux.Exploit.Mirai
s-h.4-.Sakura.elf	68%	Virustotal		Browse
s-h.4-.Sakura.elf	100%	Avira	EXP/ELF.Mirai.Z.A

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
104.248.115.71:606	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
104.248.115.71	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.43	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
91.189.91.42	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
DIGITALOCEAN-ASNUS	https://www.criminon.org/	Get hash	malicious	Unknown	Browse	146.185.171.14
	SecuriteInfo.com.Program.Unwanted.5412.9015.527.exe	Get hash	malicious	PureLog Stealer	Browse	165.227.176.158
	SecuriteInfo.com.Program.Unwanted.5412.9015.527.exe	Get hash	malicious	PureLog Stealer	Browse	165.227.176.158
	MmF9tcIj1J.exe	Get hash	malicious	FormBook	Browse	178.128.48.21
	https://greenwichpediatrics.acvhealth.site/?njlv=ork	Get hash	malicious	HTMLPhisher	Browse	134.122.77.6
	efjepc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	157.245.182.51
	nabarm5.elf	Get hash	malicious	Unknown	Browse	159.203.90.238
	zerarm7.elf	Get hash	malicious	Unknown	Browse	64.227.79.152
	cbr.ppc.elf	Get hash	malicious	Mirai	Browse	134.123.80.30
	https://oesonline.net	Get hash	malicious	Unknown	Browse	104.248.224.96
CANONICAL-ASGB	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
INIT7CH	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, Renesas SH, version 1 (SYSV), statically linked, not stripped
Entropy (8bit):	6.618261485030871
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	s-h.4-.Sakura.elf
File size:	88'733 bytes
MD5:	2c83e4090c03252157dc5846637f5317
SHA1:	ffd4c4da68f428c64e3ce1f011af1268acc2c2b9
SHA256:	f13ce45650aa219828fc0b8cdeb05f5c9086e41effc4fe43467895dff0f20666
SHA512:	1534353c62155a41a3c0cd8805e7893cd9965492baa0c73c002acb920859841ed169eca3c5fb672f7e63db70ce06161af0c775f5e83a8e72547c92331d1bceb9
SSDEEP:	1536:ClN9YyOXmMSr4k9dgGwKGg0CfjGJCMdojMyTRLmkxVqOEeofzee:g7OXmMSr4krG3JjBQLmkxVqODofzee
TLSH:	D3833B47E9A19FB7C0866A7565AB5E300B13E9912B4F1A4A303CA7F8434F4CD790EF64
File Content Preview:	.ELF.....................@.4...........4. ...(...............@...@...........................A...A......g..........Q.td............................././"O.n........#.@........#.*@.....o&O.n...l..............................././.../.a"O.!...n...a.b("...q.

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	<unknown>
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x4001a0
Flags:	0x9
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	69296
Section Header Size:	40
Number of Section Headers:	15
Header String Table Index:	12

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x400094	0x94	0x30	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x4000e0	0xe0	0xd520	0x0	0x6	AX	0	0	32
.fini	PROGBITS	0x40d600	0xd600	0x24	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x40d624	0xd624	0x266c	0x0	0x2	A	0	0	4
.eh_frame	PROGBITS	0x40fc90	0xfc90	0x4	0x0	0x2	A	0	0	4
.ctors	PROGBITS	0x410000	0x10000	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x410008	0x10008	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x410010	0x10010	0x4	0x0	0x3	WA	0	0	4
.data	PROGBITS	0x410014	0x10014	0x398	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x4103ac	0x103ac	0x635c	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x103ac	0xa9e	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x10e4a	0x66	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x11108	0x29e0	0x10	0x0		14	249	4
.strtab	STRTAB	0x0	0x13ae8	0x1fb5	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0xfc94	0xfc94	6.9202	0x5	R E	0x10000	.init .text .fini .rodata .eh_frame
LOAD	0x10000	0x410000	0x410000	0x3ac	0x6708	2.7620	0x6	RW	0x10000	.ctors .dtors .jcr .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x400094	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x4000e0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x40d600	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x40d624	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x40fc90	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x410000	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x410008	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x410010	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x410014	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x4103ac	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	14
/home/firmware/build/temp-sh4/gcc-core/gcc/config/sh/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-sh4/gcc-core/gcc/config/sh/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
L1	.symtab	0x406b1c	0	NOTYPE	<unknown>	DEFAULT	2
L_abort	.symtab	0x4001d0	0	NOTYPE	<unknown>	DEFAULT	2
L_fini	.symtab	0x4001c8	0	NOTYPE	<unknown>	DEFAULT	2
L_init	.symtab	0x4001c4	0	NOTYPE	<unknown>	DEFAULT	2
L_main	.symtab	0x4001c0	0	NOTYPE	<unknown>	DEFAULT	2
L_uClibc_main	.symtab	0x4001cc	0	NOTYPE	<unknown>	DEFAULT	2
Q	.symtab	0x4103e0	16384	OBJECT	<unknown>	DEFAULT	10
Sakura_Bot.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
SendSTD	.symtab	0x403020	344	FUNC	<unknown>	DEFAULT	2
SendSTDHEX	.symtab	0x4026b0	372	FUNC	<unknown>	DEFAULT	2
SendSTD_HEX	.symtab	0x4032e0	420	FUNC	<unknown>	DEFAULT	2
SendUDP	.symtab	0x401cf4	1040	FUNC	<unknown>	DEFAULT	2
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x410004	0	OBJECT	<unknown>	DEFAULT	6
__CTOR_LIST__	.symtab	0x410000	0	OBJECT	<unknown>	DEFAULT	6
__C_ctype_b	.symtab	0x41004c	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x40e638	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x4103a4	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x40ed1e	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x410054	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x40e938	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x41000c	0	OBJECT	<unknown>	DEFAULT	7
__DTOR_LIST__	.symtab	0x410008	0	OBJECT	<unknown>	DEFAULT	7
__EH_FRAME_BEGIN__	.symtab	0x40fc90	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x40fc90	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x41004c	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_b_data	.symtab	0x40e638	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_tolower	.symtab	0x4103a4	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_tolower_data	.symtab	0x40ed1e	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_toupper	.symtab	0x410054	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_toupper_data	.symtab	0x40e938	768	OBJECT	<unknown>	HIDDEN	4
__GI___ctype_b	.symtab	0x410050	4	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_tolower	.symtab	0x4103a8	4	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_toupper	.symtab	0x410058	4	OBJECT	<unknown>	HIDDEN	9
__GI___errno_location	.symtab	0x4070a0	20	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x40c378	216	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x40c5d8	32	FUNC	<unknown>	HIDDEN	2
__GI___h_errno_location	.symtab	0x408eec	20	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x406b24	172	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl64	.symtab	0x406bd0	152	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x406e7c	160	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x4089c8	104	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x408a94	80	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x40c5f8	200	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x406c68	48	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x4080c0	244	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x408624	24	FUNC	<unknown>	HIDDEN	2
__GI_atol	.symtab	0x408624	24	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0x406cd0	56	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x406d08	56	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x407af0	40	FUNC	<unknown>	HIDDEN	2
__GI_errno	.symtab	0x41460c	4	OBJECT	<unknown>	HIDDEN	10
__GI_exit	.symtab	0x408794	112	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x40a078	272	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x406b24	172	FUNC	<unknown>	HIDDEN	2
__GI_fcntl64	.symtab	0x406bd0	152	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x40a660	320	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x40c378	216	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x40a508	120	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x40a7a0	128	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x40a188	24	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x406d40	56	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x40c450	68	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x40d354	28	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x40d370	232	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x40c494	156	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x40c378	216	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x408d48	56	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x408d80	56	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x408db8	56	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname	.symtab	0x4077fc	72	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x407844	684	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x406d78	56	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x407b18	40	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x408df0	56	FUNC	<unknown>	HIDDEN	2
__GI_h_errno	.symtab	0x414610	4	OBJECT	<unknown>	HIDDEN	10
__GI_inet_addr	.symtab	0x4077d0	44	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x409508	204	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa	.symtab	0x4077b8	24	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa_r	.symtab	0x407740	120	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x40add8	492	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x40ab04	408	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x408574	176	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x406db0	148	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x40a9d0	36	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x406e44	56	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x40d540	96	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x40d1bc	204	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x407140	636	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x409004	978	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x40c530	36	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x40d288	204	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x4073c0	124	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x408e28	56	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x406e7c	160	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x40a040	56	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x409ea4	40	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x4081c8	100	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x408448	104	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x40a820	152	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x406f34	56	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x407b6c	40	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x408cb8	88	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x406f6c	52	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x407b94	40	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x407bbc	48	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x406fa0	56	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x407bec	44	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x408370	216	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x409ecc	160	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x407c40	184	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x408e60	84	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x408804	376	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x407c18	40	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x40b554	132	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x4084b0	196	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x40c6c0	64	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x40743c	192	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x4074fc	34	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x4074fc	34	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x40751e	30	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x40a984	76	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x40753c	136	FUNC	<unknown>	HIDDEN	2
__GI_strncat	.symtab	0x40a8b8	154	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x4093d8	142	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x40c554	132	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x4094e0	40	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x40a952	48	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x4075c4	192	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x40769c	24	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x409468	120	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x40863c	20	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x40a9f4	116	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x406fd8	56	FUNC	<unknown>	HIDDEN	2
__GI_tolower	.symtab	0x40b52c	40	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x407078	40	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x40b5d8	168	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x408eb4	56	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x407010	20	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x40c8b4	68	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x40c918	112	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x40c8f8	32	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x407024	56	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x410010	0	OBJECT	<unknown>	DEFAULT	8
__JCR_LIST__	.symtab	0x410010	0	OBJECT	<unknown>	DEFAULT	8
__app_fini	.symtab	0x414600	4	OBJECT	<unknown>	HIDDEN	10
__atexit_lock	.symtab	0x410230	24	OBJECT	<unknown>	DEFAULT	9
__bsd_signal	.symtab	0x407c40	184	FUNC	<unknown>	HIDDEN	2
__bss_start	.symtab	0x4103ac	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x408a4a	74	FUNC	<unknown>	DEFAULT	2
__ctype_b	.symtab	0x410050	4	OBJECT	<unknown>	DEFAULT	9
__ctype_tolower	.symtab	0x4103a8	4	OBJECT	<unknown>	DEFAULT	9
__ctype_toupper	.symtab	0x410058	4	OBJECT	<unknown>	DEFAULT	9
__curbrk	.symtab	0x414630	4	OBJECT	<unknown>	HIDDEN	10
__data_start	.symtab	0x410014	0	NOTYPE	<unknown>	DEFAULT	9
__decode_answer	.symtab	0x40b1a0	228	FUNC	<unknown>	HIDDEN	2
__decode_dotted	.symtab	0x40c7ac	200	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x40b084	148	FUNC	<unknown>	HIDDEN	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__dns_lookup	.symtab	0x4095d4	1604	FUNC	<unknown>	HIDDEN	2
__do_global_ctors_aux	.symtab	0x40d5c0	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x4000e0	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x410014	0	OBJECT	<unknown>	HIDDEN	9
__encode_dotted	.symtab	0x40c700	172	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x40afc4	192	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x40b118	104	FUNC	<unknown>	HIDDEN	2
__environ	.symtab	0x4145f8	4	OBJECT	<unknown>	DEFAULT	10
__errno_location	.symtab	0x4070a0	20	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x4145f0	4	OBJECT	<unknown>	HIDDEN	10
__fgetc_unlocked	.symtab	0x40c378	216	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x410000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fini_array_start	.symtab	0x410000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__get_hosts_byname_r	.symtab	0x409e70	52	FUNC	<unknown>	HIDDEN	2
__glibc_strerror_r	.symtab	0x40c5d8	32	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__h_errno_location	.symtab	0x408eec	20	FUNC	<unknown>	DEFAULT	2
__h_errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__heap_alloc	.symtab	0x407f70	98	FUNC	<unknown>	DEFAULT	2
__heap_free	.symtab	0x408010	176	FUNC	<unknown>	DEFAULT	2
__heap_link_free_area	.symtab	0x407fd4	34	FUNC	<unknown>	DEFAULT	2
__heap_link_free_area_after	.symtab	0x407ff6	26	FUNC	<unknown>	DEFAULT	2
__init_array_end	.symtab	0x410000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__init_array_start	.symtab	0x410000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__init_brk	.symtab	0x409fc4	68	FUNC	<unknown>	HIDDEN	2
__init_brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__length_dotted	.symtab	0x40c874	64	FUNC	<unknown>	HIDDEN	2
__length_question	.symtab	0x40b180	32	FUNC	<unknown>	HIDDEN	2
__libc_close	.symtab	0x406d08	56	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x407af0	40	FUNC	<unknown>	DEFAULT	2
__libc_creat	.symtab	0x406f1c	24	FUNC	<unknown>	DEFAULT	2
__libc_fcntl	.symtab	0x406b24	172	FUNC	<unknown>	DEFAULT	2
__libc_fcntl64	.symtab	0x406bd0	152	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x406d40	56	FUNC	<unknown>	DEFAULT	2
__libc_getpid	.symtab	0x406d78	56	FUNC	<unknown>	DEFAULT	2
__libc_lseek64	.symtab	0x40d540	96	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0x408e28	56	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x406e7c	160	FUNC	<unknown>	DEFAULT	2
__libc_poll	.symtab	0x40a040	56	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x406f34	56	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x407b6c	40	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x406f6c	52	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x407b94	40	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x407bbc	48	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x409ecc	160	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x4145f4	4	OBJECT	<unknown>	DEFAULT	10
__libc_waitpid	.symtab	0x407010	20	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x407024	56	FUNC	<unknown>	DEFAULT	2
__malloc_heap	.symtab	0x41005c	4	OBJECT	<unknown>	DEFAULT	9
__malloc_heap_lock	.symtab	0x4145d4	24	OBJECT	<unknown>	DEFAULT	10
__malloc_sbrk_lock	.symtab	0x4166c4	24	OBJECT	<unknown>	DEFAULT	10
__nameserver	.symtab	0x4166ec	12	OBJECT	<unknown>	HIDDEN	10
__nameservers	.symtab	0x4166f8	4	OBJECT	<unknown>	HIDDEN	10
__open_etc_hosts	.symtab	0x40b284	68	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x409c18	600	FUNC	<unknown>	HIDDEN	2
__pagesize	.symtab	0x4145fc	4	OBJECT	<unknown>	DEFAULT	10
__preinit_array_end	.symtab	0x410000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__preinit_array_start	.symtab	0x410000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__pthread_initialize_minimal	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0x408a30	14	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x408a30	14	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x408a30	14	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x408a30	14	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x408a30	14	FUNC	<unknown>	DEFAULT	2
__pthread_return_void	.symtab	0x408a3e	12	FUNC	<unknown>	DEFAULT	2
__raise	.symtab	0x409ea4	40	FUNC	<unknown>	HIDDEN	2
__read_etc_hosts_r	.symtab	0x40b2c8	612	FUNC	<unknown>	HIDDEN	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__resolv_lock	.symtab	0x410250	24	OBJECT	<unknown>	DEFAULT	9
__rtld_fini	.symtab	0x414604	4	OBJECT	<unknown>	HIDDEN	10
__sdivsi3_i4	.symtab	0x40d5a0	14	FUNC	<unknown>	HIDDEN	2
__searchdomain	.symtab	0x4166dc	16	OBJECT	<unknown>	HIDDEN	10
__searchdomains	.symtab	0x4166fc	4	OBJECT	<unknown>	HIDDEN	10
__sigaddset	.symtab	0x407d24	40	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x407d4c	42	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x407cf8	44	FUNC	<unknown>	DEFAULT	2
__socketcall	.symtab	0x408d10	56	FUNC	<unknown>	HIDDEN	2
__socketcall.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__stdin	.symtab	0x410274	4	OBJECT	<unknown>	DEFAULT	9
__stdio_READ	.symtab	0x40c988	80	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x40b680	148	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x40d458	180	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x40c9d8	264	FUNC	<unknown>	HIDDEN	2
__stdio_init_mutex	.symtab	0x40a424	28	FUNC	<unknown>	HIDDEN	2
__stdio_mutex_initializer.3812	.symtab	0x40ecbc	24	OBJECT	<unknown>	DEFAULT	4
__stdio_rfill	.symtab	0x40cae0	48	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x40d50c	52	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x40cb10	120	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x40cb88	176	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x40a4d4	52	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x410278	4	OBJECT	<unknown>	DEFAULT	9
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_rt_sigaction	.symtab	0x40a008	56	FUNC	<unknown>	HIDDEN	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uClibc_fini	.symtab	0x4089c8	104	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x408a94	80	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x408ae4	468	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x410248	4	OBJECT	<unknown>	HIDDEN	9
__udivsi3_i4	.symtab	0x406af4	48	FUNC	<unknown>	HIDDEN	2
__xpg_strerror_r	.symtab	0x40c5f8	200	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_brk	.symtab	0x409f8c	56	FUNC	<unknown>	HIDDEN	2
_charpad	.symtab	0x40b714	80	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_dl_aux_init	.symtab	0x409f6c	32	FUNC	<unknown>	DEFAULT	2
_dl_phdr	.symtab	0x416700	4	OBJECT	<unknown>	DEFAULT	10
_dl_phnum	.symtab	0x416704	4	OBJECT	<unknown>	DEFAULT	10
_edata	.symtab	0x4103ac	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x416708	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_errno	.symtab	0x41460c	4	OBJECT	<unknown>	DEFAULT	10
_exit	.symtab	0x406c68	48	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x40d600	12	FUNC	<unknown>	HIDDEN	3
_fixed_buffers	.symtab	0x41463c	8192	OBJECT	<unknown>	DEFAULT	10
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x40b764	124	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x40cccc	1264	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_h_errno	.symtab	0x414610	4	OBJECT	<unknown>	DEFAULT	10
_init	.symtab	0x400094	12	FUNC	<unknown>	HIDDEN	1
_load_inttype	.symtab	0x40cc38	92	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_init	.symtab	0x40bd24	120	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x40bff0	902	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x40bd9c	72	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x40bde4	464	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x40bfb4	60	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x408a3e	12	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x408a3e	12	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_sigintr	.symtab	0x416644	128	OBJECT	<unknown>	HIDDEN	10
_start	.symtab	0x4001a0	30	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x40a1a0	536	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x40a3b8	108	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x41027c	4	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_add_lock	.symtab	0x410280	24	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_dec_use	.symtab	0x40a580	224	FUNC	<unknown>	DEFAULT	2
_stdio_openlist_del_count	.symtab	0x414638	4	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_del_lock	.symtab	0x410298	24	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_use_count	.symtab	0x414634	4	OBJECT	<unknown>	DEFAULT	10
_stdio_streams	.symtab	0x4102b4	240	OBJECT	<unknown>	DEFAULT	9
_stdio_term	.symtab	0x40a440	148	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x4102b0	4	OBJECT	<unknown>	DEFAULT	9
_stdlib_strto_l	.symtab	0x408650	324	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x40cc94	56	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x40f0d8	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x408f00	260	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x40b7e0	1348	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x4080c0	244	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
access	.symtab	0x406c98	56	FUNC	<unknown>	DEFAULT	2
access.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
astd	.symtab	0x4043b8	368	FUNC	<unknown>	DEFAULT	2
atcp	.symtab	0x403e10	1448	FUNC	<unknown>	DEFAULT	2
atoi	.symtab	0x408624	24	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x408624	24	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
audp	.symtab	0x4038d4	1340	FUNC	<unknown>	DEFAULT	2
bcopy	.symtab	0x407684	24	FUNC	<unknown>	DEFAULT	2
bcopy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
been_there_done_that	.symtab	0x4145ec	4	OBJECT	<unknown>	DEFAULT	10
been_there_done_that.2753	.symtab	0x414608	4	OBJECT	<unknown>	DEFAULT	10
bsd_signal	.symtab	0x407c40	184	FUNC	<unknown>	DEFAULT	2
buf.2577	.symtab	0x4143e4	16	OBJECT	<unknown>	DEFAULT	10
buf.4814	.symtab	0x4143f4	460	OBJECT	<unknown>	DEFAULT	10
c	.symtab	0x410044	4	OBJECT	<unknown>	DEFAULT	9
chdir	.symtab	0x406cd0	56	FUNC	<unknown>	DEFAULT	2
chdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x406d08	56	FUNC	<unknown>	DEFAULT	2
close.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
commServer	.symtab	0x410020	4	OBJECT	<unknown>	DEFAULT	9
completed.2217	.symtab	0x4103ac	1	OBJECT	<unknown>	DEFAULT	10
connect	.symtab	0x407af0	40	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connectTimeout	.symtab	0x4015e0	772	FUNC	<unknown>	DEFAULT	2
creat	.symtab	0x406f1c	24	FUNC	<unknown>	DEFAULT	2
crti.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
csum	.symtab	0x401a18	232	FUNC	<unknown>	DEFAULT	2
currentServer	.symtab	0x410040	4	OBJECT	<unknown>	DEFAULT	9
data_start	.symtab	0x41001c	0	NOTYPE	<unknown>	DEFAULT	9
decodea.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dnslookup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ	.symtab	0x4145f8	4	OBJECT	<unknown>	DEFAULT	10
errno	.symtab	0x41460c	4	OBJECT	<unknown>	DEFAULT	10
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x408794	112	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x40fc48	72	OBJECT	<unknown>	DEFAULT	4
fclose	.symtab	0x40a078	272	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x406b24	172	FUNC	<unknown>	DEFAULT	2
fcntl64	.symtab	0x406bd0	152	FUNC	<unknown>	DEFAULT	2
fdgets	.symtab	0x4003f4	200	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x40a660	320	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x40c378	216	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x40a508	120	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x40a7a0	128	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fmt	.symtab	0x40fc34	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x40a188	24	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0x406d40	56	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs_unlocked	.symtab	0x40c450	68	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x400140	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x407e80	240	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x40d354	28	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x40d354	28	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x40d370	232	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ftcp	.symtab	0x402104	1452	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked	.symtab	0x40c494	156	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getArch	.symtab	0x404528	20	FUNC	<unknown>	DEFAULT	2
getHost	.symtab	0x401188	84	FUNC	<unknown>	DEFAULT	2
getOurIP	.symtab	0x4004bc	680	FUNC	<unknown>	DEFAULT	2
getPortz	.symtab	0x40453c	152	FUNC	<unknown>	DEFAULT	2
getRandomIP	.symtab	0x400398	92	FUNC	<unknown>	DEFAULT	2
get_hosts_byname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getc_unlocked	.symtab	0x40c378	216	FUNC	<unknown>	DEFAULT	2
getegid	.symtab	0x408d48	56	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x408d80	56	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x408db8	56	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname	.symtab	0x4077fc	72	FUNC	<unknown>	DEFAULT	2
gethostbyname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r	.symtab	0x407844	684	FUNC	<unknown>	DEFAULT	2
gethostbyname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x406d78	56	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockname	.symtab	0x407b18	40	FUNC	<unknown>	DEFAULT	2
getsockname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x407b40	44	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x408df0	56	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gotIP	.symtab	0x4103cc	4	OBJECT	<unknown>	DEFAULT	10
h.4813	.symtab	0x4145c0	20	OBJECT	<unknown>	DEFAULT	10
h_errno	.symtab	0x414610	4	OBJECT	<unknown>	DEFAULT	10
heap_alloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
heap_free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
htonl	.symtab	0x4076fa	46	FUNC	<unknown>	DEFAULT	2
htons	.symtab	0x407728	22	FUNC	<unknown>	DEFAULT	2
i.4082	.symtab	0x410048	4	OBJECT	<unknown>	DEFAULT	9
index	.symtab	0x40743c	192	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x4077d0	44	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x409508	204	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa	.symtab	0x4077b8	24	FUNC	<unknown>	DEFAULT	2
inet_ntoa.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa_r	.symtab	0x407740	120	FUNC	<unknown>	DEFAULT	2
inet_ntop	.symtab	0x40add8	492	FUNC	<unknown>	DEFAULT	2
inet_ntop4	.symtab	0x40ac9c	316	FUNC	<unknown>	DEFAULT	2
inet_pton	.symtab	0x40ab04	408	FUNC	<unknown>	DEFAULT	2
inet_pton4	.symtab	0x40aa68	156	FUNC	<unknown>	DEFAULT	2
initConnection	.symtab	0x4062ac	340	FUNC	<unknown>	DEFAULT	2
init_rand	.symtab	0x4001d4	180	FUNC	<unknown>	DEFAULT	2
initial_fa	.symtab	0x410060	260	OBJECT	<unknown>	DEFAULT	9
initstate	.symtab	0x408298	120	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x408574	176	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x406db0	148	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isatty	.symtab	0x40a9d0	36	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isspace	.symtab	0x40705c	28	FUNC	<unknown>	DEFAULT	2
isspace.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0x406e44	56	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lengthd.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lengthq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/sh/sh4/memcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/sh/crt1.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/sh/crti.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/sh/crtn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
listFork	.symtab	0x4018e4	308	FUNC	<unknown>	DEFAULT	2
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x40d540	96	FUNC	<unknown>	DEFAULT	2
macAddress	.symtab	0x4103d8	6	OBJECT	<unknown>	DEFAULT	10
main	.symtab	0x406400	1780	FUNC	<unknown>	DEFAULT	2
mainCommSock	.symtab	0x4103c8	4	OBJECT	<unknown>	DEFAULT	10
makeIPPacket	.symtab	0x401c14	224	FUNC	<unknown>	DEFAULT	2
makeRandomStr	.symtab	0x4011dc	156	FUNC	<unknown>	DEFAULT	2
makevsepacket	.symtab	0x402944	248	FUNC	<unknown>	DEFAULT	2
malloc	.symtab	0x407d78	264	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memchr	.symtab	0x40d1bc	204	FUNC	<unknown>	DEFAULT	2
memchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memcpy	.symtab	0x407140	636	FUNC	<unknown>	DEFAULT	2
memmove	.symtab	0x409004	978	FUNC	<unknown>	DEFAULT	2
memmove.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mempcpy	.symtab	0x40c530	36	FUNC	<unknown>	DEFAULT	2
mempcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memrchr	.symtab	0x40d288	204	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x4073c0	124	FUNC	<unknown>	DEFAULT	2
memset.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mylock	.symtab	0x410164	24	OBJECT	<unknown>	DEFAULT	9
mylock	.symtab	0x41017c	24	OBJECT	<unknown>	DEFAULT	9
mylock	.symtab	0x414614	24	OBJECT	<unknown>	DEFAULT	10
nanosleep	.symtab	0x408e28	56	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
next_start.1030	.symtab	0x4143e0	4	OBJECT	<unknown>	DEFAULT	10
ntohl	.symtab	0x4076b4	48	FUNC	<unknown>	DEFAULT	2
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0x4076e4	22	FUNC	<unknown>	DEFAULT	2
ntop.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
numpids	.symtab	0x4103d0	8	OBJECT	<unknown>	DEFAULT	10
object.2270	.symtab	0x4103b0	24	OBJECT	<unknown>	DEFAULT	10
open	.symtab	0x406e7c	160	FUNC	<unknown>	DEFAULT	2
open.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opennameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ourIP	.symtab	0x41663c	4	OBJECT	<unknown>	DEFAULT	10
p.2215	.symtab	0x410018	0	OBJECT	<unknown>	DEFAULT	9
pids	.symtab	0x416640	4	OBJECT	<unknown>	DEFAULT	10
poll	.symtab	0x40a040	56	FUNC	<unknown>	DEFAULT	2
poll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prefix.4023	.symtab	0x40f030	12	OBJECT	<unknown>	DEFAULT	4
print	.symtab	0x400bf0	1072	FUNC	<unknown>	DEFAULT	2
printchar	.symtab	0x400898	104	FUNC	<unknown>	DEFAULT	2
printi	.symtab	0x400a58	408	FUNC	<unknown>	DEFAULT	2
prints	.symtab	0x400900	344	FUNC	<unknown>	DEFAULT	2
processCmd	.symtab	0x4045d4	7384	FUNC	<unknown>	DEFAULT	2
qual_chars.4029	.symtab	0x40f044	20	OBJECT	<unknown>	DEFAULT	4
raise	.symtab	0x409ea4	40	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x4081b4	20	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand_cmwc	.symtab	0x400288	272	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x4081c8	100	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x40ec38	40	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x408448	104	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randtbl	.symtab	0x4101b0	128	OBJECT	<unknown>	DEFAULT	9
rawmemchr	.symtab	0x40a820	152	FUNC	<unknown>	DEFAULT	2
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read	.symtab	0x406f34	56	FUNC	<unknown>	DEFAULT	2
read.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read_etc_hosts_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recv	.symtab	0x407b6c	40	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recvLine	.symtab	0x401278	872	FUNC	<unknown>	DEFAULT	2
rtcp	.symtab	0x403484	1104	FUNC	<unknown>	DEFAULT	2
sbrk	.symtab	0x408cb8	88	FUNC	<unknown>	DEFAULT	2
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
select	.symtab	0x406f6c	52	FUNC	<unknown>	DEFAULT	2
select.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send	.symtab	0x407b94	40	FUNC	<unknown>	DEFAULT	2
send.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sendto	.symtab	0x407bbc	48	FUNC	<unknown>	DEFAULT	2
sendto.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsid	.symtab	0x406fa0	56	FUNC	<unknown>	DEFAULT	2
setsid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsockopt	.symtab	0x407bec	44	FUNC	<unknown>	DEFAULT	2
setsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate	.symtab	0x40822c	108	FUNC	<unknown>	DEFAULT	2
setstate_r	.symtab	0x408370	216	FUNC	<unknown>	DEFAULT	2
sigaction	.symtab	0x409ecc	160	FUNC	<unknown>	DEFAULT	2
sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
signal	.symtab	0x407c40	184	FUNC	<unknown>	DEFAULT	2
signal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigprocmask	.symtab	0x408e60	84	FUNC	<unknown>	DEFAULT	2
sigprocmask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigsetops.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sleep	.symtab	0x408804	376	FUNC	<unknown>	DEFAULT	2
sleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket	.symtab	0x407c18	40	FUNC	<unknown>	DEFAULT	2
socket.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket_connect	.symtab	0x402824	288	FUNC	<unknown>	DEFAULT	2
sockprintf	.symtab	0x401020	360	FUNC	<unknown>	DEFAULT	2
spec_and_mask.4028	.symtab	0x40f058	16	OBJECT	<unknown>	DEFAULT	4
spec_base.4022	.symtab	0x40f03c	7	OBJECT	<unknown>	DEFAULT	4
spec_chars.4025	.symtab	0x40f084	21	OBJECT	<unknown>	DEFAULT	4
spec_flags.4024	.symtab	0x40f09c	8	OBJECT	<unknown>	DEFAULT	4
spec_or_mask.4027	.symtab	0x40f068	16	OBJECT	<unknown>	DEFAULT	4
spec_ranges.4026	.symtab	0x40f078	9	OBJECT	<unknown>	DEFAULT	4
sprintf	.symtab	0x40b554	132	FUNC	<unknown>	DEFAULT	2
sprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
srand	.symtab	0x408310	96	FUNC	<unknown>	DEFAULT	2
srandom	.symtab	0x408310	96	FUNC	<unknown>	DEFAULT	2
srandom_r	.symtab	0x4084b0	196	FUNC	<unknown>	DEFAULT	2
static_id	.symtab	0x41024c	2	OBJECT	<unknown>	DEFAULT	9
static_ns	.symtab	0x41462c	4	OBJECT	<unknown>	DEFAULT	10
stderr	.symtab	0x410270	4	OBJECT	<unknown>	DEFAULT	9
stdhexflood	.symtab	0x403178	360	FUNC	<unknown>	DEFAULT	2
stdin	.symtab	0x410268	4	OBJECT	<unknown>	DEFAULT	9
stdout	.symtab	0x41026c	4	OBJECT	<unknown>	DEFAULT	9
strcasecmp	.symtab	0x40c6c0	64	FUNC	<unknown>	DEFAULT	2
strcasecmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchr	.symtab	0x40743c	192	FUNC	<unknown>	DEFAULT	2
strchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcmp	.symtab	0x4074fc	34	FUNC	<unknown>	DEFAULT	2
strcmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcoll	.symtab	0x4074fc	34	FUNC	<unknown>	DEFAULT	2
strcpy	.symtab	0x40751e	30	FUNC	<unknown>	DEFAULT	2
strcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strdup	.symtab	0x40a984	76	FUNC	<unknown>	DEFAULT	2
strdup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strerror_r	.symtab	0x40c5f8	200	FUNC	<unknown>	DEFAULT	2
strlen	.symtab	0x40753c	136	FUNC	<unknown>	DEFAULT	2
strlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncat	.symtab	0x40a8b8	154	FUNC	<unknown>	DEFAULT	2
strncat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncpy	.symtab	0x4093d8	142	FUNC	<unknown>	DEFAULT	2
strncpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strnlen	.symtab	0x40c554	132	FUNC	<unknown>	DEFAULT	2
strnlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strpbrk	.symtab	0x4094e0	40	FUNC	<unknown>	DEFAULT	2
strpbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strspn	.symtab	0x40a952	48	FUNC	<unknown>	DEFAULT	2
strspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strstr	.symtab	0x4075c4	192	FUNC	<unknown>	DEFAULT	2
strstr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok	.symtab	0x40769c	24	FUNC	<unknown>	DEFAULT	2
strtok.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok_r	.symtab	0x409468	120	FUNC	<unknown>	DEFAULT	2
strtok_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtol	.symtab	0x40863c	20	FUNC	<unknown>	DEFAULT	2
strtol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcgetattr	.symtab	0x40a9f4	116	FUNC	<unknown>	DEFAULT	2
tcgetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcpcsum	.symtab	0x401b00	276	FUNC	<unknown>	DEFAULT	2
time	.symtab	0x406fd8	56	FUNC	<unknown>	DEFAULT	2
time.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tolower	.symtab	0x40b52c	40	FUNC	<unknown>	DEFAULT	2
tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
toupper	.symtab	0x407078	40	FUNC	<unknown>	DEFAULT	2
toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
trim	.symtab	0x400764	308	FUNC	<unknown>	DEFAULT	2
trivial	.symtab	0x406b18	0	NOTYPE	<unknown>	DEFAULT	2
type_codes	.symtab	0x40f0a4	24	OBJECT	<unknown>	DEFAULT	4
type_sizes	.symtab	0x40f0bc	12	OBJECT	<unknown>	DEFAULT	4
unknown.1072	.symtab	0x40f0c8	14	OBJECT	<unknown>	DEFAULT	4
unsafe_state	.symtab	0x410194	28	OBJECT	<unknown>	DEFAULT	9
useragents	.symtab	0x410024	28	OBJECT	<unknown>	DEFAULT	9
usleep	.symtab	0x40897c	76	FUNC	<unknown>	DEFAULT	2
usleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
vseattack	.symtab	0x402a3c	1508	FUNC	<unknown>	DEFAULT	2
vsnprintf	.symtab	0x40b5d8	168	FUNC	<unknown>	DEFAULT	2
vsnprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wait4	.symtab	0x408eb4	56	FUNC	<unknown>	DEFAULT	2
wait4.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
waitpid	.symtab	0x407010	20	FUNC	<unknown>	DEFAULT	2
waitpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcrtomb	.symtab	0x40c8b4	68	FUNC	<unknown>	DEFAULT	2
wcrtomb.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsnrtombs	.symtab	0x40c918	112	FUNC	<unknown>	DEFAULT	2
wcsnrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsrtombs	.symtab	0x40c8f8	32	FUNC	<unknown>	DEFAULT	2
wcsrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
write	.symtab	0x407024	56	FUNC	<unknown>	DEFAULT	2
write.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
xdigits.3026	.symtab	0x40ece8	17	OBJECT	<unknown>	DEFAULT	4

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-03-08T06:03:12.033346+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48612	104.248.115.71	606	TCP
2025-03-08T06:03:13.451018+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48614	104.248.115.71	606	TCP
2025-03-08T06:03:14.946409+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48616	104.248.115.71	606	TCP
2025-03-08T06:03:16.413916+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48618	104.248.115.71	606	TCP
2025-03-08T06:03:17.805443+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48620	104.248.115.71	606	TCP
2025-03-08T06:03:19.214903+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48622	104.248.115.71	606	TCP
2025-03-08T06:03:20.618717+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48624	104.248.115.71	606	TCP
2025-03-08T06:03:22.041792+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48626	104.248.115.71	606	TCP
2025-03-08T06:03:23.466554+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48628	104.248.115.71	606	TCP
2025-03-08T06:03:24.868901+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48630	104.248.115.71	606	TCP
2025-03-08T06:03:26.255927+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48632	104.248.115.71	606	TCP
2025-03-08T06:03:27.650212+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48634	104.248.115.71	606	TCP
2025-03-08T06:03:29.077118+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48636	104.248.115.71	606	TCP
2025-03-08T06:03:30.479540+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48638	104.248.115.71	606	TCP
2025-03-08T06:03:31.952034+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48640	104.248.115.71	606	TCP
2025-03-08T06:03:33.526117+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48642	104.248.115.71	606	TCP
2025-03-08T06:03:34.958728+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48644	104.248.115.71	606	TCP
2025-03-08T06:03:36.352489+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48646	104.248.115.71	606	TCP
2025-03-08T06:03:37.824448+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48648	104.248.115.71	606	TCP
2025-03-08T06:03:39.228181+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48650	104.248.115.71	606	TCP
2025-03-08T06:03:40.700019+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48652	104.248.115.71	606	TCP
2025-03-08T06:03:42.124527+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48654	104.248.115.71	606	TCP
2025-03-08T06:03:43.525223+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48656	104.248.115.71	606	TCP
2025-03-08T06:03:44.935769+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48658	104.248.115.71	606	TCP
2025-03-08T06:03:46.339626+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48660	104.248.115.71	606	TCP
2025-03-08T06:03:47.744820+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48662	104.248.115.71	606	TCP
2025-03-08T06:03:49.150719+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48664	104.248.115.71	606	TCP
2025-03-08T06:03:50.560018+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48666	104.248.115.71	606	TCP
2025-03-08T06:03:51.963683+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48668	104.248.115.71	606	TCP
2025-03-08T06:03:53.370480+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48670	104.248.115.71	606	TCP
2025-03-08T06:03:54.779471+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48672	104.248.115.71	606	TCP
2025-03-08T06:03:56.181909+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48674	104.248.115.71	606	TCP
2025-03-08T06:03:57.590009+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48676	104.248.115.71	606	TCP
2025-03-08T06:03:59.035086+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48678	104.248.115.71	606	TCP
2025-03-08T06:04:00.885247+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48680	104.248.115.71	606	TCP
2025-03-08T06:04:02.295197+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48682	104.248.115.71	606	TCP
2025-03-08T06:04:03.732481+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48684	104.248.115.71	606	TCP
2025-03-08T06:04:05.137628+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48686	104.248.115.71	606	TCP
2025-03-08T06:04:06.544043+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48688	104.248.115.71	606	TCP
2025-03-08T06:04:07.949836+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48690	104.248.115.71	606	TCP
2025-03-08T06:04:09.355530+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48692	104.248.115.71	606	TCP
2025-03-08T06:04:10.760376+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48694	104.248.115.71	606	TCP
2025-03-08T06:04:12.167408+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48696	104.248.115.71	606	TCP
2025-03-08T06:04:13.594235+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48698	104.248.115.71	606	TCP
2025-03-08T06:04:15.013949+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48700	104.248.115.71	606	TCP
2025-03-08T06:04:16.436249+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48702	104.248.115.71	606	TCP
2025-03-08T06:04:17.839148+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48704	104.248.115.71	606	TCP
2025-03-08T06:04:19.247055+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48706	104.248.115.71	606	TCP
2025-03-08T06:04:20.653127+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48708	104.248.115.71	606	TCP
2025-03-08T06:04:22.057995+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48710	104.248.115.71	606	TCP
2025-03-08T06:04:23.498208+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48712	104.248.115.71	606	TCP
2025-03-08T06:04:25.024666+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48714	104.248.115.71	606	TCP
2025-03-08T06:04:26.479084+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48716	104.248.115.71	606	TCP
2025-03-08T06:04:27.886885+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48718	104.248.115.71	606	TCP
2025-03-08T06:04:29.299304+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48720	104.248.115.71	606	TCP
2025-03-08T06:04:30.698361+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48722	104.248.115.71	606	TCP
2025-03-08T06:04:32.106368+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48724	104.248.115.71	606	TCP
2025-03-08T06:04:33.511643+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48726	104.248.115.71	606	TCP
2025-03-08T06:04:34.917246+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48728	104.248.115.71	606	TCP
2025-03-08T06:04:36.324879+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48730	104.248.115.71	606	TCP
2025-03-08T06:04:37.738934+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48732	104.248.115.71	606	TCP
2025-03-08T06:04:39.137423+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48734	104.248.115.71	606	TCP
2025-03-08T06:04:40.565423+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48736	104.248.115.71	606	TCP
2025-03-08T06:04:41.966978+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48738	104.248.115.71	606	TCP
2025-03-08T06:04:43.370013+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48740	104.248.115.71	606	TCP
2025-03-08T06:04:44.777117+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48742	104.248.115.71	606	TCP
2025-03-08T06:04:46.275402+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48744	104.248.115.71	606	TCP
2025-03-08T06:04:47.699301+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48746	104.248.115.71	606	TCP
2025-03-08T06:04:49.186007+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48748	104.248.115.71	606	TCP
2025-03-08T06:04:50.656368+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48750	104.248.115.71	606	TCP
2025-03-08T06:04:52.060278+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48752	104.248.115.71	606	TCP
2025-03-08T06:04:53.465423+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48754	104.248.115.71	606	TCP
2025-03-08T06:04:54.874388+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48756	104.248.115.71	606	TCP
2025-03-08T06:04:56.299729+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48758	104.248.115.71	606	TCP
2025-03-08T06:04:57.700201+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48760	104.248.115.71	606	TCP
2025-03-08T06:04:59.262775+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48762	104.248.115.71	606	TCP
2025-03-08T06:05:00.670680+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48764	104.248.115.71	606	TCP
2025-03-08T06:05:02.073849+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48766	104.248.115.71	606	TCP
2025-03-08T06:05:03.484054+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48768	104.248.115.71	606	TCP
2025-03-08T06:05:04.888233+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48770	104.248.115.71	606	TCP
2025-03-08T06:05:06.299140+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48772	104.248.115.71	606	TCP
2025-03-08T06:05:07.702990+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48774	104.248.115.71	606	TCP
2025-03-08T06:05:09.137435+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48776	104.248.115.71	606	TCP
2025-03-08T06:05:10.552133+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48778	104.248.115.71	606	TCP
2025-03-08T06:05:12.169762+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48780	104.248.115.71	606	TCP
2025-03-08T06:05:13.576059+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48782	104.248.115.71	606	TCP
2025-03-08T06:05:14.982125+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48784	104.248.115.71	606	TCP
2025-03-08T06:05:16.424416+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48786	104.248.115.71	606	TCP
2025-03-08T06:05:17.824770+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48788	104.248.115.71	606	TCP
2025-03-08T06:05:19.231140+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48790	104.248.115.71	606	TCP
2025-03-08T06:05:20.669385+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48792	104.248.115.71	606	TCP
2025-03-08T06:05:22.075744+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48794	104.248.115.71	606	TCP
2025-03-08T06:05:23.503762+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48796	104.248.115.71	606	TCP
2025-03-08T06:05:24.923831+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48798	104.248.115.71	606	TCP
2025-03-08T06:05:26.325806+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48800	104.248.115.71	606	TCP
2025-03-08T06:05:27.733327+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48802	104.248.115.71	606	TCP
2025-03-08T06:05:29.201129+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48804	104.248.115.71	606	TCP
2025-03-08T06:05:30.607844+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48806	104.248.115.71	606	TCP
2025-03-08T06:05:32.066555+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48808	104.248.115.71	606	TCP
2025-03-08T06:05:33.511852+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48810	104.248.115.71	606	TCP
2025-03-08T06:05:34.923163+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48812	104.248.115.71	606	TCP
2025-03-08T06:05:36.345576+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48814	104.248.115.71	606	TCP
2025-03-08T06:05:37.903413+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48816	104.248.115.71	606	TCP
2025-03-08T06:05:39.450871+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48818	104.248.115.71	606	TCP
2025-03-08T06:05:40.858377+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48820	104.248.115.71	606	TCP
2025-03-08T06:05:42.301833+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48822	104.248.115.71	606	TCP
2025-03-08T06:05:43.702813+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48824	104.248.115.71	606	TCP
2025-03-08T06:05:45.106811+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48826	104.248.115.71	606	TCP
2025-03-08T06:05:46.513142+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48828	104.248.115.71	606	TCP
2025-03-08T06:05:47.924208+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48830	104.248.115.71	606	TCP
2025-03-08T06:05:49.324829+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48832	104.248.115.71	606	TCP
2025-03-08T06:05:50.733881+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48834	104.248.115.71	606	TCP
2025-03-08T06:05:52.139668+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48836	104.248.115.71	606	TCP
2025-03-08T06:05:53.544989+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48838	104.248.115.71	606	TCP
2025-03-08T06:05:55.028351+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48840	104.248.115.71	606	TCP
2025-03-08T06:05:56.472896+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48842	104.248.115.71	606	TCP
2025-03-08T06:05:57.906149+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48844	104.248.115.71	606	TCP
2025-03-08T06:05:59.479927+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48846	104.248.115.71	606	TCP
2025-03-08T06:06:01.013346+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48848	104.248.115.71	606	TCP
2025-03-08T06:06:02.418712+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48850	104.248.115.71	606	TCP
2025-03-08T06:06:03.825452+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48852	104.248.115.71	606	TCP
2025-03-08T06:06:05.232952+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48854	104.248.115.71	606	TCP
2025-03-08T06:06:06.638528+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48856	104.248.115.71	606	TCP
2025-03-08T06:06:08.044269+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48858	104.248.115.71	606	TCP
2025-03-08T06:06:09.454649+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48860	104.248.115.71	606	TCP
2025-03-08T06:06:10.855570+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48862	104.248.115.71	606	TCP
2025-03-08T06:06:12.265110+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48864	104.248.115.71	606	TCP
2025-03-08T06:06:13.671744+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48866	104.248.115.71	606	TCP
2025-03-08T06:06:16.109470+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48868	104.248.115.71	606	TCP
2025-03-08T06:06:17.536869+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48870	104.248.115.71	606	TCP
2025-03-08T06:06:19.008379+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48872	104.248.115.71	606	TCP
2025-03-08T06:06:20.499124+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48874	104.248.115.71	606	TCP
2025-03-08T06:06:21.908239+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48876	104.248.115.71	606	TCP
2025-03-08T06:06:23.310676+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48878	104.248.115.71	606	TCP
2025-03-08T06:06:24.725655+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48880	104.248.115.71	606	TCP
2025-03-08T06:06:26.331528+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48882	104.248.115.71	606	TCP
2025-03-08T06:06:27.769075+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48884	104.248.115.71	606	TCP
2025-03-08T06:06:29.232140+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48886	104.248.115.71	606	TCP
2025-03-08T06:06:30.638112+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48888	104.248.115.71	606	TCP
2025-03-08T06:06:32.059756+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48890	104.248.115.71	606	TCP
2025-03-08T06:06:33.466117+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48892	104.248.115.71	606	TCP
2025-03-08T06:06:34.894988+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48894	104.248.115.71	606	TCP
2025-03-08T06:06:36.300521+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48896	104.248.115.71	606	TCP
2025-03-08T06:06:37.700437+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48898	104.248.115.71	606	TCP
2025-03-08T06:06:39.108531+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48900	104.248.115.71	606	TCP
2025-03-08T06:06:40.515599+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48902	104.248.115.71	606	TCP
2025-03-08T06:06:41.921719+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48904	104.248.115.71	606	TCP
2025-03-08T06:06:43.342055+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48906	104.248.115.71	606	TCP
2025-03-08T06:06:44.826285+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48908	104.248.115.71	606	TCP
2025-03-08T06:06:46.233792+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48910	104.248.115.71	606	TCP
2025-03-08T06:06:47.716657+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	48912	104.248.115.71	606	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 8, 2025 06:03:12.026962996 CET	48612	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:12.032082081 CET	606	48612	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:12.032166958 CET	48612	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:12.033345938 CET	48612	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:12.038413048 CET	606	48612	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:13.444458008 CET	606	48612	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:13.445235968 CET	48612	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:13.445713043 CET	48614	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:13.450361967 CET	606	48612	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:13.450841904 CET	606	48614	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:13.451018095 CET	48614	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:13.451018095 CET	48614	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:13.456068039 CET	606	48614	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:14.369019985 CET	42836	443	192.168.2.23	91.189.91.43
Mar 8, 2025 06:03:14.939666033 CET	606	48614	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:14.939913988 CET	48614	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:14.940386057 CET	48616	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:14.946121931 CET	606	48614	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:14.946300030 CET	606	48616	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:14.946355104 CET	48616	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:14.946408987 CET	48616	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:14.952311039 CET	606	48616	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:15.137141943 CET	42516	80	192.168.2.23	109.202.202.202
Mar 8, 2025 06:03:16.407392025 CET	606	48616	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:16.407615900 CET	48616	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:16.408200026 CET	48618	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:16.413713932 CET	606	48616	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:16.413737059 CET	606	48618	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:16.413808107 CET	48618	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:16.413916111 CET	48618	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:16.418951035 CET	606	48618	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:17.799427986 CET	606	48618	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:17.799721956 CET	48618	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:17.800296068 CET	48620	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:17.804722071 CET	606	48618	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:17.805299997 CET	606	48620	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:17.805378914 CET	48620	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:17.805443048 CET	48620	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:17.810477972 CET	606	48620	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:19.207611084 CET	606	48620	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:19.207849026 CET	48620	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:19.208556890 CET	48622	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:19.214231968 CET	606	48620	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:19.214746952 CET	606	48622	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:19.214827061 CET	48622	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:19.214903116 CET	48622	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:19.221350908 CET	606	48622	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:20.612730980 CET	606	48622	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:20.612953901 CET	48622	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:20.613464117 CET	48624	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:20.618050098 CET	606	48622	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:20.618541002 CET	606	48624	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:20.618616104 CET	48624	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:20.618716955 CET	48624	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:20.623822927 CET	606	48624	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:22.034800053 CET	606	48624	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:22.035126925 CET	48624	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:22.035841942 CET	48626	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:22.041234016 CET	606	48624	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:22.041677952 CET	606	48626	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:22.041731119 CET	48626	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:22.041791916 CET	48626	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:22.046804905 CET	606	48626	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:23.460259914 CET	606	48626	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:23.460664034 CET	48626	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:23.461327076 CET	48628	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:23.465701103 CET	606	48626	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:23.466393948 CET	606	48628	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:23.466463089 CET	48628	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:23.466553926 CET	48628	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:23.471568108 CET	606	48628	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:24.862564087 CET	606	48628	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:24.862874031 CET	48628	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:24.863646030 CET	48630	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:24.868153095 CET	606	48628	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:24.868731976 CET	606	48630	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:24.868823051 CET	48630	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:24.868901014 CET	48630	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:24.873980999 CET	606	48630	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:26.249711990 CET	606	48630	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:26.249980927 CET	48630	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:26.250715971 CET	48632	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:26.255000114 CET	606	48630	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:26.255799055 CET	606	48632	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:26.255860090 CET	48632	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:26.255927086 CET	48632	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:26.260943890 CET	606	48632	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:27.643853903 CET	606	48632	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:27.644220114 CET	48632	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:27.645005941 CET	48634	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:27.649344921 CET	606	48632	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:27.650088072 CET	606	48634	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:27.650142908 CET	48634	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:27.650212049 CET	48634	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:27.655250072 CET	606	48634	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:28.703119040 CET	43928	443	192.168.2.23	91.189.91.42
Mar 8, 2025 06:03:29.071078062 CET	606	48634	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:29.071284056 CET	48634	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:29.071945906 CET	48636	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:29.076364994 CET	606	48634	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:29.076987982 CET	606	48636	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:29.077044964 CET	48636	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:29.077117920 CET	48636	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:29.082173109 CET	606	48636	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:30.472743034 CET	606	48636	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:30.473130941 CET	48636	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:30.474070072 CET	48638	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:30.479329109 CET	606	48636	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:30.479340076 CET	606	48638	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:30.479420900 CET	48638	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:30.479540110 CET	48638	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:30.484594107 CET	606	48638	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:31.945416927 CET	606	48638	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:31.945686102 CET	48638	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:31.946698904 CET	48640	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:31.950658083 CET	606	48638	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:31.951699018 CET	606	48640	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:31.951778889 CET	48640	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:31.952033997 CET	48640	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:31.957034111 CET	606	48640	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:33.519304037 CET	606	48640	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:33.519726992 CET	48640	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:33.520771980 CET	48642	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:33.524801016 CET	606	48640	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:33.525907040 CET	606	48642	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:33.525983095 CET	48642	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:33.526117086 CET	48642	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:33.531138897 CET	606	48642	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:34.946422100 CET	606	48642	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:34.946645021 CET	48642	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:34.947475910 CET	48644	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:34.951781988 CET	606	48642	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:34.952569962 CET	606	48644	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:34.952882051 CET	48644	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:34.958728075 CET	48644	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:34.963821888 CET	606	48644	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:36.346555948 CET	606	48644	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:36.347193003 CET	48644	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:36.347304106 CET	48646	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:36.352238894 CET	606	48644	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:36.352368116 CET	606	48646	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:36.352421999 CET	48646	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:36.352488995 CET	48646	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:36.357575893 CET	606	48646	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:37.817765951 CET	606	48646	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:37.818150043 CET	48646	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:37.819053888 CET	48648	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:37.823317051 CET	606	48646	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:37.824207067 CET	606	48648	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:37.824318886 CET	48648	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:37.824448109 CET	48648	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:37.829734087 CET	606	48648	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:39.222017050 CET	606	48648	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:39.222297907 CET	48648	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:39.222935915 CET	48650	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:39.227417946 CET	606	48648	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:39.228027105 CET	606	48650	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:39.228089094 CET	48650	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:39.228180885 CET	48650	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:39.233213902 CET	606	48650	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:40.693363905 CET	606	48650	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:40.693723917 CET	48650	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:40.694643021 CET	48652	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:40.698808908 CET	606	48650	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:40.699807882 CET	606	48652	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:40.699879885 CET	48652	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:40.700018883 CET	48652	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:40.705130100 CET	606	48652	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:40.989443064 CET	42836	443	192.168.2.23	91.189.91.43
Mar 8, 2025 06:03:42.118356943 CET	606	48652	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:42.118614912 CET	48652	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:42.119220972 CET	48654	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:42.123781919 CET	606	48652	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:42.124407053 CET	606	48654	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:42.124480009 CET	48654	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:42.124526978 CET	48654	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:42.129565954 CET	606	48654	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:43.518899918 CET	606	48654	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:43.519259930 CET	48654	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:43.519804955 CET	48656	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:43.524507999 CET	606	48654	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:43.525000095 CET	606	48656	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:43.525140047 CET	48656	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:43.525223017 CET	48656	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:43.530324936 CET	606	48656	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:44.927905083 CET	606	48656	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:44.928272009 CET	48656	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:44.928953886 CET	48658	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:44.933353901 CET	606	48656	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:44.935575008 CET	606	48658	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:44.935641050 CET	48658	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:44.935769081 CET	48658	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:44.940802097 CET	606	48658	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:45.084785938 CET	42516	80	192.168.2.23	109.202.202.202
Mar 8, 2025 06:03:46.332986116 CET	606	48658	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:46.333328962 CET	48658	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:46.334253073 CET	48660	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:46.338571072 CET	606	48658	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:46.339405060 CET	606	48660	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:46.339509964 CET	48660	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:46.339626074 CET	48660	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:46.344755888 CET	606	48660	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:47.738169909 CET	606	48660	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:47.738579988 CET	48660	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:47.739423990 CET	48662	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:47.743659019 CET	606	48660	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:47.744606972 CET	606	48662	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:47.744683027 CET	48662	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:47.744820118 CET	48662	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:47.749918938 CET	606	48662	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:49.144133091 CET	606	48662	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:49.144493103 CET	48662	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:49.145447016 CET	48664	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:49.149606943 CET	606	48662	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:49.150517941 CET	606	48664	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:49.150610924 CET	48664	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:49.150718927 CET	48664	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:49.155689001 CET	606	48664	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:50.552362919 CET	606	48664	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:50.552898884 CET	48664	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:50.554025888 CET	48666	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:50.558521986 CET	606	48664	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:50.559653044 CET	606	48666	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:50.559931993 CET	48666	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:50.560018063 CET	48666	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:50.565088987 CET	606	48666	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:51.956861019 CET	606	48666	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:51.957489967 CET	48666	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:51.958323956 CET	48668	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:51.962621927 CET	606	48666	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:51.963512897 CET	606	48668	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:51.963608980 CET	48668	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:51.963682890 CET	48668	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:51.968668938 CET	606	48668	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:53.364063978 CET	606	48668	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:53.364372969 CET	48668	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:53.365170002 CET	48670	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:53.369419098 CET	606	48668	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:53.370254040 CET	606	48670	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:53.370315075 CET	48670	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:53.370480061 CET	48670	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:53.375459909 CET	606	48670	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:54.773227930 CET	606	48670	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:54.773540974 CET	48670	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:54.774137020 CET	48672	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:54.778595924 CET	606	48670	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:54.779285908 CET	606	48672	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:54.779382944 CET	48672	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:54.779470921 CET	48672	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:54.784552097 CET	606	48672	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:56.175580025 CET	606	48672	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:56.175815105 CET	48672	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:56.176647902 CET	48674	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:56.180967093 CET	606	48672	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:56.181746960 CET	606	48674	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:56.181822062 CET	48674	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:56.181909084 CET	48674	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:56.186853886 CET	606	48674	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:57.583206892 CET	606	48674	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:57.583695889 CET	48674	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:57.584724903 CET	48676	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:57.588776112 CET	606	48674	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:57.589807987 CET	606	48676	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:57.589899063 CET	48676	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:57.590008974 CET	48676	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:57.595136881 CET	606	48676	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:59.028573036 CET	606	48676	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:59.028970957 CET	48676	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:59.029865980 CET	48678	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:59.034012079 CET	606	48676	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:59.034888983 CET	606	48678	104.248.115.71	192.168.2.23
Mar 8, 2025 06:03:59.034956932 CET	48678	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:59.035085917 CET	48678	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:03:59.040096998 CET	606	48678	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:00.878854036 CET	606	48678	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:00.879239082 CET	48678	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:00.879955053 CET	48680	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:00.884363890 CET	606	48678	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:00.885066032 CET	606	48680	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:00.885133982 CET	48680	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:00.885246992 CET	48680	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:00.890221119 CET	606	48680	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:02.288876057 CET	606	48680	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:02.289078951 CET	48680	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:02.289881945 CET	48682	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:02.294193029 CET	606	48680	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:02.294950962 CET	606	48682	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:02.295023918 CET	48682	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:02.295197010 CET	48682	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:02.300484896 CET	606	48682	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:03.725879908 CET	606	48682	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:03.726268053 CET	48682	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:03.726268053 CET	48682	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:03.727313042 CET	48684	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:03.731365919 CET	606	48682	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:03.732373953 CET	606	48684	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:03.732424974 CET	48684	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:03.732481003 CET	48684	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:03.737495899 CET	606	48684	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:05.130985022 CET	606	48684	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:05.131531000 CET	48684	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:05.132335901 CET	48686	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:05.136635065 CET	606	48684	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:05.137439013 CET	606	48686	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:05.137520075 CET	48686	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:05.137628078 CET	48686	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:05.142720938 CET	606	48686	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:06.535972118 CET	606	48686	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:06.536274910 CET	48686	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:06.537456036 CET	48688	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:06.542567015 CET	606	48686	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:06.543853998 CET	606	48688	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:06.543939114 CET	48688	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:06.544043064 CET	48688	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:06.549067974 CET	606	48688	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:07.941585064 CET	606	48688	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:07.942248106 CET	48688	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:07.944082975 CET	48690	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:07.947829008 CET	606	48688	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:07.949604034 CET	606	48690	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:07.949711084 CET	48690	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:07.949836016 CET	48690	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:07.955055952 CET	606	48690	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:09.349190950 CET	606	48690	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:09.349627972 CET	48690	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:09.350270033 CET	48692	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:09.354737997 CET	606	48690	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:09.355338097 CET	606	48692	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:09.355462074 CET	48692	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:09.355530024 CET	48692	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:09.360553026 CET	606	48692	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:09.657432079 CET	43928	443	192.168.2.23	91.189.91.42
Mar 8, 2025 06:04:10.754091978 CET	606	48692	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:10.754369974 CET	48692	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:10.755028009 CET	48694	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:10.759591103 CET	606	48692	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:10.760200024 CET	606	48694	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:10.760271072 CET	48694	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:10.760375977 CET	48694	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:10.765429974 CET	606	48694	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:12.160439968 CET	606	48694	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:12.161031961 CET	48694	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:12.161856890 CET	48696	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:12.166373014 CET	606	48694	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:12.167131901 CET	606	48696	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:12.167228937 CET	48696	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:12.167407990 CET	48696	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:12.172600031 CET	606	48696	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:13.587727070 CET	606	48696	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:13.588134050 CET	48696	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:13.588888884 CET	48698	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:13.593302965 CET	606	48696	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:13.594017029 CET	606	48698	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:13.594125032 CET	48698	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:13.594234943 CET	48698	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:13.599282980 CET	606	48698	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:15.007846117 CET	606	48698	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:15.008112907 CET	48698	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:15.008694887 CET	48700	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:15.013144016 CET	606	48698	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:15.013803959 CET	606	48700	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:15.013897896 CET	48700	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:15.013948917 CET	48700	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:15.019040108 CET	606	48700	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:16.429801941 CET	606	48700	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:16.430183887 CET	48700	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:16.430876970 CET	48702	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:16.435344934 CET	606	48700	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:16.436028004 CET	606	48702	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:16.436127901 CET	48702	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:16.436249018 CET	48702	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:16.441323996 CET	606	48702	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:17.832458973 CET	606	48702	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:17.832962036 CET	48702	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:17.833817005 CET	48704	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:17.838095903 CET	606	48702	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:17.838947058 CET	606	48704	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:17.839034081 CET	48704	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:17.839148045 CET	48704	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:17.844274044 CET	606	48704	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:19.240494967 CET	606	48704	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:19.240927935 CET	48704	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:19.241662025 CET	48706	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:19.246109009 CET	606	48704	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:19.246867895 CET	606	48706	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:19.246943951 CET	48706	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:19.247055054 CET	48706	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:19.252140999 CET	606	48706	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:20.646493912 CET	606	48706	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:20.646908998 CET	48706	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:20.647885084 CET	48708	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:20.652107000 CET	606	48706	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:20.653001070 CET	606	48708	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:20.653060913 CET	48708	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:20.653126955 CET	48708	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:20.658231020 CET	606	48708	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:22.051177979 CET	606	48708	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:22.051615953 CET	48708	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:22.052658081 CET	48710	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:22.056899071 CET	606	48708	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:22.057800055 CET	606	48710	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:22.057969093 CET	48710	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:22.057995081 CET	48710	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:22.063100100 CET	606	48710	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:23.491179943 CET	606	48710	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:23.491586924 CET	48710	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:23.491628885 CET	48710	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:23.492799044 CET	48712	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:23.496757030 CET	606	48710	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:23.497988939 CET	606	48712	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:23.498100042 CET	48712	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:23.498208046 CET	48712	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:23.503371954 CET	606	48712	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:25.017921925 CET	606	48712	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:25.018428087 CET	48712	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:25.019314051 CET	48714	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:25.023554087 CET	606	48712	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:25.024478912 CET	606	48714	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:25.024547100 CET	48714	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:25.024666071 CET	48714	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:25.029678106 CET	606	48714	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:26.472894907 CET	606	48714	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:26.473114014 CET	48714	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:26.473869085 CET	48716	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:26.478167057 CET	606	48714	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:26.478929043 CET	606	48716	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:26.479084015 CET	48716	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:26.479084015 CET	48716	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:26.484160900 CET	606	48716	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:27.879616976 CET	606	48716	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:27.880219936 CET	48716	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:27.881522894 CET	48718	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:27.885312080 CET	606	48716	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:27.886574984 CET	606	48718	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:27.886653900 CET	48718	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:27.886884928 CET	48718	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:27.891978979 CET	606	48718	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:29.291765928 CET	606	48718	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:29.292378902 CET	48718	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:29.293657064 CET	48720	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:29.298136950 CET	606	48718	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:29.299045086 CET	606	48720	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:29.299304008 CET	48720	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:29.299304008 CET	48720	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:29.304500103 CET	606	48720	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:30.691644907 CET	606	48720	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:30.691993952 CET	48720	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:30.692647934 CET	48722	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:30.697216034 CET	606	48720	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:30.698057890 CET	606	48722	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:30.698360920 CET	48722	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:30.698360920 CET	48722	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:30.703733921 CET	606	48722	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:32.098534107 CET	606	48722	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:32.099060059 CET	48722	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:32.100640059 CET	48724	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:32.104667902 CET	606	48722	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:32.106149912 CET	606	48724	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:32.106257915 CET	48724	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:32.106368065 CET	48724	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:32.111682892 CET	606	48724	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:33.504376888 CET	606	48724	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:33.505045891 CET	48724	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:33.506279945 CET	48726	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:33.510737896 CET	606	48724	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:33.511439085 CET	606	48726	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:33.511542082 CET	48726	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:33.511642933 CET	48726	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:33.517337084 CET	606	48726	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:34.910875082 CET	606	48726	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:34.911320925 CET	48726	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:34.911967993 CET	48728	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:34.916462898 CET	606	48726	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:34.917052984 CET	606	48728	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:34.917135000 CET	48728	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:34.917246103 CET	48728	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:34.922377110 CET	606	48728	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:36.318471909 CET	606	48728	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:36.318790913 CET	48728	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:36.319504023 CET	48730	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:36.324003935 CET	606	48728	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:36.324664116 CET	606	48730	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:36.324763060 CET	48730	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:36.324878931 CET	48730	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:36.330180883 CET	606	48730	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:37.731273890 CET	606	48730	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:37.731599092 CET	48730	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:37.733186007 CET	48732	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:37.737121105 CET	606	48730	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:37.738642931 CET	606	48732	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:37.738728046 CET	48732	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:37.738934040 CET	48732	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:37.744355917 CET	606	48732	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:39.129623890 CET	606	48732	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:39.130057096 CET	48732	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:39.130999088 CET	48734	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:39.137149096 CET	606	48732	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:39.137195110 CET	606	48734	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:39.137301922 CET	48734	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:39.137423038 CET	48734	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:39.142456055 CET	606	48734	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:40.556063890 CET	606	48734	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:40.556571007 CET	48734	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:40.558180094 CET	48736	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:40.561686993 CET	606	48734	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:40.565186024 CET	606	48736	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:40.565291882 CET	48736	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:40.565423012 CET	48736	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:40.571321011 CET	606	48736	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:41.959222078 CET	606	48736	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:41.959501982 CET	48736	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:41.961385012 CET	48738	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:41.964773893 CET	606	48736	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:41.966761112 CET	606	48738	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:41.966876984 CET	48738	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:41.966978073 CET	48738	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:41.972006083 CET	606	48738	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:43.363724947 CET	606	48738	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:43.363965034 CET	48738	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:43.364686966 CET	48740	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:43.369122028 CET	606	48738	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:43.369888067 CET	606	48740	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:43.369946957 CET	48740	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:43.370012999 CET	48740	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:43.375283957 CET	606	48740	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:44.769979954 CET	606	48740	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:44.770431995 CET	48740	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:44.771507025 CET	48742	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:44.775830984 CET	606	48740	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:44.776985884 CET	606	48742	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:44.777059078 CET	48742	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:44.777117014 CET	48742	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:44.782877922 CET	606	48742	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:46.268788099 CET	606	48742	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:46.269148111 CET	48742	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:46.270229101 CET	48744	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:46.274236917 CET	606	48742	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:46.275279045 CET	606	48744	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:46.275343895 CET	48744	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:46.275402069 CET	48744	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:46.280438900 CET	606	48744	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:47.692498922 CET	606	48744	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:47.692914009 CET	48744	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:47.693623066 CET	48746	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:47.698440075 CET	606	48744	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:47.699064016 CET	606	48746	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:47.699301004 CET	48746	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:47.699301004 CET	48746	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:47.704476118 CET	606	48746	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:49.179167032 CET	606	48746	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:49.179577112 CET	48746	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:49.180557966 CET	48748	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:49.185233116 CET	606	48746	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:49.185880899 CET	606	48748	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:49.185940027 CET	48748	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:49.186007023 CET	48748	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:49.191170931 CET	606	48748	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:50.649658918 CET	606	48748	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:50.650032043 CET	48748	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:50.650877953 CET	48750	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:50.655292988 CET	606	48748	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:50.656138897 CET	606	48750	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:50.656368017 CET	48750	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:50.656368017 CET	48750	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:50.661566973 CET	606	48750	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:52.053327084 CET	606	48750	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:52.053639889 CET	48750	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:52.054402113 CET	48752	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:52.060045004 CET	606	48750	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:52.060076952 CET	606	48752	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:52.060192108 CET	48752	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:52.060277939 CET	48752	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:52.065313101 CET	606	48752	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:53.458266973 CET	606	48752	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:53.458718061 CET	48752	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:53.459816933 CET	48754	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:53.464104891 CET	606	48752	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:53.465157986 CET	606	48754	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:53.465228081 CET	48754	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:53.465423107 CET	48754	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:53.470776081 CET	606	48754	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:54.866225958 CET	606	48754	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:54.866697073 CET	48754	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:54.868710041 CET	48756	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:54.872263908 CET	606	48754	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:54.874089003 CET	606	48756	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:54.874150038 CET	48756	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:54.874387980 CET	48756	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:54.879456997 CET	606	48756	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:56.292489052 CET	606	48756	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:56.292975903 CET	48756	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:56.293750048 CET	48758	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:56.298537970 CET	606	48756	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:56.299411058 CET	606	48758	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:56.299546003 CET	48758	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:56.299729109 CET	48758	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:56.304868937 CET	606	48758	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:57.692521095 CET	606	48758	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:57.693082094 CET	48758	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:57.694382906 CET	48760	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:57.698497057 CET	606	48758	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:57.699736118 CET	606	48760	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:57.699867010 CET	48760	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:57.700201035 CET	48760	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:57.705461025 CET	606	48760	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:59.255119085 CET	606	48760	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:59.255400896 CET	48760	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:59.256877899 CET	48762	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:59.260612965 CET	606	48760	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:59.262432098 CET	606	48762	104.248.115.71	192.168.2.23
Mar 8, 2025 06:04:59.262511015 CET	48762	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:59.262774944 CET	48762	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:04:59.268177986 CET	606	48762	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:00.661973953 CET	606	48762	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:00.662498951 CET	48762	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:00.664671898 CET	48764	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:00.668670893 CET	606	48762	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:00.670324087 CET	606	48764	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:00.670587063 CET	48764	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:00.670680046 CET	48764	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:00.675894976 CET	606	48764	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:02.067271948 CET	606	48764	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:02.067713976 CET	48764	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:02.068450928 CET	48766	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:02.072779894 CET	606	48764	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:02.073565006 CET	606	48766	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:02.073652029 CET	48766	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:02.073848963 CET	48766	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:02.078934908 CET	606	48766	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:03.476001024 CET	606	48766	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:03.476710081 CET	48766	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:03.478400946 CET	48768	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:03.481909037 CET	606	48766	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:03.483583927 CET	606	48768	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:03.483671904 CET	48768	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:03.484054089 CET	48768	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:03.489249945 CET	606	48768	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:04.880435944 CET	606	48768	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:04.881041050 CET	48768	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:04.882394075 CET	48770	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:04.886509895 CET	606	48768	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:04.888012886 CET	606	48770	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:04.888124943 CET	48770	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:04.888232946 CET	48770	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:04.893362045 CET	606	48770	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:06.291450977 CET	606	48770	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:06.292045116 CET	48770	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:06.293463945 CET	48772	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:06.297724009 CET	606	48770	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:06.298815966 CET	606	48772	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:06.299037933 CET	48772	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:06.299139977 CET	48772	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:06.304234982 CET	606	48772	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:07.695833921 CET	606	48772	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:07.696446896 CET	48772	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:07.697603941 CET	48774	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:07.701626062 CET	606	48772	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:07.702688932 CET	606	48774	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:07.702791929 CET	48774	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:07.702990055 CET	48774	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:07.708287001 CET	606	48774	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:09.130083084 CET	606	48774	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:09.130453110 CET	48774	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:09.131509066 CET	48776	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:09.135993004 CET	606	48774	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:09.137083054 CET	606	48776	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:09.137190104 CET	48776	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:09.137434959 CET	48776	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:09.142678022 CET	606	48776	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:10.544344902 CET	606	48776	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:10.544883966 CET	48776	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:10.546377897 CET	48778	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:10.550090075 CET	606	48776	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:10.551764965 CET	606	48778	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:10.551873922 CET	48778	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:10.552133083 CET	48778	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:10.557346106 CET	606	48778	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:12.161725044 CET	606	48778	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:12.162410021 CET	48778	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:12.164169073 CET	48780	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:12.168045044 CET	606	48778	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:12.169457912 CET	606	48780	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:12.169558048 CET	48780	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:12.169761896 CET	48780	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:12.175271988 CET	606	48780	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:13.568840027 CET	606	48780	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:13.569365978 CET	48780	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:13.570744038 CET	48782	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:13.574615002 CET	606	48780	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:13.575854063 CET	606	48782	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:13.576059103 CET	48782	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:13.576059103 CET	48782	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:13.581254959 CET	606	48782	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:14.974541903 CET	606	48782	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:14.975208044 CET	48782	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:14.976582050 CET	48784	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:14.980771065 CET	606	48782	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:14.981836081 CET	606	48784	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:14.981897116 CET	48784	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:14.982125044 CET	48784	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:14.987479925 CET	606	48784	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:16.417301893 CET	606	48784	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:16.417840004 CET	48784	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:16.418869019 CET	48786	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:16.423376083 CET	606	48784	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:16.424232960 CET	606	48786	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:16.424416065 CET	48786	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:16.424416065 CET	48786	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:16.429956913 CET	606	48786	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:17.817688942 CET	606	48786	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:17.818136930 CET	48786	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:17.819183111 CET	48788	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:17.823498011 CET	606	48786	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:17.824606895 CET	606	48788	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:17.824769974 CET	48788	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:17.824769974 CET	48788	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:17.829902887 CET	606	48788	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:19.223826885 CET	606	48788	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:19.224281073 CET	48788	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:19.225296021 CET	48790	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:19.229780912 CET	606	48788	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:19.230921030 CET	606	48790	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:19.231139898 CET	48790	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:19.231139898 CET	48790	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:19.236829996 CET	606	48790	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:20.661494970 CET	606	48790	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:20.662072897 CET	48790	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:20.663544893 CET	48792	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:20.667339087 CET	606	48790	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:20.669049978 CET	606	48792	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:20.669209957 CET	48792	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:20.669384956 CET	48792	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:20.674791098 CET	606	48792	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:22.068263054 CET	606	48792	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:22.068783045 CET	48792	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:22.070036888 CET	48794	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:22.074136972 CET	606	48792	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:22.075541973 CET	606	48794	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:22.075743914 CET	48794	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:22.075743914 CET	48794	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:22.081302881 CET	606	48794	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:23.495978117 CET	606	48794	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:23.496581078 CET	48794	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:23.498033047 CET	48796	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:23.502106905 CET	606	48794	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:23.503475904 CET	606	48796	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:23.503540993 CET	48796	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:23.503762007 CET	48796	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:23.509175062 CET	606	48796	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:24.917114019 CET	606	48796	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:24.917529106 CET	48796	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:24.918466091 CET	48798	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:24.922646999 CET	606	48796	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:24.923639059 CET	606	48798	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:24.923830986 CET	48798	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:24.923830986 CET	48798	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:24.929951906 CET	606	48798	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:26.319147110 CET	606	48798	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:26.319432020 CET	48798	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:26.320485115 CET	48800	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:26.324469090 CET	606	48798	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:26.325555086 CET	606	48800	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:26.325804949 CET	48800	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:26.325805902 CET	48800	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:26.330939054 CET	606	48800	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:27.726099014 CET	606	48800	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:27.726874113 CET	48800	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:27.727904081 CET	48802	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:27.732146025 CET	606	48800	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:27.733037949 CET	606	48802	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:27.733140945 CET	48802	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:27.733326912 CET	48802	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:27.738662958 CET	606	48802	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:29.194813013 CET	606	48802	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:29.195031881 CET	48802	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:29.195673943 CET	48804	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:29.200304031 CET	606	48802	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:29.200982094 CET	606	48804	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:29.201078892 CET	48804	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:29.201128960 CET	48804	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:29.206202030 CET	606	48804	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:30.601022959 CET	606	48804	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:30.601610899 CET	48804	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:30.602540970 CET	48806	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:30.606746912 CET	606	48804	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:30.607645988 CET	606	48806	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:30.607719898 CET	48806	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:30.607844114 CET	48806	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:30.613126040 CET	606	48806	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:32.060558081 CET	606	48806	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:32.060908079 CET	48806	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:32.061393976 CET	48808	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:32.066138983 CET	606	48806	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:32.066443920 CET	606	48808	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:32.066505909 CET	48808	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:32.066555023 CET	48808	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:32.071683884 CET	606	48808	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:33.505520105 CET	606	48808	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:33.505937099 CET	48808	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:33.506715059 CET	48810	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:33.511019945 CET	606	48808	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:33.511728048 CET	606	48810	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:33.511795998 CET	48810	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:33.511852026 CET	48810	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:33.516901970 CET	606	48810	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:34.916809082 CET	606	48810	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:34.917347908 CET	48810	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:34.917924881 CET	48812	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:34.922667980 CET	606	48810	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:34.923027039 CET	606	48812	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:34.923134089 CET	48812	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:34.923162937 CET	48812	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:34.928232908 CET	606	48812	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:36.339448929 CET	606	48812	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:36.339711905 CET	48812	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:36.340353966 CET	48814	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:36.344775915 CET	606	48812	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:36.345379114 CET	606	48814	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:36.345452070 CET	48814	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:36.345576048 CET	48814	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:36.350533962 CET	606	48814	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:37.896168947 CET	606	48814	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:37.896703959 CET	48814	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:37.897669077 CET	48816	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:37.902137995 CET	606	48814	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:37.903126955 CET	606	48816	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:37.903206110 CET	48816	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:37.903413057 CET	48816	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:37.908533096 CET	606	48816	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:39.443185091 CET	606	48816	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:39.443433046 CET	48816	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:39.445010900 CET	48818	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:39.448911905 CET	606	48816	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:39.450696945 CET	606	48818	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:39.450788021 CET	48818	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:39.450870991 CET	48818	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:39.456043005 CET	606	48818	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:40.849356890 CET	606	48818	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:40.849688053 CET	48818	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:40.852600098 CET	48820	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:40.855021954 CET	606	48818	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:40.858036041 CET	606	48820	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:40.858129978 CET	48820	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:40.858376980 CET	48820	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:40.863603115 CET	606	48820	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:42.293590069 CET	606	48820	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:42.293999910 CET	48820	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:42.295686960 CET	48822	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:42.299560070 CET	606	48820	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:42.301469088 CET	606	48822	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:42.301832914 CET	48822	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:42.301832914 CET	48822	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:42.307394028 CET	606	48822	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:43.695755005 CET	606	48822	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:43.696093082 CET	48822	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:43.697458029 CET	48824	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:43.701268911 CET	606	48822	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:43.702604055 CET	606	48824	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:43.702771902 CET	48824	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:43.702812910 CET	48824	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:43.707984924 CET	606	48824	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:45.099730968 CET	606	48824	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:45.100334883 CET	48824	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:45.101362944 CET	48826	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:45.105743885 CET	606	48824	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:45.106462002 CET	606	48826	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:45.106532097 CET	48826	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:45.106811047 CET	48826	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:45.111967087 CET	606	48826	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:46.505711079 CET	606	48826	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:46.506140947 CET	48826	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:46.507266998 CET	48828	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:46.511590004 CET	606	48826	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:46.512576103 CET	606	48828	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:46.512784958 CET	48828	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:46.513142109 CET	48828	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:46.518194914 CET	606	48828	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:47.916223049 CET	606	48828	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:47.916630030 CET	48828	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:47.917968988 CET	48830	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:47.922555923 CET	606	48828	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:47.923954010 CET	606	48830	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:47.924017906 CET	48830	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:47.924207926 CET	48830	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:47.930294991 CET	606	48830	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:49.318552017 CET	606	48830	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:49.318804026 CET	48830	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:49.319606066 CET	48832	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:49.324062109 CET	606	48830	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:49.324651957 CET	606	48832	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:49.324769974 CET	48832	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:49.324829102 CET	48832	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:49.329833031 CET	606	48832	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:50.726139069 CET	606	48832	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:50.726708889 CET	48832	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:50.728140116 CET	48834	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:50.731787920 CET	606	48832	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:50.733339071 CET	606	48834	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:50.733413935 CET	48834	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:50.733880997 CET	48834	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:50.739116907 CET	606	48834	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:52.132551908 CET	606	48834	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:52.132927895 CET	48834	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:52.134170055 CET	48836	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:52.138312101 CET	606	48834	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:52.139288902 CET	606	48836	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:52.139394999 CET	48836	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:52.139667988 CET	48836	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:52.144829035 CET	606	48836	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:53.538472891 CET	606	48836	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:53.538928986 CET	48836	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:53.539783001 CET	48838	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:53.543921947 CET	606	48836	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:53.544806957 CET	606	48838	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:53.544893026 CET	48838	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:53.544989109 CET	48838	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:53.549974918 CET	606	48838	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:55.021740913 CET	606	48838	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:55.021976948 CET	48838	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:55.023046017 CET	48840	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:55.027239084 CET	606	48838	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:55.028203964 CET	606	48840	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:55.028281927 CET	48840	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:55.028351068 CET	48840	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:55.033442020 CET	606	48840	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:56.465769053 CET	606	48840	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:56.466191053 CET	48840	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:56.467333078 CET	48842	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:56.471681118 CET	606	48840	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:56.472771883 CET	606	48842	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:56.472896099 CET	48842	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:56.472896099 CET	48842	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:56.478024960 CET	606	48842	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:57.898858070 CET	606	48842	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:57.899295092 CET	48842	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:57.899946928 CET	48844	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:57.905086040 CET	606	48842	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:57.906018019 CET	606	48844	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:57.906095982 CET	48844	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:57.906148911 CET	48844	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:57.912133932 CET	606	48844	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:59.472769976 CET	606	48844	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:59.473186970 CET	48844	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:59.473907948 CET	48846	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:59.479732990 CET	606	48844	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:59.479746103 CET	606	48846	104.248.115.71	192.168.2.23
Mar 8, 2025 06:05:59.479823112 CET	48846	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:59.479927063 CET	48846	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:05:59.485176086 CET	606	48846	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:01.007308960 CET	606	48846	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:01.007664919 CET	48846	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:01.008153915 CET	48848	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:01.013207912 CET	606	48846	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:01.013252020 CET	606	48848	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:01.013302088 CET	48848	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:01.013345957 CET	48848	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:01.018377066 CET	606	48848	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:02.412542105 CET	606	48848	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:02.412798882 CET	48848	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:02.413425922 CET	48850	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:02.417906046 CET	606	48848	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:02.418586969 CET	606	48850	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:02.418646097 CET	48850	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:02.418711901 CET	48850	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:02.423748970 CET	606	48850	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:03.818672895 CET	606	48850	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:03.819156885 CET	48850	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:03.820120096 CET	48852	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:03.824289083 CET	606	48850	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:03.825273037 CET	606	48852	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:03.825341940 CET	48852	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:03.825452089 CET	48852	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:03.830553055 CET	606	48852	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:05.226421118 CET	606	48852	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:05.226861000 CET	48852	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:05.227751970 CET	48854	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:05.232053995 CET	606	48852	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:05.232832909 CET	606	48854	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:05.232891083 CET	48854	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:05.232952118 CET	48854	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:05.237955093 CET	606	48854	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:06.631583929 CET	606	48854	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:06.632049084 CET	48854	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:06.633102894 CET	48856	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:06.637271881 CET	606	48854	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:06.638318062 CET	606	48856	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:06.638396978 CET	48856	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:06.638528109 CET	48856	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:06.643646955 CET	606	48856	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:08.037435055 CET	606	48856	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:08.037890911 CET	48856	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:08.038994074 CET	48858	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:08.043019056 CET	606	48856	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:08.044137955 CET	606	48858	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:08.044197083 CET	48858	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:08.044269085 CET	48858	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:08.049324036 CET	606	48858	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:09.448002100 CET	606	48858	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:09.448435068 CET	48858	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:09.449314117 CET	48860	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:09.453579903 CET	606	48858	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:09.454422951 CET	606	48860	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:09.454505920 CET	48860	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:09.454648972 CET	48860	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:09.459690094 CET	606	48860	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:10.848468065 CET	606	48860	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:10.848963022 CET	48860	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:10.850169897 CET	48862	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:10.854099989 CET	606	48860	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:10.855346918 CET	606	48862	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:10.855421066 CET	48862	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:10.855570078 CET	48862	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:10.860613108 CET	606	48862	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:12.257069111 CET	606	48862	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:12.257620096 CET	48862	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:12.259620905 CET	48864	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:12.262839079 CET	606	48862	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:12.264715910 CET	606	48864	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:12.264880896 CET	48864	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:12.265110016 CET	48864	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:12.270176888 CET	606	48864	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:13.664010048 CET	606	48864	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:13.664330006 CET	48864	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:13.664463997 CET	48864	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:13.666234016 CET	48866	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:13.669512033 CET	606	48864	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:13.671355009 CET	606	48866	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:13.671516895 CET	48866	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:13.671744108 CET	48866	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:13.676805973 CET	606	48866	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:15.071588039 CET	606	48866	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:15.071830034 CET	48866	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:15.072961092 CET	48868	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:15.272824049 CET	606	48866	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:15.273128033 CET	48866	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:15.280066013 CET	48866	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:15.285322905 CET	606	48866	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:16.103991032 CET	48868	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:16.109242916 CET	606	48868	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:16.109359026 CET	48868	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:16.109469891 CET	48868	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:16.114469051 CET	606	48868	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:17.527422905 CET	606	48868	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:17.527728081 CET	48868	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:17.528580904 CET	48870	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:17.533175945 CET	606	48868	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:17.536751986 CET	606	48870	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:17.536817074 CET	48870	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:17.536869049 CET	48870	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:17.541851044 CET	606	48870	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:19.000222921 CET	606	48870	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:19.000799894 CET	48870	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:19.002649069 CET	48872	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:19.006767988 CET	606	48870	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:19.007868052 CET	606	48872	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:19.008146048 CET	48872	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:19.008378983 CET	48872	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:19.013602018 CET	606	48872	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:20.492288113 CET	606	48872	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:20.492801905 CET	48872	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:20.493772030 CET	48874	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:20.497982025 CET	606	48872	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:20.498832941 CET	606	48874	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:20.498925924 CET	48874	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:20.499124050 CET	48874	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:20.504086971 CET	606	48874	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:21.900063038 CET	606	48874	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:21.900743961 CET	48874	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:21.902581930 CET	48876	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:21.906209946 CET	606	48874	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:21.907805920 CET	606	48876	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:21.907977104 CET	48876	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:21.908238888 CET	48876	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:21.913300991 CET	606	48876	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:23.303286076 CET	606	48876	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:23.303740025 CET	48876	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:23.305319071 CET	48878	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:23.308903933 CET	606	48876	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:23.310471058 CET	606	48878	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:23.310676098 CET	48878	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:23.310676098 CET	48878	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:23.315696955 CET	606	48878	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:24.718190908 CET	606	48878	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:24.718836069 CET	48878	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:24.718836069 CET	48878	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:24.720441103 CET	48880	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:24.723959923 CET	606	48878	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:24.725503922 CET	606	48880	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:24.725575924 CET	48880	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:24.725655079 CET	48880	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:24.730701923 CET	606	48880	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:26.324887037 CET	606	48880	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:26.325181007 CET	48880	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:26.326152086 CET	48882	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:26.330365896 CET	606	48880	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:26.331320047 CET	606	48882	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:26.331414938 CET	48882	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:26.331527948 CET	48882	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:26.336702108 CET	606	48882	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:27.761447906 CET	606	48882	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:27.761955023 CET	48882	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:27.763485909 CET	48884	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:27.767326117 CET	606	48882	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:27.768712997 CET	606	48884	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:27.768924952 CET	48884	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:27.769074917 CET	48884	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:27.774096966 CET	606	48884	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:29.225442886 CET	606	48884	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:29.225950003 CET	48884	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:29.226834059 CET	48886	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:29.231178045 CET	606	48884	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:29.232008934 CET	606	48886	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:29.232078075 CET	48886	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:29.232140064 CET	48886	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:29.237207890 CET	606	48886	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:30.631551981 CET	606	48886	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:30.632188082 CET	48886	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:30.632899046 CET	48888	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:30.637218952 CET	606	48886	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:30.637939930 CET	606	48888	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:30.638003111 CET	48888	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:30.638112068 CET	48888	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:30.643028975 CET	606	48888	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:32.053304911 CET	606	48888	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:32.053715944 CET	48888	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:32.054510117 CET	48890	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:32.058727980 CET	606	48888	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:32.059562922 CET	606	48890	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:32.059628010 CET	48890	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:32.059756041 CET	48890	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:32.064754009 CET	606	48890	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:33.459522009 CET	606	48890	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:33.459927082 CET	48890	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:33.460865974 CET	48892	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:33.465032101 CET	606	48890	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:33.465929985 CET	606	48892	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:33.466008902 CET	48892	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:33.466116905 CET	48892	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:33.471097946 CET	606	48892	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:34.887428045 CET	606	48892	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:34.888154984 CET	48892	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:34.889596939 CET	48894	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:34.893472910 CET	606	48892	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:34.894733906 CET	606	48894	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:34.894851923 CET	48894	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:34.894988060 CET	48894	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:34.900116920 CET	606	48894	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:36.293912888 CET	606	48894	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:36.294359922 CET	48894	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:36.295262098 CET	48896	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:36.299484968 CET	606	48894	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:36.300311089 CET	606	48896	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:36.300431013 CET	48896	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:36.300520897 CET	48896	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:36.305504084 CET	606	48896	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:37.693945885 CET	606	48896	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:37.694252014 CET	48896	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:37.695028067 CET	48898	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:37.699434042 CET	606	48896	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:37.700167894 CET	606	48898	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:37.700278997 CET	48898	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:37.700437069 CET	48898	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:37.705495119 CET	606	48898	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:39.102129936 CET	606	48898	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:39.102489948 CET	48898	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:39.103221893 CET	48900	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:39.107546091 CET	606	48898	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:39.108371019 CET	606	48900	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:39.108474970 CET	48900	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:39.108530998 CET	48900	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:39.113567114 CET	606	48900	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:40.508594036 CET	606	48900	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:40.509005070 CET	48900	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:40.510231972 CET	48902	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:40.514161110 CET	606	48900	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:40.515383005 CET	606	48902	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:40.515491009 CET	48902	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:40.515599012 CET	48902	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:40.520570993 CET	606	48902	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:41.914901018 CET	606	48902	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:41.915442944 CET	48902	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:41.916436911 CET	48904	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:41.920500040 CET	606	48902	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:41.921526909 CET	606	48904	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:41.921622992 CET	48904	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:41.921719074 CET	48904	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:41.926736116 CET	606	48904	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:43.334887028 CET	606	48904	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:43.335572958 CET	48904	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:43.336596012 CET	48906	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:43.340809107 CET	606	48904	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:43.341800928 CET	606	48906	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:43.341943026 CET	48906	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:43.342055082 CET	48906	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:43.347160101 CET	606	48906	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:44.819463968 CET	606	48906	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:44.819806099 CET	48906	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:44.820977926 CET	48908	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:44.824920893 CET	606	48906	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:44.826055050 CET	606	48908	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:44.826172113 CET	48908	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:44.826284885 CET	48908	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:44.831402063 CET	606	48908	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:46.226038933 CET	606	48908	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:46.226562977 CET	48908	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:46.228043079 CET	48910	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:46.231975079 CET	606	48908	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:46.233253002 CET	606	48910	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:46.233511925 CET	48910	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:46.233792067 CET	48910	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:46.238980055 CET	606	48910	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:47.709959984 CET	606	48910	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:47.710311890 CET	48910	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:47.711256027 CET	48912	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:47.715596914 CET	606	48910	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:47.716411114 CET	606	48912	104.248.115.71	192.168.2.23
Mar 8, 2025 06:06:47.716526031 CET	48912	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:47.716656923 CET	48912	606	192.168.2.23	104.248.115.71
Mar 8, 2025 06:06:47.721777916 CET	606	48912	104.248.115.71	192.168.2.23

System Behavior

Analysis Process: s-h.4-.Sakura.elf PID: 6245, Parent PID: 6167

General

Start time (UTC):	05:03:10
Start date (UTC):	08/03/2025
Path:	/tmp/s-h.4-.Sakura.elf
Arguments:	/tmp/s-h.4-.Sakura.elf
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Chronological Activities

Analysis Process: s-h.4-.Sakura.elf PID: 6249, Parent PID: 6245

General

Start time (UTC):	05:03:11
Start date (UTC):	08/03/2025
Path:	/tmp/s-h.4-.Sakura.elf
Arguments:	-
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Chronological Activities

Analysis Process: s-h.4-.Sakura.elf PID: 6251, Parent PID: 6249

General

Start time (UTC):	05:03:11
Start date (UTC):	08/03/2025
Path:	/tmp/s-h.4-.Sakura.elf
Arguments:	-
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping or `net view` using Net .
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report s-h.4-.Sakura.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Threatname: Gafgyt

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: s-h.4-.Sakura.elf PID: 6245, Parent PID: 6167

General

Chronological Activities

Analysis Process: s-h.4-.Sakura.elf PID: 6249, Parent PID: 6245

General

Chronological Activities

Analysis Process: s-h.4-.Sakura.elf PID: 6251, Parent PID: 6249

General

Chronological Activities

Linux Analysis Report
s-h.4-.Sakura.elf