Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
Q1BPEcSFNH.elf

Overview

General Information

Sample Name:Q1BPEcSFNH.elf
Original Sample Name:7fe53af62bda8d7e8673865f9e5ec70b.elf
Analysis ID:1345560
MD5:7fe53af62bda8d7e8673865f9e5ec70b
SHA1:ad36ac4ffd5ef28b38bce8669873ac53b13fcd32
SHA256:eedec4c30de491311570032616ad5c90f1e594e1cd6b335584ee6d44969c5338
Tags:32elfmipsmirai
Infos:

Detection

Mirai
Score:72
Range:0 - 100
Whitelisted:false

Signatures

Malicious sample detected (through community Yara rule)
Yara detected Mirai
Multi AV Scanner detection for submitted file
Sample is packed with UPX
Uses known network protocols on non-standard ports
Sample contains only a LOAD segment without any section mappings
Yara signature match
Uses the "uname" system call to query kernel version information (possible evasion)
Detected TCP or UDP traffic on non-standard ports
Sample listens on a socket
ELF contains segments with high entropy indicating compressed/encrypted content

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.
Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox Version:38.0.0 Ammolite
Analysis ID:1345560
Start date and time:2023-11-21 03:15:06 +01:00
Joe Sandbox Product:CloudBasic
Overall analysis duration:0h 7m 43s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample file name:Q1BPEcSFNH.elf
renamed because original name is a hash value
Original Sample Name:7fe53af62bda8d7e8673865f9e5ec70b.elf
Detection:MAL
Classification:mal72.troj.evad.linELF@0/0@0/0

Warnings

  • Report size exceeded maximum capacity and may have missing network information.

Runtime Messages

Command:/tmp/Q1BPEcSFNH.elf
PID:6249
Exit Code:
Exit Code Info:
Killed:True
Standard Output:
Rakitin
selfrep started
Rakitin.
[watchdog] failed to find a valid watchdog driver, bailing out
selfrep started
Rakitin.
[watchdog] failed to find a valid watchdog driver, bailing out
selfrep started
Rakitin.
[scanner] scanner process initialized. scanning started.
[scanner] FD4 request sent to 178.131.252.116
[scanner] FD5 request sent to 118.178.117.193
[scanner] FD6 request sent to 109.121.13.114
[scanner] FD4 request sent to 2.73.67.153
[scanner] FD5 request sent to 42.199.220.104
[scanner] FD6 request sent to 178.229.135.132
[scanner] FD4 request sent to 94.62.244.190
[scanner] FD5 request sent to 212.30.129.86
[scanner] FD6 request sent to 94.105.49.243
[scanner] FD4 request sent to 37.48.7.230
[scanner] FD6 request sent to 42.65.162.38
[scanner] FD5 request sent to 109.129.102.30
[scanner] FD6 request sent to 42.129.248.201
[scanner] FD4 request sent to 210.202.121.36
[scanner] FD4 request sent to 94.224.2.70
[scanner] FD5 request sent to 178.118.149.141
[scanner] FD6 request sent to 79.69.100.161
[scanner] FD4 request sent to 5.30.216.98
[scanner] FD5 request sent to 94.141.118.253
[scanner] FD6 request sent to 94.15.82.4
[scanner] FD5 request sent to 94.254.137.230
[scanner] FD6 request sent to 79.109.237.204
[scanner] FD5 request sent to 42.247.241.219
[scanner] FD6 request sent to 79.20.117.124
[scanner] FD4 request sent to 37.164.79.12
[scanner] FD5 request sent to 94.98.34.134
[scanner] FD6 request sent to 178.160.218.93
[scanner] FD4 request sent to 178.58.103.88
[scanner] FD5 request sent to 94.217.28.139
[scanner] FD6 request sent to 94.173.152.13
[scanner] FD5 request sent to 118.223.103.3
[scanner] FD6 request sent to 178.18.87.122
[scanner] FD5 request sent to 37.82.94.237
[scanner] FD4 request sent to 118.158.90.117
[scanner] FD5 request sent to 212.207.147.150
[scanner] FD6 request sent to 118.22.43.62
[scanner] FD4 request sent to 118.36.99.9
[scanner] FD5 request sent to 109.234.96.137
[scanner] FD6 request sent to 178.13.181.154
[scanner] FD4 request sent to 212.100.241.222
[scanner] FD5 request sent to 37.12.91.131
[scanner] FD6 request sent to 37.97.169.119
[scanner] FD4 request sent to 5.29.16.18
[scanner] FD6 request sent to 2.45.120.157
[scanner] FD5 request sent to 2.229.60.144
[scanner] FD4 request sent to 118.228.171.100
[scanner] FD6 request sent to 37.177.152.122
[scanner] FD5 request sent to 37.196.164.49
[scanner] FD4 request sent to 210.206.165.19
[scanner] FD6 request sent to 94.234.230.9
[scanner] FD4 request sent to 94.247.31.194
[scanner] FD5 request sent to 118.245.129.221
[scanner] FD6 request sent to 178.229.44.53
[scanner] FD4 request sent to 79.158.114.161
[scanner] FD5 request sent to 94.145.229.165
[scanner] FD4 request sent to 118.70.83.251
[scanner] FD6 request sent to 2.21.60.45
[scanner] FD5 request sent to 37.221.208.8
[scanner] FD6 request sent to 5.58.232.154
[scanner] FD4 request sent to 5.88.196.89
[scanner] FD6 request sent to 79.66.228.154
[scanner] FD5 request sent to 109.225.136.148
[scanner] FD4 request sent to 178.34.235.180
[scanner] FD6 request sent to 94.206.66.48
[scanner] FD5 request sent to 210.74.130.123
[scanner] FD6 request sent to 79.220.198.106
[scanner] FD5 request sent to 118.146.122.244
[scanner] FD4 request sent to 37.81.71.89
[scanner] FD5 request sent to 118.92.70.182
[scanner] FD6 request sent to 2.106.41.215
[scanner] FD5 request sent to 118.9.184.189
[scanner] FD6 request sent to 79.200.228.28
[scanner] FD4 request sent to 212.213.250.16
[scanner] FD5 request sent to 2.21.3.192
[scanner] FD6 request sent to 42.154.120.21
[scanner] FD4 request sent to 37.99.81.77
[scanner] FD5 request sent to 212.24.187.32
[scanner] FD4 request sent to 109.47.54.44
[scanner] FD6 request sent to 42.135.83.172
[scanner] FD5 request sent to 178.24.190.134
[scanner] FD4 request sent to 212.54.32.17
[scanner] FD6 request sent to 5.92.111.96
[scanner] FD5 request sent to 37.120.241.249
[scanner] FD4 request sent to 42.242.69.219
[scanner] FD5 request sent to 2.254.111.44
[scanner] FD6 request sent to 118.59.103.35
[scanner] FD4 request sent to 118.79.53.109
[scanner] FD5 request sent to 109.235.159.210
[scanner] FD4 request sent to 178.49.255.36
[scanner] FD6 request sent to 94.112.103.138
[scanner] FD5 request sent to 178.1.255.166
[scanner] FD6 request sent to 118.238.215.183
[scanner] FD4 request sent to 109.96.159.46
[scanner] FD5 request sent to 118.34.222.120
[scanner] FD6 request sent to 79.213.176.7
[scanner] FD4 request sent to 94.93.63.55
[scanner] FD5 request sent to 212.204.173.87
[scanner] FD6 request sent to 37.87.33.9
[scanner] FD4 request sent to 109.32.56.140
[scanner] FD4 request sent to 2.53.155.132
[scanner] FD5 request sent to 2.205.20.165
[scanner] FD6 request sent to 94.141.48.37
[scanner] FD4 request sent to 94.90.7.170
[scanner] FD5 request sent to 109.114.141.247
[scanner] FD6 request sent to 94.241.40.238
[scanner] FD4 request sent to 5.80.190.186
[scanner] FD5 request sent to 178.111.73.104
[scanner] FD6 request sent to 210.89.93.59
[scanner] FD4 request sent to 212.76.124.109
[scanner] FD5 request sent to 109.40.254.44
[scanner] FD6 request sent to 210.254.174.100
[scanner] FD4 request sent to 2.236.180.88
[scanner] FD5 request sent to 210.108.87.165
[scanner] FD6 request sent to 210.154.246.52
[scanner] FD4 request sent to 37.21.29.151
[scanner] FD5 request sent to 118.214.45.233
[scanner] FD6 request sent to 178.165.44.99
[scanner] FD4 request sent to 212.136.127.231
[scanner] FD5 request sent to 178.233.155.42
[scanner] FD6 request sent to 94.225.228.124
[scanner] FD4 request sent to 178.249.221.41
[scanner] FD5 request sent to 118.1.240.82
[scanner] FD6 request sent to 212.207.57.246
[scanner] FD4 request sent to 109.74.191.209
[scanner] FD5 request sent to 5.29.148.240
[scanner] FD6 request sent to 118.176.92.217
[scanner] FD4 request sent to 94.183.189.190
[scanner] FD5 request sent to 5.176.68.54
[scanner] FD6 request sent to 5.42.32.164
[scanner] FD4 request sent to 37.232.14.106
[scanner] FD5 request sent to 2.55.183.243
[scanner] FD6 request sent to 37.144.104.168
[scanner] FD4 request sent to 118.233.246.83
[scanner] FD5 request sent to 79.195.14.94
[scanner] FD6 request sent to 109.217.91.19
[scanner] FD4 request sent to 79.233.205.134
[scanner] FD5 request sent to 178.204.235.236
[scanner] FD6 request sent to 212.241.56.1
[scanner] FD4 request sent to 109.113.250.226
[scanner] FD5 request sent to 42.36.76.15
[scanner] FD4 request sent to 79.182.80.95
[scanner] FD6 request sent to 212.180.5.78
[scanner] FD5 request sent to 210.2.66.4
[scanner] FD4 request sent to 118.31.179.215
[scanner] FD6 request sent to 5.229.249.253
[scanner] FD5 request sent to 37.209.152.135
[scanner] FD4 request sent to 42.2.199.184
[scanner] FD6 request sent to 109.185.198.149
[scanner] FD5 request sent to 5.251.147.157
[scanner] FD4 request sent to 37.157.199.131
[scanner] FD6 request sent to 79.89.89.211
[scanner] FD5 request sent to 212.198.99.31
[scanner] FD4 request sent to 2.7.254.81
[scanner] FD6 request sent to 212.95.172.53
[scanner] FD5 request sent to 94.98.222.36
[scanner] FD4 request sent to 178.72.38.148
[scanner] FD6 request sent to 94.42.134.217
[scanner] FD5 request sent to 109.64.180.163
[scanner] FD4 request sent to 212.57.3.238
[scanner] FD6 request sent to 42.91.74.74
[scanner] FD5 request sent to 178.187.31.94
[scanner] FD4 request sent to 212.176.245.209
[scanner] FD6 request sent to 5.234.36.116
[scanner] FD5 request sent to 2.73.177.97
[scanner] FD4 request sent to 210.191.240.241
[scanner] FD6 request sent to 109.31.199.206
[scanner] FD5 request sent to 94.58.187.90
[scanner] FD4 request sent to 42.154.225.193
[scanner] FD6 request sent to 5.21.55.192
[scanner] FD4 request sent to 79.0.252.13
[scanner] FD5 request sent to 2.40.109.246
[scanner] FD4 request sent to 79.236.118.102
[scanner] FD5 request sent to 42.37.92.122
[scanner] FD6 request sent to 118.223.120.169
[scanner] FD4 request sent to 212.171.123.100
[scanner] FD5 request sent to 118.204.0.231
[scanner] FD6 request sent to 178.50.230.205
[scanner] FD4 request sent to 2.183.94.59
[scanner] FD5 request sent to 118.56.9.73
[scanner] FD6 request sent to 79.206.98.251
[scanner] FD4 request sent to 5.47.150.82
[scanner] FD5 request sent to 5.164.120.10
[scanner] FD6 request sent to 5.162.98.129
[scanner] FD4 request sent to 37.198.122.5
[scanner] FD5 request sent to selfrep started
Rakitin.
[main] We are the only process on this system!
[scanner] Scanner process initialized. Scanning started.
[scanner] FD5 Attempting to brute found IP 185.177.229.7
[scanner] FD5 connected. Trying [91mgzza[32m:[91mqpst`ya
[scanner] FD5 connection gracefully closed
[scanner] FD5 lost connection
[scanner] FD5 retrying with different auth combo!
[scanner] FD6 Attempting to brute found IP 203.101.93.98
[scanner] FD5 connected. Trying [91mgzza[32m:[91m `e
[scanner] FD6 connected. Trying [91mgzza[32m:[91m$
[scanner] FD5 connection gracefully closed
[scanner] FD5 lost connection
[scanner] FD5 retrying with different auth combo!
[scanner] FD5 connected. Trying [91m6'.,'6#&/+,[32m:[91m6'.,'6#&/+,
[scanner] FD6 finished telnet negotiation
[scanner] FD5 connection gracefully closed
[scanner] FD5 lost connection
[scanner] FD5 retrying with different auth combo!
[scanner] FD5 connected. Trying [91mf`eezga[32m:[91mf`eezga
[scanner] FD5 connection gracefully closed
[scanner] FD5 lost connection
[scanner] FD5 retrying with different auth combo!
[scanner] FD5 connected. Trying [91m&'$#[32m:[91m
:*.5z
[scanner] FD5 connection gracefully closed
[scanner] FD5 lost connection
[scanner] FD5 retrying with different auth combo!
[scanner] FD5 connected. Trying [91m0--6B[32m:[91m0'#.6')B
[scanner] FD7 Attempting to brute found IP 163.220.222.250
[scanner] FD5 connection gracefully closed
[scanner] FD5 lost connection
[scanner] FD5 retrying with different auth combo!
[scanner] FD7 connected. Trying [91mtqx|{[32m:[91m'''''
[scanner] FD5 connected. Trying [91m0--6[32m:[91m6'.'!-/#&/+,B
[scanner] FD5 connection gracefully closed
[scanner] FD5 lost connection
[scanner] FD5 retrying with different auth combo!
[scanner] FD5 connected. Trying [91mr`pfa[32m:[91m$'&!
[scanner] FD5 connection gracefully closed
[scanner] FD5 lost connection
[scanner] FD5 retrying with different auth combo!
[scanner] FD8 Attempting to brute found IP 163.191.49.126
[scanner] FD8 connected. Trying [91mgzza[32m:[91m$'&! #"-
[scanner] FD5 connected. Trying [91mgzza[32m:[91m$'&!dbpg
[scanner] FD9 Attempting to brute found IP 115.238.251.73
[scanner] FD5 connection gracefully closed
[scanner] FD5 lost connection
[scanner] FD5 retrying with different auth combo!
[scanner] FD9 connected. Trying [91mtqx|{[32m:[91mtqx|{
[scanner] FD5 connected. Trying [91mf`eezga[32m:[91m$'&!
[scanner] FD5 connection gracefully closed
[scanner] FD5 lost connection
[scanner] FD5 retrying with different auth combo!
[scanner] FD5 connected. Trying [91mtqx|{[32m:[91mqpst`ya
[scanner] FD10 Attempting to brute found IP 59.153.163.124
[scanner] FD11 Attempting to brute found IP 164.155.209.209
[scanner] FD12 Attempting to brute found IP 189.201.156.126
[scanner] FD10 connected. Trying [91m&#'/-,B[32m:[91m&#'/-,B
[scanner] FD11 connected. Trying [91m#&/+,[32m:[91m$+0'6+&'B
[scanner] FD12 connected. Trying [91mgzza[32m:[91matOoU'&!, - ,
[scanner] FD5 connection gracefully closed
[scanner] FD5 lost connection
[scanner] FD5 retrying with different auth combo!
[scanner] FD12 lost connection
[scanner] FD12 retrying with different auth combo!
[scanner] FD5 connected. Trying [91m0--6B[32m:[91m

B
[scanner] FD12 connected. Trying [91m0--6[32m:[91m%0-
[scanner] FD5 connection gracefully closed
[scanner] FD5 lost connection
[scanner] FD5 retrying with different auth combo!
[scanner] FD12 lost connection
[scanner] FD12 retrying with different auth combo!
[scanner] FD5 connected. Trying [91m#&/+,B[32m:[91mptrs*:B
[scanner] FD12 connected. Trying [91mgzza[32m:[91mmv& $$
[scanner] FD5 connection gracefully closed
[scanner] FD5 lost connection
[scanner] FD5 retrying with different auth combo!
[scanner] FD12 lost connection
[scanner] FD12 retrying with different auth combo!
[scanner] FD5 connected. Trying [91mxr& %%[32m:[91mxpgy|{
[scanner] FD12 connected. Trying [91m&'$#[32m:[91m
:*.5z
[scanner] FD5 connection gracefully closed
[scanner] FD5 lost connection
[scanner] FD5 retrying with different auth combo!
[scanner] FD5 connected. Trying [91m212.182.142.243
[scanner] FD6 request sent to 118.80.50.223
[scanner] FD4 request sent to 178.77.164.165
[scanner] FD5 request sent to 94.180.188.138
[scanner] FD6 request sent to 178.76.129.61
[scanner] FD4 request sent to 178.186.200.2
[scanner] FD5 request sent to 79.102.206.254
[scanner] FD6 request sent to 210.191.19.163
[scanner] FD4 request sent to 109.205.90.36
[scanner] FD5 request sent to 94.136.137.10
[scanner] FD6 request sent to 5.56.139.10
[scanner] FD4 request sent to 5.115.52.171
[scanner] FD5 request sent to 37.10.245.62
[scanner] FD6 request sent to 42.163.82.175
[scanner] FD4 request sent to 94.150.83.165
[scanner] FD5 request sent to 37.181.28.161
[scanner] FD6 request sent to 178.17.143.200
[scanner] FD4 request sent to 109.209.87.110
[scanner] FD5 request sent to 210.151.197.31
[scanner] FD6 request sent to 37.23.198.73
[scanner] FD4 request sent to 79.130.169.84
[scanner] FD5 request sent to 79.102.220.54
[scanner] FD6 request sent to 109.201.73.117
[scanner] FD4 request sent to 42.96.149.27
[scanner] FD5 request sent to 42.34.14.214
[scanner] FD6 request sent to 178.78.241.91
[scanner] FD4 request sent to 42.202.222.83
[scanner] FD5 request sent to 2.158.13.195
[scanner] FD6 request sent to 37.114.82.67
[scanner] FD4 request sent to 118.229.173.18
[scanner] FD5 request sent to 42.89.223.222
[scanner] FD4 request sent to 37.137.200.212
[scanner] FD6 request sent to 109.248.40.64
[scanner] FD4 request sent to 42.210.157.169
[scanner] FD5 request sent to 109.155.228.242
[scanner] FD6 request sent to 212.8.150.255
[scanner] FD4 request sent to 37.181.28.161
[scanner] FD5 request sent to 42.199.165.169
[scanner] FD6 request sent to 118.48.108.189
[scanner] FD4 request sent to 210.238.171.20
[scanner] FD5 request sent to 210.9.113.52
[scanner] FD6 request sent to 178.8.198.55
[scanner] FD4 request sent to 109.140.148.186
[scanner] FD5 request sent to 37.221.178.249
[scanner] FD6 request sent to 37.221.137.73
[scanner] FD4 request sent to 178.147.195.51
[scanner] FD5 request sent to 178.201.107.177
[scanner] FD6 request sent to 178.160.162.124
[scanner] FD4 request sent to 212.102.80.5
[scanner] FD5 request sent to 210.187.208.187
[scanner] FD6 request sent to 210.146.80.142
[scanner] FD4 request sent to 210.74.70.40
[scanner] FD5 request sent to 109.35.194.171
[scanner] FD6 request sent to 2.202.132.113
[scanner] FD4 request sent to 210.156.152.221
[scanner] FD5 request sent to 79.158.218.188
[scanner] FD6 request sent to 94.255.96.188
[scanner] FD4 request sent to 178.136.131.186
[scanner] FD5 request sent to 210.113.43.49
[scanner] FD6 request sent to 2.81.30.48
[scanner] FD4 request sent to 210.168.238.179
[scanner] FD5 request sent to 118.75.48.127
[scanner] FD6 request sent to 37.222.134.221
[scanner] FD4 request sent to 37.182.224.119
[scanner] FD5 request sent to 118.145.88.117
[scanner] FD6 request sent to 5.69.183.74
[scanner] FD4 request sent to 79.88.51.108
[scanner] FD5 request sent to 94.182.201.86
[scanner] FD6 request sent to 210.154.5.63
[scanner] FD4 request sent to 118.209.38.11
[scanner] FD5 request sent to 79.27.229.36
[scanner] FD4 request sent to 37.192.245.34
[scanner] FD6 request sent to 178.125.25.21
[scanner] FD5 request sent to 94.224.243.166
[scanner] FD4 request sent to 37.172.217.211
[scanner] FD6 request sent to 178.248.252.145
[scanner] FD5 request sent to 2.52.107.178
[scanner] FD4 request sent to 109.71.181.78
[scanner] FD6 request sent to 5.52.189.171
[scanner] FD5 request sent to 79.122.173.50
[scanner] FD4 request sent to 37.39.109.207
[scanner] FD6 request sent to 109.120.69.214
[scanner] FD5 request sent to 5.213.81.74
[scanner] FD4 request sent to 42.151.123.15
[scanner] FD6 request sent to 5.174.146.56
[scanner] FD5 request sent to 212.114.130.127
[scanner] FD4 request sent to 5.45.196.60
[scanner] FD6 request sent to 79.45.73.248
[scanner] FD5 request sent to 118.27.209.46
[scanner] FD4 request sent to 79.188.189.170
[scanner] FD6 request sent to 109.183.246.202
[scanner] FD5 request sent to 118.178.244.111
[scanner] FD4 request sent to 210.159.237.62
[scanner] FD6 request sent to 109.244.57.165
[scanner] FD5 request sent to 2.159.206.232
[scanner] FD4 request sent to 109.197.223.228
[scanner] FD6 request sent to 79.164.199.8
[scanner] FD5 request sent to 42.254.170.95
[scanner] FD4 request sent to 2.103.148.88
[scanner] FD6 request sent to 42.212.167.156
[scanner] FD5 request sent to 118.147.127.198
[scanner] FD4 request sent to 109.158.64.69
[scanner] FD6 request sent to 212.117.179.177
[scanner] FD5 request sent to 94.138.152.123
[scanner] FD4 request sent to 5.9.39.233
[scanner] FD6 request sent to 109.118.78.99
[scanner] FD5 request sent to 210.72.157.17
[scanner] FD4 request sent to 94.187.116.229
[scanner] FD6 request sent to 42.174.55.41
[scanner] FD5 request sent to 212.52.214.137
[scanner] FD4 request sent to 37.172.18.150
[scanner] FD6 request sent to 42.136.218.166
[scanner] FD5 request sent to 109.188.234.221
[scanner] FD4 request sent to 118.141.177.150
[scanner] FD6 request sent to 118.98.187.8
[scanner] FD5 request sent to 118.25.136.239
[scanner] FD4 request sent to 118.55.86.100
[scanner] FD6 request sent to 2.79.156.194
[scanner] FD5 request sent to 109.244.42.8
[scanner] FD4 request sent to 94.163.165.27
[scanner] FD6 request sent to 118.90.250.70
[scanner] FD4 request sent to 118.198.66.53
[scanner] FD5 request sent to 109.146.183.128
[scanner] FD6 request sent to 37.169.93.119
[scanner] FD4 request sent to 2.28.175.152
[scanner] FD5 request sent to 178.100.38.11
[scanner] FD6 request sent to 5.137.218.54
[scanner] FD4 request sent to 212.138.204.15
[scanner] FD5 request sent to 79.245.255.237
[scanner] FD6 request sent to 178.66.15.230
[scanner] FD4 request sent to 37.128.42.187
[scanner] FD5 request sent to 109.201.81.119
[scanner] FD6 request sent to 79.118.214.39
[scanner] FD4 request sent to 79.72.218.97
[scanner] FD5 request sent to 5.182.151.218
[scanner] FD6 request sent to 118.73.241.144
[scanner] FD4 request sent to 109.213.204.161
[scanner] FD5 request sent to 2.179.5.67
[scanner] FD6 request sent to 5.40.19.45
[scanner] FD4 request sent to 42.154.156.173
[scanner] FD5 request sent to 210.61.187.1
[scanner] FD6 request sent to 212.177.2.136
[scanner] FD4 request sent to 210.20.64.157
[scanner] FD5 request sent to 178.82.176.240
[scanner] FD6 request sent to 178.178.219.195
[scanner] FD4 request sent to 79.118.1.18
[scanner] FD5 request sent to 94.32.146.50
[scanner] FD6 request sent to 37.164.44.209
[scanner] FD4 request sent to 94.219.20.89
[scanner] FD5 request sent to 5.107.28.154
[scanner] FD6 request sent to 109.206.47.241
[scanner] FD4 request sent to 5.52.93.86
[scanner] FD5 request sent to 109.133.138.203
[scanner] FD6 request sent to 210.68.152.48
[scanner] FD4 request sent to 178.135.190.145
[scanner] FD5 request sent to 5.132.72.29
[scanner] FD6 request sent to 212.4.129.34
[scanner] FD4 request sent to 118.96.207.147
[scanner] FD5 request sent to 2.136.48.255
[scanner] FD6 request sent to 2.15.57.68
[scanner] FD4 request sent to 42.230.4.219
[scanner] FD5 request sent to 5.117.80.162
[scanner] FD6 request sent to 210.195.44.187
[scanner] FD4 request sent to 109.91.64.46
[scanner] FD5 request sent to 79.187.176.62
[scanner] FD6 request sent to 178.133.232.1
[scanner] FD4 request sent to 42.68.193.125
[scanner] FD5 request sent to 212.108.211.240
[scanner] FD6 request sent to 178.217.191.254
[scanner] FD4 request sent to 212.185.41.87
[scanner] FD5 request sent to 212.17.240.182
[scanner] FD6 request sent to 212.85.116.90
[scanner] FD4 request sent to 210.102.137.230
[scanner] FD5 request sent to 210.182.183.105
[scanner] FD6 request sent to 210.62.134.66
[scanner] FD4 request sent to 79.5.56.43
[scanner] FD5 request sent to 79.171.164.244
[scanner] FD6 request sent to 37.104.104.218
[scanner] FD4 request sent to 178.51.245.232
[scanner] FD5 request sent to 79.51.167.234
[scanner] FD6 request sent to 5.27.98.226
[scanner] FD4 request sent to 210.253.3.44
[scanner] FD5 request sent to 210.228.175.107
[scanner] FD6 request sent to 118.44.33.46
[scanner] FD4 request sent to 109.31.131.219
[scanner] FD5 request sent to 2.208.150.44
[scanner] FD6 request sent to 37.113.96.26
[scanner] FD4 request sent to 94.20.203.67
[scanner] FD5 request sent to 79.25.178.22
[scanner] FD6 request sent to 2.6.219.41
[scanner] FD4 request sent to 178.168.9.87
[scanner] FD5 request sent to 94.153.54.102
[scanner] FD4 request sent to 37.31.2.28
[scanner] FD6 request sent to 212.179.174.84
[scanner] FD5 request sent to 212.218.26.126
[scanner] FD6 request sent to 37.138.199.239
[scanner] FD4 request sent to 37.74.191.244
[scanner] FD5 request sent to 79.129.235.200
[scanner] FD6 request sent to 79.42.139.244
[scanner] FD4 request sent to 94.170.104.71
[scanner] FD5 request sent to 212.4.125.174
[scanner] FD6 request sent to 2.193.225.124
[scanner] FD4 request sent to 5.42.97.135
[scanner] FD5 request sent to 94.162.32.25
[scanner] FD6 request sent to 42.177.23.203
[scanner] FD4 request sent to 109.78.92.177
[scanner] FD5 request sent to 94.152.71.219
[scanner] FD6 request sent to 79.248.151.6
[scanner] FD4 request sent to 79.45.31.93
[scanner] FD5 request sent to 2.204.232.83
[scanner] FD4 request sent to 94.36.201.107
[scanner] FD6 request sent to 94.36.141.146
[scanner] FD5 request sent to 37.161.178.197
[scanner] FD4 request sent to 178.146.136.212
[scanner] FD6 request sent to 178.9.87.13
[scanner] FD5 request sent to 109.74.56.184
[scanner] FD4 request sent to 94.206.154.59
[scanner] FD6 request sent to 94.151.229.158
[scanner] FD5 request sent to 94.77.16.15
[scanner] FD4 request sent to 42.56.187.121
[scanner] FD6 request sent to 42.90.143.174
[scanner] FD5 request sent to 118.140.107.245
[scanner] FD4 request sent to 94.65.207.117
[scanner] FD6 request sent to 2.159.156.76
[scanner] FD5 request sent to 210.97.198.75
[scanner] FD4 request sent to 118.115.129.28
[scanner] FD6 request sent to 37.95.129.122
[scanner] FD5 request sent to 5.103.18.72
[scanner] FD4 request sent to 37.250.230.206
[scanner] FD6 request sent to 210.90.251.192
[scanner] FD5 request sent to 2.207.101.202
[scanner] FD4 request sent to 94.107.127.97
[scanner] FD6 request sent to 212.185.65.158
[scanner] FD5 request sent to 118.211.34.57
[scanner] FD4 request sent to 212.192.76.148
[scanner] FD6 request sent to 178.44.43.190
[scanner] FD4 request sent to 42.10.11.156
[scanner] FD5 request sent to 79.135.68.89
[scanner] FD6 request sent to 94.149.43.108
[scanner] FD4 request sent to 2.172.101.113
[scanner] FD5 request sent to 2.50.189.73
[scanner] FD6 request sent to 42.202.108.45
[scanner] FD4 request sent to 94.151.21.44
[scanner] FD5 request sent to 109.92.127.110
[scanner] FD6 request sent to 79.165.28.26
[scanner] FD4 request sent to 2.42.95.70
[scanner] FD5 request sent to 42.224.221.111
[scanner] FD6 request sent to 42.9.4.243
[scanner] FD4 request sent to 109.105.127.209
[scanner] FD5 request sent to 118.110.205.27
[scanner] FD6 request sent to 212.114.84.9
[scanner] FD4 request sent to 2.252.250.117
[scanner] FD5 request sent to 178.150.32.88
[scanner] FD6 request sent to 109.78.182.239
[scanner] FD4 request sent to 210.133.107.66
[scanner] FD5 request sent to 109.231.23.163
[scanner] FD6 request sent to 212.52.52.217
[scanner] FD4 request sent to 2.226.167.218
[scanner] FD5 request sent to 42.0.214.6
[scanner] FD6 request sent to 37.104.206.129
[scanner] FD4 request sent to 2.76.223.166
[scanner] FD5 request sent to 42.113.86.205
[scanner] FD6 request sent to 178.212.234.5
[scanner] FD4 request sent to 212.132.131.248
[scanner] FD5 request sent to 210.153.162.148
[scanner] FD6 request sent to 178.216.147.245
[scanner] FD4 request sent to 94.38.162.223
[scanner] FD5 request sent to 118.204.197.131
[scanner] FD6 request sent to 212.50.55.8
[scanner] FD4 request sent to 2.11.153.158
[scanner] FD5 request sent to 212.169.136.173
[scanner] FD6 request sent to 79.95.152.126
[scanner] FD4 request sent to 212.45.72.206
[scanner] FD5 request sent to 212.124.143.229
[scanner] FD6 request sent to 79.184.171.249
[scanner] FD4 request sent to 79.37.171.31
[scanner] FD5 request sent to 2.94.40.201
[scanner] FD6 request sent to 118.157.102.135
[scanner] FD4 request sent to 42.66.155.243
[scanner] FD6 request sent to 94.210.62.70
[scanner] FD4 request sent to 94.104.233.251
[scanner] FD5 request sent to 210.229.112.180
[scanner] FD4 request sent to 79.10.23.13
[scanner] FD6 request sent to 109.31.2.35
[scanner] FD5 request sent to 37.110.255.211
[scanner] FD4 request sent to 2.119.158.212
[scanner] FD6 request sent to 5.216.238.2
[scanner] FD5 request sent to 94.176.175.205
[scanner] FD4 request sent to 79.0.194.146
[scanner] FD6 request sent to 212.20.107.171
[scanner] FD5 request sent to 118.120.112.41
[scanner] FD4 request sent to 210.171.70.173
[scanner] FD6 request sent to 118.66.18.113
[scanner] FD5 request sent to 212.194.136.49
[scanner] FD4 request sent to 118.219.167.137
[scanner] FD6 request sent to 37.240.188.177
[scanner] FD5 request sent to 94.91.139.63
[scanner] FD4 request sent to 5.18.211.161
[scanner] FD6 request sent to 2.195.206.164
[scanner] FD5 request sent to 42.9.144.208
[scanner] FD4 request sent to 109.149.160.234
[scanner] FD6 request sent to 212.36.154.26
[scanner] FD5 request sent to 118.78.74.72
[scanner] FD4 request sent to 212.243.138.252
[scanner] FD6 request sent to 5.171.176.98
[scanner] FD5 request sent to 94.51.212.33
[scanner] FD4 request sent to 2.26.160.136
[scanner] FD6 request sent to 109.210.250.155
[scanner] FD5 request sent to 178.122.50.8
[scanner] FD4 request sent to 109.12.61.223
[scanner] FD6 request sent to 79.254.179.0
[scanner] FD5 request sent to 37.73.255.167
[scanner] FD4 request sent to 42.70.3.141
[scanner] FD6 request sent to 79.63.0.225
[scanner] FD5 request sent to 37.55.196.191
[scanner] FD4 request sent to 42.182.235.40
[scanner] FD6 request sent to 79.2.69.218
[scanner] FD5 request sent to 109.62.135.92
[scanner] FD4 request sent to 210.241.151.231
[scanner] FD5 request sent to 118.144.26.32
[scanner] FD6 request sent to 42.239.82.30
[scanner] FD4 request sent to 42.46.97.105
[scanner] FD5 request sent to 42.174.133.175
[scanner] FD6 request sent to 118.42.137.10
[scanner] FD4 request sent to 212.77.113.245
[scanner] FD5 request sent to 178.10.238.58
[scanner] FD6 request sent to 212.82.156.157
[scanner] FD4 request sent to 5.163.129.169
[scanner] FD5 request sent to 212.51.92.247
[scanner] FD6 request sent to 212.136.163.211
[scanner] FD4 request sent to 94.10.107.149
[scanner] FD5 request sent to 5.240.87.238
[scanner] FD6 request sent to 212.71.224.1
[scanner] FD4 request sent to 109.249.231.169
[scanner] FD5 request sent to 212.165.254.197
[scanner] FD6 request sent to 42.207.198.117
[scanner] FD4 request sent to 178.69.138.185
[scanner] FD5 request sent to 5.72.176.145
[scanner] FD6 request sent to 109.230.206.36
[scanner] FD4 request sent to 109.185.188.185
[scanner] FD5 request sent to 42.161.225.36
[scanner] FD6 request sent to 94.77.5.205
[scanner] FD4 request sent to 210.7.215.121
[scanner] FD5 request sent to 79.107.225.104
[scanner] FD6 request sent to 42.228.216.40
[scanner] FD4 request sent to 109.204.81.146
[scanner] FD5 request sent to 178.66.153.201
[scanner] FD6 request sent to 118.130.32.126
[scanner] FD4 request sent to 212.66.35.98
[scanner] FD5 request sent to 5.6.229.116
[scanner] FD4 request sent to 37.176.68.138
[scanner] FD6 request sent to 109.146.85.223
[scanner] FD5 request sent to 2.144.169.50
[scanner] FD4 request sent to 42.164.131.92
[scanner] FD6 request sent to 94.211.182.186
[scanner] FD5 request sent to 210.131.223.164
[scanner] FD4 request sent to 37.0.125.16
[scanner] FD6 request sent to 79.220.172.185
[scanner] FD5 request sent to 212.178.237.149
[scanner] FD4 request sent to 118.227.53.225
[scanner] FD6 request sent to 109.58.75.243
[scanner] FD5 request sent to 94.162.104.72
[scanner] FD4 request sent to 109.5.29.118
[scanner] FD5 request sent to 212.252.43.121
[scanner] FD6 request sent to 178.135.93.203
[scanner] FD4 request sent to 212.217.88.181
[scanner] FD5 request sent to 210.67.202.55
[scanner] FD6 request sent to 37.50.12.88
[scanner] FD4 request sent to 94.232.8.33
[scanner] FD5 request sent to 210.120.239.72
[scanner] FD6 request sent to 94.218.0.162
[scanner] FD4 request sent to 37.219.210.224
[scanner] FD5 request sent to 2.195.47.109
[scanner] FD6 request sent to 37.17.221.53
[scanner] FD4 request sent to 178.234.40.130
[scanner] FD5 request sent to 109.248.123.215
[scanner] FD6 request sent to 178.148.141.138
[scanner] FD4 request sent to 42.146.39.236
[scanner] FD5 request sent to 79.74.131.61
[scanner] FD6 request sent to 210.109.31.82
[scanner] FD4 request sent to 2.230.12.87
[scanner] FD5 request sent to 109.151.23.166
[scanner] FD6 request sent to 42.205.58.219
[scanner] FD4 request sent to 109.183.161.112
[scanner] FD5 request sent to 37.132.163.158
[scanner] FD6 request sent to 210.218.17.228
[scanner] FD4 request sent to 94.80.237.199
[scanner] FD5 request sent to 42.155.77.100
[scanner] FD6 request sent to 2.121.161.233
[scanner] FD4 request sent to 37.73.111.63
[scanner] FD5 request sent to 42.51.244.53
[scanner] FD6 request sent to 5.208.170.33
[scanner] FD5 request sent to 42.18.203.95
[scanner] FD6 request sent to 212.217.80.68
[scanner] FD5 request sent to 118.34.236.213
[scanner] FD6 request sent to 2.0.95.64
[scanner] FD5 request sent to 5.40.161.51
[scanner] FD4 request sent to 212.243.181.213
[scanner] FD6 request sent to 2.72.0.170
[scanner] FD5 request sent to 2.146.84.89
[scanner] FD4 request sent to 2.252.178.165
[scanner] FD6 request sent to 5.78.184.128
[scanner] FD5 request sent to 109.224.94.85
[scanner] FD4 request sent to 2.153.180.116
[scanner] FD6 request sent to 212.183.186.12
[scanner] FD4 request sent to 178.69.150.97
[scanner] FD5 request sent to 118.119.12.156
[scanner] FD6 request sent to 94.253.31.118
[scanner] FD4 request sent to 94.239.16.219
[scanner] FD5 request sent to 79.53.205.47
[scanner] FD6 request sent to 109.255.56.77
[scanner] FD4 request sent to 42.172.170.145
[scanner] FD5 request sent to 94.7.156.238
[scanner] FD6 request sent to 2.148.233.216
[scanner] FD4 request sent to 118.84.152.220
[scanner] FD5 request sent to 42.159.157.111
[scanner] FD6 request sent to 5.56.90.85
[scanner] FD4 request sent to 109.30.102.247
[scanner] FD5 request sent to 37.23.108.153
[scanner] FD6 request sent to 118.81.182.71
[scanner] FD4 request sent to 178.217.34.182
[scanner] FD5 request sent to 212.13.147.13
[scanner] FD4 request sent to 42.15.164.199
[scanner] FD5 request sent to 94.52.217.6
[scanner] FD4 request sent to 109.113.65.20
[scanner] FD6 request sent to 109.65.33.129
[scanner] FD5 request sent to 118.39.124.125
[scanner] FD4 request sent to 2.95.159.129
[scanner] FD6 request sent to 212.77.241.31
[scanner] FD5 request sent to 37.81.176.225
[scanner] FD4 request sent to 5.97.205.212
[scanner] FD6 request sent to 5.160.24.251
[scanner] FD5 request sent to 2.216.117.181
[scanner] FD4 request sent to 109.24.153.198
[scanner] FD6 request sent to 79.239.190.163
[scanner] FD5 request sent to 212.16.153.216
[scanner] FD4 request sent to 42.246.204.43
[scanner] FD6 request sent to 94.231.157.216
[scanner] FD5 request sent to 178.202.5.206
[scanner] FD4 request sent to 37.76.127.51
[scanner] FD6 request sent to 178.63.187.11
[scanner] FD5 request sent to 212.114.84.73
[scanner] FD4 request sent to 37.208.177.244
[scanner] FD5 request sent to 210.71.33.96
[scanner] FD4 request sent to 109.5.29.244
[scanner] FD6 request sent to 118.175.182.74
[scanner] FD5 request sent to 109.17.134.87
[scanner] FD4 request sent to 5.250.199.85
[scanner] FD5 request sent to 2.210.234.233
[scanner] FD6 request sent to 5.117.213.51
[scanner] FD4 request sent to 2.12.183.4
[scanner] FD5 request sent to 79.136.213.105
[scanner] FD6 request sent to 42.1.33.177
[scanner] FD4 request sent to 79.5.59.43
[scanner] FD5 request sent to 42.2.159.35
[scanner] FD6 request sent to 42.25.122.24
[scanner] FD4 request sent to 109.174.166.74
[scanner] FD5 request sent to 109.155.40.5
[scanner] FD6 request sent to 109.27.123.19
[scanner] FD4 request sent to 94.82.41.255
[scanner] FD5 request sent to 94.195.158.203
[scanner] FD6 request sent to 42.231.246.95
[scanner] FD4 request sent to 5.114.48.69
[scanner] FD5 request sent to 2.166.77.76
[scanner] FD6 request sent to 212.30.5.15
[scanner] FD4 request sent to 210.14.85.141
[scanner] FD5 request sent to 0--6[32m:[91m#/15B
[scanner] FD12 finished telnet negotiation
[scanner] FD5 connection gracefully closed
[scanner] FD5 lost connection
[scanner] FD12 connection gracefully closed
[scanner] FD12 lost connection
[scanner] FD5 retrying with different auth combo!
[scanner] FD5 connected. Trying [91mgzza[32m:[91mflfapx
[scanner] FD8 lost connection
[scanner] FD8 retrying with different auth combo!
[scanner] FD5 lost connection
[scanner] FD5 retrying with different auth combo!
[scanner] FD8 connected. Trying [91mgzza[32m:[91mapyvz
[scanner] FD5 connected. Trying [91mr`pfa[32m:[91mr`pfa
[scanner] FD5 finished telnet negotiation
[scanner] FD5 connection gracefully closed
[scanner] FD5 lost connection
[scanner] FD5 retrying with different auth combo!
[scanner] FD5 connected. Trying [91mgzza[32m:[91mc|omc
[scanner] FD5 finished telnet negotiation
[scanner] FD5 connection gracefully closed
[scanner] FD5 lost connection
[scanner] FD5 retrying with different auth combo!
[scanner] FD5 connected. Trying [91m#&/+,[32m:[91m$+0'6+&'B
[scanner] FD5 finished telnet negotiation
[scanner] FD5 connection gracefully closed
[scanner] FD5 lost connection
[scanner] FD5 retrying with different auth combo!
[scanner] FD8 lost connection
[scanner] FD8 retrying with different auth combo!
[scanner] FD5 connected. Trying [91mgzza[32m:[91mapyvz
[scanner] FD8 connected. Trying [91mgzza[32m:[91mt{afyd
[scanner] FD5 finished telnet negotiation
[scanner] FD5 connection gracefully closed
[scanner] FD5 lost connection
[scanner] FD5 retrying with different auth combo!
[scanner] FD5 connected. Trying [91mqtpxz{[32m:[91m
[scanner] FD5 finished telnet negotiation
[scanner] FD5 connection gracefully closed
[scanner] FD5 lost connection
[scanner] FD5 retrying with different auth combo!
[scanner] FD5 connected. Trying [91mgzza[32m:[91mcwoq
[scanner] FD5 finished telnet negotiation
[scanner] FD5 connection gracefully closed
[scanner] FD5 lost connection
[scanner] FD5 retrying with different auth combo!
[scanner] FD5 connected. Trying [91mspqvB[32m:[91m!-/!#16B
[scanner] FD8 lost connection
[scanner] FD8 retrying with different auth combo!
[scanner] FD5 finished telnet negotiation
[scanner] FD8 connected. Trying [91mgzza[32m:[91m$'&! #"-,%
[scanner] FD5 connection gracefully closed
[scanner] FD5 lost connection
[scanner] FD5 retrying with different auth combo!
[scanner] FD5 connected. Trying [91m0--6B[32m:[91m0#1 '00;2+'B
[scanner] FD5 finished telnet negotiation
[scanner] FD5 connection gracefully closed
[scanner] FD5 lost connection
[scanner] FD5 retrying with different auth combo!
[scanner] FD5 connected. Trying [91mgzza[32m:[91m$'&! #
[scanner] FD5 finished telnet negotiation
[scanner] FD5 connection gracefully closed
[scanner] FD5 lost connection
[scanner] FD5 retrying with different auth combo!
[scanner] FD5 connected. Trying [91m#&/+,[32m:[91m$+0'6+&'B
[scanner] FD5 finished telnet negotiation
[scanner] FD8 lost connection
[scanner] FD8 retrying with different auth combo!
[scanner] FD8 connected. Trying [91mtqx|{[32m:[91m$'&!
[scanner] FD5 connection gracefully closed
[scanner] FD5 lost connection
[scanner] FD8 lost connection
[scanner] FD5 retrying with different auth combo!
[scanner] FD8 Attempting to brute found IP 218.49.210.65
[scanner] FD5 connected. Trying [91m0--6B[32m:[91m&0-22'0B
[scanner] FD8 connected. Trying [91m[32m:[91m!-,,'!6B
[scanner] FD5 lost connection
[scanner] FD5 retrying with different auth combo!
[scanner] FD12 Attempting to brute found IP 163.18.51.211
[scanner] FD13 Attempting to brute found IP 201.176.214.60
[scanner] FD13 connected. Trying [91mspqvB[32m:[91m!-/!#16B
[scanner] FD12 connected. Trying [91mgzza[32m:[91mapy{pagzza
[scanner] FD13 finished telnet negotiation
[table] Tried to double-lock value
[table] Tried to double-lock value
[scanner] FD13 received username prompt
[table] Tried to double-lock value
[scanner] FD13 received password prompt
[scanner] FD8 connection gracefully closed
[scanner] FD8 lost connection
[scanner] FD8 retrying with different auth combo!
178.125.65.54
[scanner] FD6 request sent to 210.119.188.102
[scanner] FD4 request sent to 5.217.242.224
[scanner] FD5 request sent to 210.174.69.92
[scanner] FD6 request sent to 210.237.139.164
[scanner] FD4 request sent to 79.91.236.115
[scanner] FD5 request sent to 178.151.250.48
[scanner] FD6 request sent to 2.247.65.61
[scanner] FD4 request sent to 37.229.50.176
[scanner] FD5 request sent to 2.98.251.241
[scanner] FD6 request sent to 5.115.118.100
[scanner] FD4 request sent to 212.217.208.50
[scanner] FD5 request sent to 109.252.250.89
[scanner] FD6 request sent to 2.72.10.206
[scanner] FD4 request sent to 118.37.67.91
[scanner] FD5 request sent to 2.32.40.3
[scanner] FD6 request sent to 94.128.236.115
[scanner] FD4 request sent to 79.67.92.188
[scanner] FD5 request sent to 109.165.93.45
[scanner] FD6 request sent to 109.5.132.206
[scanner] FD4 request sent to 2.197.92.243
[scanner] FD5 request sent to 210.167.82.56
[scanner] FD6 request sent to 118.173.109.158
[scanner] FD4 request sent to 210.205.244.219
[scanner] FD5 request sent to 178.255.49.155
[scanner] FD6 request sent to 2.59.187.229
[scanner] FD4 request sent to 2.234.211.37
[scanner] FD5 request sent to 42.196.218.153
[scanner] FD6 request sent to 42.203.160.26
[scanner] FD4 request sent to 79.105.95.162
[scanner] FD5 request sent to 109.1.144.79
[scanner] FD6 request sent to 210.26.103.195
[scanner] FD4 request sent to 178.86.47.86
[scanner] FD5 request sent to 210.248.7.66
[scanner] FD6 request sent to 94.11.207.53
[scanner] FD4 request sent to 37.55.250.27
[scanner] FD5 request sent to 210.3.25.77
[scanner] FD6 request sent to 178.195.207.161
[scanner] FD4 request sent to 118.251.120.101
[scanner] FD5 request sent to 94.61.0.58
[scanner] FD6 request sent to 109.121.169.197
[scanner] FD4 request sent to 2.53.222.60
[scanner] FD5 request sent to 178.44.6.33
[scanner] FD6 request sent to 79.24.87.101
[scanner] FD4 request sent to 79.161.225.75
[scanner] FD5 request sent to 109.238.61.51
[scanner] FD6 request sent to 109.253.36.251
[scanner] FD4 request sent to 210.166.91.226
[scanner] FD5 request sent to 5.122.26.29
[scanner] FD4 request sent to 94.204.26.117
[scanner] FD5 request sent to 79.8.230.169
[scanner] FD6 request sent to 212.66.148.11
[scanner] FD4 request sent to 212.128.137.94
[scanner] FD5 request sent to 37.237.14.0
[scanner] FD6 request sent to 2.56.14.246
[scanner] FD4 request sent to 212.2.213.71
[scanner] FD5 request sent to 5.207.113.171
[scanner] FD4 request sent to 2.134.76.236
[scanner] FD6 request sent to 178.205.142.131
[scanner] FD4 request sent to 5.215.194.231
[scanner] FD5 request sent to 37.47.84.54
[scanner] FD6 request sent to 118.105.224.165
[scanner] FD4 request sent to 42.150.147.26
[scanner] FD5 request sent to 37.50.64.228
[scanner] FD6 request sent to 210.222.233.41
[scanner] FD4 request sent to 210.2.126.168
[scanner] FD5 request sent to 118.240.16.51
[scanner] FD6 request sent to 212.237.119.210
[scanner] FD4 request sent to 109.88.167.204
[scanner] FD5 request sent to 109.123.149.63
[scanner] FD6 request sent to 118.10.253.156
[scanner] FD4 request sent to 118.103.25.110
[scanner] FD5 request sent to 178.51.246.188
[scanner] FD6 request sent to 42.197.168.140
[scanner] FD4 request sent to 212.113.66.42
[scanner] FD5 request sent to 118.86.224.75
[scanner] FD6 request sent to 94.80.195.192
[scanner] FD4 request sent to 178.52.249.29
[scanner] FD5 request sent to 109.207.146.27
[scanner] FD6 request sent to 37.14.139.121
[scanner] FD4 request sent to 210.112.255.18
[scanner] FD5 request sent to 2.191.192.184
[scanner] FD6 request sent to 118.25.119.42
[scanner] FD4 request sent to 37.2.197.109
[scanner] FD5 request sent to 5.189.45.170
[scanner] FD6 request sent to 2.109.120.129
[scanner] FD4 request sent to 118.141.49.140
[scanner] FD5 request sent to 212.234.107.109
[scanner] FD6 request sent to 94.201.27.232
[scanner] FD4 request sent to 42.64.134.188
[scanner] FD5 request sent to 37.71.107.210
[scanner] FD6 request sent to 109.119.237.178
[scanner] FD4 request sent to 5.73.2.161
[scanner] FD5 request sent to 37.167.[scanner] FD8 connected. Trying [91m0--6B[32m:[91m0#1 '00;2+'B
[scanner] FD12 lost connection
[scanner] FD12 retrying with different auth combo!
[scanner] FD14 Attempting to brute found IP 34.117.178.85
[scanner] FD12 connected. Trying [91m6'.,'6#&/+,[32m:[91m6'.,'6#&/+,
[scanner] FD14 connected. Trying [91mgzza[32m:[91moymm;
[scanner] FD5 timed out (state = 1)
[scanner] FD13 received shell prompt
[scanner] FD14 connection gracefully closed
[scanner] FD14 lost connection
[scanner] FD5 retrying with different auth combo!
[scanner] FD5 connected. Trying [91mgzza[32m:[91my|{`mf}pyy
[scanner] FD14 Attempting to brute found IP 66.242.152.145
[scanner] FD5 connection gracefully closed
[scanner] FD5 lost connection
[scanner] FD5 retrying with different auth combo!
[scanner] FD15 Attempting to brute found IP 94.120.13.196
[scanner] FD14 connected. Trying [91m0--6B[32m:[91m--6B
[scanner] FD5 connected. Trying [91m#&/+,[32m:[91m$+0'6+&'B
[scanner] FD5 connection gracefully closed
[scanner] FD5 lost connection
[scanner] FD5 retrying with different auth combo!
[scanner] FD15 connected. Trying [91m6'.,'6#&/+,[32m:[91m6'.,'6#&/+,
[scanner] FD13 received sh prompt
[scanner] FD5 connected. Trying [91mtqx|{[32m:[91mqpst`ya
[scanner] FD5 connection gracefully closed
[scanner] FD5 lost connection
[scanner] FD5 retrying with different auth combo!
[scanner] FD5 connected. Trying [91mxr& %%[32m:[91mxpgy|{
[scanner] FD5 connection gracefully closed
[scanner] FD5 lost connection
[scanner] FD5 retrying with different auth combo!
[scanner] FD5 connected. Trying [91m0--6B[32m:[91m0'#.6')B
[scanner] FD5 connection gracefully closed
[scanner] FD5 lost connection
[scanner] FD5 retrying with different auth combo!
[scanner] FD5 connected. Trying [91m0--6[32m:[91m6'.'!-/#&/+,B
[scanner] FD5 connection gracefully closed
[scanner] FD5 lost connection
[scanner] FD5 retrying with different auth combo!
[scanner] FD5 connected. Trying [91mgzza[32m:[91mEyfV}rXp$
[scanner] FD5 connection gracefully closed
[scanner] FD5 lost connection
[scanner] FD5 retrying with different auth combo!
[scanner] FD6 connection gracefully closed
[scanner] FD6 lost connection
[scanner] FD6 retrying with different auth combo!
[scanner] FD6 connected. Trying [91m0--6B[32m:[91m0'#.6')B
[scanner] FD6 finished telnet negotiation
[scanner] FD12 lost connection
[scanner] FD12 retrying with different auth combo!
[scanner] FD5 connected. Trying [91m&'$#[32m:[91m
:*.5z
[scanner] FD5 connection gracefully closed
[scanner] FD5 lost connection
[scanner] FD5 retrying with different auth combo!
[scanner] FD8 connection gracefully closed
[scanner] FD8 lost connection
[scanner] FD8 retrying with different auth combo!
[scanner] FD5 connected. Trying [91m0--6B[32m:[91m0#1 '00;2+'B
[scanner] FD12 connected. Trying [91mgzza[32m:[91mRX-$-'
[scanner] FD5 connection gracefully closed
[scanner] FD5 lost connection
[scanner] FD5 retrying with different auth combo!
[scanner] FD5 connected. Trying [91mgzza[32m:[91m!&'$
[scanner] FD8 connected. Trying [91mgzza[32m:[91mgzza
[scanner] FD5 connection gracefully closed
[scanner] FD5 lost connection
[scanner] FD5 retrying with different auth combo!
[scanner] FD5 connected. Trying [91m0--6[32m:[91m#/15B
[scanner] FD5 connection gracefully closed
[scanner] FD5 lost connection
[scanner] FD5 retrying with different auth combo!
[scanner] FD5 connected. Trying [91mgzza[32m:[91m}`{a " ,
[scanner] FD5 connection gracefully closed
[scanner] FD5 lost connection
[scanner] FD5 retrying with different auth combo!
[scanner] FD5 connected. Trying [91mgzza[32m:[91m`|q%
[scanner] FD7 timed out (state = 2)
[scanner] FD5 connection gracefully closed
[scanner] FD5 lost connection
[scanner] FD5 retrying with different auth combo!
[scanner] FD5 connected. Trying [91mtqx|{[32m:[91m$,--
[scanner] FD5 connection gracefully closed
[scanner] FD5 lost connection
[scanner] FD13 received sh prompt
[scanner] FD13 received shell prompt
[scanner] FD13 received sh prompt
[scanner] FD5 Attempting to brute found IP 195.135.21.71200.201
[scanner] FD6 request sent to 5.208.196.189
[scanner] FD4 request sent to 2.128.236.80
[scanner] FD5 request sent to 94.15.219.168
[scanner] FD6 request sent to 210.250.68.35
[scanner] FD4 request sent to 79.89.225.1
[scanner] FD5 request sent to 37.22.115.254
[scanner] FD6 request sent to 5.182.204.152
[scanner] FD4 request sent to 210.65.29.129
[scanner] FD5 request sent to 37.46.169.255
[scanner] FD6 request sent to 5.210.127.79
[scanner] FD4 request sent to 94.142.120.100
[scanner] FD5 request sent to 37.138.145.95
[scanner] FD6 request sent to 94.157.173.135
[scanner] FD4 request sent to 79.95.67.169
[scanner] FD5 request sent to 37.162.103.253
[scanner] FD6 request sent to 109.62.28.35
[scanner] FD4 request sent to 118.254.214.227
[scanner] FD5 request sent to 42.238.95.48
[scanner] FD6 request sent to 2.59.8.27
[scanner] FD4 request sent to 5.230.125.125
[scanner] FD5 request sent to 5.104.203.194
[scanner] FD6 request sent to 2.124.221.133
[scanner] FD4 request sent to 37.29.227.216
[scanner] FD5 request sent to 5.206.227.152
[scanner] FD6 request sent to 178.67.102.43
[scanner] FD4 request sent to 109.88.106.252
[scanner] FD5 request sent to 210.219.48.190
[scanner] FD6 request sent to 118.43.99.118
[scanner] FD4 request sent to 2.31.67.31
[scanner] FD5 request sent to 118.29.112.12
[scanner] FD6 request sent to 94.174.186.15
[scanner] FD4 request sent to 212.192.88.207
[scanner] FD5 request sent to 118.155.132.87
[scanner] FD6 request sent to 118.254.245.160
[scanner] FD4 request sent to 42.75.159.114
[scanner] FD5 request sent to 37.31.16.46
[scanner] FD6 request sent to 42.127.159.191
[scanner] FD4 request sent to 37.56.245.121
[scanner] FD5 request sent to 109.241.238.140
[scanner] FD6 request sent to 210.84.248.127
[scanner] FD4 request sent to 178.247.152.74
[scanner] FD5 request sent to 118.25.145.152
[scanner] FD6 request sent to 118.42.31.45
[scanner] FD4 request sent to 109.187.100.242
[scanner] FD5 request sent to 109.152.32.60
[scanner] FD6 request sent to 178.40.0.208
[scanner] FD4 request sent to 37.232.145.77
[scanner] FD5 request sent to 5.208.33.53
[scanner] FD6 request sent to 118.233.240.77
[scanner] FD4 request sent to 210.42.142.89
[scanner] FD5 request sent to 109.173.21.132
[scanner] FD6 request sent to 212.249.13.22
[scanner] FD4 request sent to 118.127.12.117
[scanner] FD5 request sent to 109.215.105.12
[scanner] FD6 request sent to 5.237.209.193
[scanner] FD4 request sent to 178.186.170.69
[scanner] FD5 request sent to 94.91.155.108
[scanner] FD4 request sent to 2.247.153.200
[scanner] FD5 request sent to 109.97.245.40
[scanner] FD6 request sent to 212.118.239.240
[scanner] FD4 request sent to 5.9.208.75
[scanner] FD5 request sent to 37.107.184.143
[scanner] FD6 request sent to 94.106.35.100
[scanner] FD4 request sent to 42.149.134.15
[scanner] FD5 request sent to 42.86.28.76
[scanner] FD6 request sent to 212.121.186.90
[scanner] FD4 request sent to 37.241.110.243
[scanner] FD5 request sent to 178.249.128.182
[scanner] FD6 request sent to 79.179.19.57
[scanner] FD4 request sent to 79.55.79.94
[scanner] FD5 request sent to 178.129.170.255
[scanner] FD6 request sent to 212.231.19.124
[scanner] FD4 request sent to 5.22.227.132
[scanner] FD5 request sent to 79.116.239.36
[scanner] FD6 request sent to 178.13.201.49
[scanner] FD4 request sent to 109.205.1.251
[scanner] FD4 request sent to 109.97.245.40
[scanner] FD5 request sent to 2.247.153.200
[scanner] FD6 request sent to 118.6.20.227
[scanner] FD4 request sent to 212.191.139.60
[scanner] FD5 request sent to 5.238.213.25
[scanner] FD6 request sent to 118.125.247.43
[scanner] FD4 request sent to 94.34.211.187
[scanner] FD5 request sent to 210.64.190.232
[scanner] FD6 request sent to 118.72.195.194
[scanner] FD4 request sent to 118.229.14.74
[scanner] FD5 request sent to 118.194.37.144
[scanner] FD6 request sent to 109.8.134.209
[scanner] FD4 request sent to 210.71.138.88
[scanner] FD5 request sent to 118.101.242.10
[scanner] FD4 request sent to 109.52.214.18
[scanner] FD6 request sent to 178.31.124.116
Standard Error:

Process Tree

  • system is lnxubuntu20
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
MiraiMirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

PCAP (Network Traffic)

SourceRuleDescriptionAuthorStrings
dump.pcapJoeSecurity_Mirai_12Yara detected MiraiJoe Security

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    6252.1.00007f2584400000.00007f258441b000.r-x.sdmpLinux_Trojan_Gafgyt_ea92cca8unknownunknown
    • 0x174c8:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
    6252.1.00007f2584400000.00007f258441b000.r-x.sdmpMirai_Botnet_MalwareDetects Mirai Botnet MalwareFlorian Roth
    • 0x19004:$s1: LCOGQGPTGP
    • 0x1877c:$s3: CFOKLKQVPCVMP
    • 0x188b4:$s4: QWRGPTKQMP
    • 0x18884:$s5: HWCLVGAJ
    6249.1.00007f2584400000.00007f258441b000.r-x.sdmpLinux_Trojan_Gafgyt_ea92cca8unknownunknown
    • 0x174c8:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
    6249.1.00007f2584400000.00007f258441b000.r-x.sdmpMirai_Botnet_MalwareDetects Mirai Botnet MalwareFlorian Roth
    • 0x19004:$s1: LCOGQGPTGP
    • 0x1877c:$s3: CFOKLKQVPCVMP
    • 0x188b4:$s4: QWRGPTKQMP
    • 0x18884:$s5: HWCLVGAJ
    6258.1.00007f2584400000.00007f258441b000.r-x.sdmpLinux_Trojan_Gafgyt_ea92cca8unknownunknown
    • 0x174c8:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
    Click to see the 4 entries

    Snort Signatures

    ⊘No Snort rule has matched

    Joe Sandbox Signatures

    Click to jump to signature section

    Show All Signature Results

    AV Detection

    barindex
    Multi AV Scanner detection for submitted file
    Source: Q1BPEcSFNH.elfReversingLabs: Detection: 21%
    Source: Q1BPEcSFNH.elfVirustotal: Detection: 22%Perma Link

    Networking

    barindex
    Uses known network protocols on non-standard ports
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 51822
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 51830
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 51838
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 51848
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 51854
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 51864
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 51870
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 51874
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 51878
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 51882
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 51884
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 51888
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 51898
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 51910
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 51920
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54440
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54446
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54456
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54470
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54484
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54494
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54506
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54516
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54532
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54540
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54552
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54558
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54566
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54572
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54582
    Source: global trafficTCP traffic: 192.168.2.23:44648 -> 45.88.90.129:9902
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 105.171.252.116:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 200.149.233.15:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 66.139.175.161:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 113.5.216.193:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 188.85.163.120:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 159.245.52.213:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 187.131.220.7:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 92.187.131.183:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 175.152.130.205:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 149.152.248.136:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 175.254.189.182:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 125.179.21.171:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 91.14.175.200:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 111.30.137.228:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 100.142.65.52:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 128.85.102.211:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 79.73.38.70:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 176.101.11.229:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 63.142.176.205:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 80.219.201.184:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 13.214.26.93:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 108.165.112.127:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 161.201.37.157:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 195.198.0.150:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 47.14.88.105:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 5.24.226.115:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 180.255.11.47:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 92.138.62.28:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 216.21.208.67:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 53.197.251.172:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 9.155.17.80:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 65.200.156.192:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 186.144.132.85:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 17.49.88.80:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 20.95.252.175:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 119.242.139.230:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 89.250.96.161:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 76.12.14.91:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 101.42.223.69:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 2.47.99.23:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 105.88.179.174:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 177.70.101.194:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 20.95.235.87:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 175.56.16.121:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 71.242.238.173:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 143.36.220.134:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 39.190.58.254:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 58.49.228.111:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 119.94.214.161:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 2.146.124.209:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 93.149.150.14:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 9.222.29.95:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 67.121.32.142:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 220.222.153.239:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 98.153.185.137:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 47.33.39.43:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 105.145.228.200:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 120.7.125.97:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 177.133.166.8:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 74.221.154.251:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 35.56.238.148:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 105.217.8.122:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 38.11.52.162:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 132.48.141.211:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 40.221.236.203:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 206.240.245.230:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 44.39.252.1:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 190.131.105.46:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 150.55.83.70:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 198.168.241.46:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 90.114.248.174:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 143.254.94.108:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 176.231.243.203:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 66.190.45.63:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 121.38.196.220:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 174.181.44.90:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 58.87.134.244:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 153.85.196.173:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 34.100.96.187:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 217.224.75.118:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 87.206.3.127:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 128.23.121.253:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 110.214.166.134:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 158.139.37.195:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 44.87.34.9:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 211.240.40.20:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 161.29.169.98:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 164.39.199.5:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 101.243.123.182:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 20.63.169.131:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 129.21.95.98:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 143.165.142.105:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 128.190.128.59:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 104.230.33.39:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 31.144.143.94:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 61.56.59.207:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 103.89.248.139:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 219.201.187.18:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 19.18.43.234:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 19.9.18.52:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 194.215.220.179:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 106.146.91.59:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 39.70.195.151:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 184.208.249.250:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 32.89.200.118:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 203.106.98.197:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 132.120.60.18:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 146.107.55.203:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 105.152.36.126:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 59.17.16.125:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 150.224.208.245:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 169.251.5.170:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 185.11.18.90:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 39.32.209.145:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 148.119.123.225:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 57.193.142.47:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 181.131.249.181:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 12.197.248.203:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 219.127.249.35:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 130.164.124.205:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 171.86.225.203:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 75.68.118.243:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 84.152.111.236:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 175.175.61.6:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 68.96.169.184:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 168.216.44.132:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 38.81.210.135:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 93.239.95.129:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 116.226.140.180:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 204.41.217.169:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 196.253.9.75:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 149.221.100.124:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 199.69.245.186:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 196.156.232.176:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 61.101.194.127:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 125.68.208.55:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 85.235.26.240:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 17.161.223.62:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 78.231.201.62:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 82.150.164.34:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 53.129.22.247:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 187.36.13.134:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 85.76.233.222:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 87.143.37.8:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 128.48.172.172:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 101.14.134.63:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 195.160.47.16:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 114.161.236.150:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 196.84.245.144:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 68.191.163.162:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 217.86.89.93:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 149.133.85.96:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 136.183.69.126:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 118.20.65.135:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 4.57.141.155:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 87.240.175.63:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 138.3.27.141:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 111.202.147.127:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 132.101.98.246:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 5.200.129.155:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 166.188.192.38:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 83.40.75.130:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 74.70.26.74:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 89.252.229.199:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 107.36.14.205:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 81.101.219.55:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 59.220.193.120:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 90.50.178.160:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 147.32.233.173:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 220.226.100.27:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 213.44.220.243:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 62.151.30.212:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 4.95.112.110:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 209.196.110.190:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 99.40.11.23:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 218.145.138.132:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 168.204.187.65:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 139.205.223.14:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 111.227.59.217:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 178.86.227.186:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 85.132.154.113:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 122.49.137.111:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 106.177.204.164:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 71.100.75.118:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 88.83.196.40:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 160.80.14.216:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 158.193.138.52:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 92.133.120.45:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 109.190.135.147:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 54.135.194.62:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 109.120.101.252:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 46.254.87.237:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 174.166.255.111:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 150.247.249.38:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 8.203.20.45:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 111.84.189.9:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 152.22.56.67:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 102.120.91.89:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 223.116.150.238:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 74.108.54.22:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 149.255.242.27:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 58.172.18.118:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 96.255.118.243:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 153.123.247.181:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 32.238.65.218:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 130.111.214.39:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 205.145.125.177:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 144.245.234.24:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 176.146.172.151:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 121.229.117.175:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 72.215.138.164:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 58.110.125.144:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 90.169.156.234:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 213.106.178.11:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 208.249.128.106:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 53.140.95.173:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 219.108.16.54:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 89.182.129.252:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 61.170.79.71:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 221.223.141.221:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 211.9.181.27:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 60.255.56.212:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 36.213.224.145:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 181.238.227.16:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 62.98.35.42:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 129.110.51.68:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 45.124.12.70:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 219.9.65.46:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 130.27.124.109:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 207.33.230.123:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 9.30.253.157:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 138.254.238.205:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 153.82.164.39:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 108.146.168.226:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 32.107.6.143:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 176.62.164.136:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 95.141.246.53:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 190.198.180.13:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 190.235.98.142:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 57.150.25.226:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 174.237.207.49:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 32.98.126.100:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 157.246.211.209:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 185.237.46.192:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 82.101.209.176:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 78.158.251.95:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 124.99.34.159:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 20.76.137.70:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 144.5.171.111:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 135.196.141.71:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 186.208.252.216:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 32.198.31.190:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 66.26.221.150:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 210.1.244.34:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 120.45.208.49:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 108.100.38.70:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 205.132.179.153:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 161.217.191.203:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 82.67.255.57:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 68.187.86.105:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 143.70.21.5:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 88.51.70.65:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 194.216.251.200:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 181.83.52.167:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 13.223.6.48:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 164.42.165.65:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 82.187.216.100:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 23.223.237.72:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 63.11.123.87:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 195.152.8.84:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 48.140.98.95:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 157.32.144.159:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 200.185.251.60:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 148.218.226.40:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 -> 23.135.15.150:2323
    Source: global trafficTCP traffic: 192.168.2.23:48513 ->