Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
vvV3pyLNs0.elf

Overview

General Information

Sample Name:vvV3pyLNs0.elf
Original Sample Name:df3ad12d3f93bd41300cb8442d9c12b8.elf
Analysis ID:1351993
MD5:df3ad12d3f93bd41300cb8442d9c12b8
SHA1:49d839f04da961b7017a0e73ab0d05352b80e8c0
SHA256:c3269fb97b86abdf706cecac70e490b1efecda9d237fbbdee567194cc1c5959c
Tags:32elfmiraimotorola
Infos:

Detection

Mirai
Score:100
Range:0 - 100
Whitelisted:false

Signatures

Antivirus / Scanner detection for submitted sample
Yara detected Mirai
Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
Snort IDS alert for network traffic
Connects to many ports of the same IP (likely port scanning)
Uses known network protocols on non-standard ports
Sample tries to kill multiple processes (SIGKILL)
Reads CPU information from /sys indicative of miner or evasive malware
Yara signature match
Uses the "uname" system call to query kernel version information (possible evasion)
Enumerates processes within the "proc" file system
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Detected TCP or UDP traffic on non-standard ports
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Sample has stripped symbol table
HTTP GET or POST without a user agent
Executes the "rm" command used to delete files or directories
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.
All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.

General Information

Joe Sandbox Version:38.0.0 Ammolite
Analysis ID:1351993
Start date and time:2023-12-02 10:47:41 +01:00
Joe Sandbox Product:CloudBasic
Overall analysis duration:0h 5m 19s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample file name:vvV3pyLNs0.elf
renamed because original name is a hash value
Original Sample Name:df3ad12d3f93bd41300cb8442d9c12b8.elf
Detection:MAL
Classification:mal100.spre.troj.linELF@0/0@1/0

Runtime Messages

Command:/tmp/vvV3pyLNs0.elf
PID:6255
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
J4d3Gr33n.
Standard Error:

Process Tree

  • system is lnxubuntu20
  • dash New Fork (PID: 6248, Parent: 4336)
  • rm (PID: 6248, Parent: 4336, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.IM4u5aeyei /tmp/tmp.RezRzG61Iv /tmp/tmp.4dvX4qoUbM
  • wrapper-2.0 (PID: 6269, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"
  • wrapper-2.0 (PID: 6270, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"
  • wrapper-2.0 (PID: 6271, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"
  • wrapper-2.0 (PID: 6272, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"
  • wrapper-2.0 (PID: 6273, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"
  • wrapper-2.0 (PID: 6274, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
MiraiMirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
vvV3pyLNs0.elfJoeSecurity_Mirai_6Yara detected MiraiJoe Security
    vvV3pyLNs0.elfJoeSecurity_Mirai_8Yara detected MiraiJoe Security
      vvV3pyLNs0.elfLinux_Trojan_Mirai_575f5bc8unknownunknown
      • 0x1bc09:$a: 5A 56 5B 5B 55 42 44 5E 59 52 44 44 00 5E 73 5E 45 52 54 43 00

      Memory Dumps

      SourceRuleDescriptionAuthorStrings
      6261.1.00007f94a4001000.00007f94a401f000.r-x.sdmpJoeSecurity_Mirai_6Yara detected MiraiJoe Security
        6261.1.00007f94a4001000.00007f94a401f000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
          6261.1.00007f94a4001000.00007f94a401f000.r-x.sdmpLinux_Trojan_Mirai_575f5bc8unknownunknown
          • 0x1bc09:$a: 5A 56 5B 5B 55 42 44 5E 59 52 44 44 00 5E 73 5E 45 52 54 43 00
          6255.1.00007f94a4001000.00007f94a401f000.r-x.sdmpJoeSecurity_Mirai_6Yara detected MiraiJoe Security
            6255.1.00007f94a4001000.00007f94a401f000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
              Click to see the 7 entries

              Snort Signatures

              Timestamp:192.168.2.23156.241.122.14035664372152829579 12/02/23-10:49:00.694224
              SID:2829579
              Source Port:35664
              Destination Port:37215
              Protocol:TCP
              Classtype:A Network Trojan was detected
              Timestamp:192.168.2.23156.254.97.1234056372152835222 12/02/23-10:49:00.678398
              SID:2835222
              Source Port:34056
              Destination Port:37215
              Protocol:TCP
              Classtype:A Network Trojan was detected
              Timestamp:192.168.2.23156.241.65.22252084372152835222 12/02/23-10:49:00.694365
              SID:2835222
              Source Port:52084
              Destination Port:37215
              Protocol:TCP
              Classtype:A Network Trojan was detected
              Timestamp:192.168.2.23156.241.81.20637522372152829579 12/02/23-10:49:00.696733
              SID:2829579
              Source Port:37522
              Destination Port:37215
              Protocol:TCP
              Classtype:A Network Trojan was detected
              Timestamp:192.168.2.23156.241.81.20637522372152835222 12/02/23-10:49:00.696733
              SID:2835222
              Source Port:37522
              Destination Port:37215
              Protocol:TCP
              Classtype:A Network Trojan was detected
              Timestamp:192.168.2.23156.254.97.1234056372152829579 12/02/23-10:49:00.678398
              SID:2829579
              Source Port:34056
              Destination Port:37215
              Protocol:TCP
              Classtype:A Network Trojan was detected
              Timestamp:192.168.2.23156.241.122.14035664372152835222 12/02/23-10:49:00.694224
              SID:2835222
              Source Port:35664
              Destination Port:37215
              Protocol:TCP
              Classtype:A Network Trojan was detected
              Timestamp:192.168.2.23156.241.65.22252084372152829579 12/02/23-10:49:00.694365
              SID:2829579
              Source Port:52084
              Destination Port:37215
              Protocol:TCP
              Classtype:A Network Trojan was detected

              Joe Sandbox Signatures

              Click to jump to signature section

              Show All Signature Results

              AV Detection

              barindex
              Antivirus / Scanner detection for submitted sample
              Source: vvV3pyLNs0.elfAvira: detected
              Multi AV Scanner detection for submitted file
              Source: vvV3pyLNs0.elfReversingLabs: Detection: 54%
              Source: vvV3pyLNs0.elfVirustotal: Detection: 54%Perma Link
              Source: /tmp/vvV3pyLNs0.elf (PID: 6259)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/topology/thread_siblings_listJump to behavior
              Source: /tmp/vvV3pyLNs0.elf (PID: 6259)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/topology/thread_siblings_listJump to behavior

              Networking

              barindex
              Snort IDS alert for network traffic
              Source: TrafficSnort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:34056 -> 156.254.97.12:37215
              Source: TrafficSnort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:34056 -> 156.254.97.12:37215
              Source: TrafficSnort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:35664 -> 156.241.122.140:37215
              Source: TrafficSnort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:35664 -> 156.241.122.140:37215
              Source: TrafficSnort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:52084 -> 156.241.65.222:37215
              Source: TrafficSnort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:52084 -> 156.241.65.222:37215
              Source: TrafficSnort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:37522 -> 156.241.81.206:37215
              Source: TrafficSnort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:37522 -> 156.241.81.206:37215
              Connects to many ports of the same IP (likely port scanning)
              Source: global trafficTCP traffic: 156.241.81.206 ports 1,2,3,5,7,37215
              Source: global trafficTCP traffic: 156.73.182.86 ports 1,2,3,5,7,37215
              Source: global trafficTCP traffic: 156.254.97.12 ports 1,2,3,5,7,37215
              Source: global trafficTCP traffic: 197.128.202.9 ports 1,2,3,5,7,37215
              Source: global trafficTCP traffic: 156.241.122.140 ports 1,2,3,5,7,37215
              Source: global trafficTCP traffic: 156.73.203.47 ports 1,2,3,5,7,37215
              Source: global trafficTCP traffic: 156.241.65.222 ports 1,2,3,5,7,37215
              Uses known network protocols on non-standard ports
              Source: unknownNetwork traffic detected: HTTP traffic on port 34056 -> 37215
              Source: unknownNetwork traffic detected: HTTP traffic on port 35664 -> 37215
              Source: unknownNetwork traffic detected: HTTP traffic on port 52084 -> 37215
              Source: unknownNetwork traffic detected: HTTP traffic on port 37522 -> 37215
              Source: unknownNetwork traffic detected: HTTP traffic on port 34056 -> 37215
              Source: unknownNetwork traffic detected: HTTP traffic on port 37522 -> 37215
              Source: unknownNetwork traffic detected: HTTP traffic on port 35664 -> 37215
              Source: unknownNetwork traffic detected: HTTP traffic on port 34056 -> 37215
              Source: unknownNetwork traffic detected: HTTP traffic on port 35664 -> 37215
              Source: unknownNetwork traffic detected: HTTP traffic on port 37522 -> 37215
              Source: unknownNetwork traffic detected: HTTP traffic on port 34056 -> 37215
              Source: unknownNetwork traffic detected: HTTP traffic on port 35664 -> 37215
              Source: unknownNetwork traffic detected: HTTP traffic on port 37522 -> 37215
              Source: unknownNetwork traffic detected: HTTP traffic on port 34056 -> 37215
              Source: unknownNetwork traffic detected: HTTP traffic on port 37522 -> 37215
              Source: unknownNetwork traffic detected: HTTP traffic on port 35664 -> 37215
              Source: unknownNetwork traffic detected: HTTP traffic on port 34056 -> 37215
              Source: unknownNetwork traffic detected: HTTP traffic on port 37522 -> 37215
              Source: unknownNetwork traffic detected: HTTP traffic on port 35664 -> 37215
              Source: unknownNetwork traffic detected: HTTP traffic on port 34056 -> 37215
              Source: unknownNetwork traffic detected: HTTP traffic on port 37522 -> 37215
              Source: unknownNetwork traffic detected: HTTP traffic on port 35664 -> 37215
              Source: global trafficTCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
              Source: global trafficTCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.157.10.161:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.33.249.205:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.239.174.163:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.80.167.199:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.11.56.161:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.62.136.183:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.162.246.129:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.208.157.91:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.109.144.69:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.212.198.223:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.18.42.208:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.108.239.6:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.215.27.190:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.16.238.148:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.208.189.126:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.232.147.243:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.19.217.18:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.209.213.189:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.209.144.53:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.80.221.27:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.15.125.153:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.7.69.160:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.106.167.104:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.158.97.246:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.49.205.4:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.49.119.12:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.7.23.73:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.166.17.88:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.222.104.25:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.58.29.205:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.10.103.186:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.77.179.112:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.238.58.98:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.111.16.213:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.54.26.179:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.211.16.66:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.95.31.78:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.86.164.189:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.87.94.1:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.44.33.226:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.180.189.142:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.33.92.106:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.119.96.41:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.2.130.40:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.181.13.90:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.172.19.205:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.5.97.211:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.238.141.152:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.101.234.246:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.94.227.5:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.29.70.90:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.247.162.223:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.122.163.84:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.237.56.3:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.190.45.202:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.29.68.112:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.124.110.194:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.136.91.199:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.9.79.234:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.54.185.140:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.251.242.113:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.2.115.178:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.56.253.9:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.49.47.214:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.98.114.243:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.115.152.177:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.102.16.182:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.49.98.51:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.27.230.171:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.121.47.107:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.63.134.141:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.131.155.160:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.129.195.143:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.9.222.203:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.17.0.204:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.66.8.110:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.200.32.183:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.55.213.207:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.107.200.241:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.221.78.175:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.198.25.131:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.75.92.248:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.229.247.255:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.254.213.246:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.114.53.207:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.230.94.134:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.17.253.237:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.28.153.205:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.60.215.170:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.69.75.160:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.172.81.50:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.58.111.34:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.51.83.162:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.222.149.251:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.228.38.9:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.73.203.47:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.136.0.109:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.240.48.130:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.73.182.86:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.45.233.39:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.180.254.181:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.72.110.35:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.232.109.25:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.68.189.32:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.158.227.163:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.194.253.125:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.167.128.244:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.26.110.171:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.209.29.207:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.36.39.83:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.55.153.34:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.186.123.158:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.81.208.86:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.113.206.228:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.174.251.200:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.178.68.227:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.131.98.213:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.62.199.105:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.21.29.33:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.79.16.48:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.140.65.79:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.46.46.146:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.214.184.145:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.1.115.26:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.129.160.132:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.85.96.24:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.130.80.129:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.11.47.85:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.46.2.234:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.122.53.189:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.157.187.70:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.160.66.77:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.164.222.243:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.197.233.191:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.24.108.193:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.190.254.254:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.231.161.34:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.126.127.3:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.186.215.69:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.168.131.213:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.138.103.193:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.36.4.115:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.166.153.224:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.84.28.49:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.169.252.172:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.186.241.201:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.33.131.78:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.249.255.180:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.49.176.225:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.146.115.233:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.191.218.134:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.85.57.74:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.140.201.15:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.63.232.84:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.254.179.238:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.156.55.44:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.204.25.168:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.210.64.241:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.25.9.177:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.120.83.197:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.242.104.146:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.34.101.17:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.237.1.121:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.189.149.1:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.254.142.88:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.158.185.223:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.53.15.127:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.44.170.232:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.208.201.78:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.193.11.204:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.136.74.93:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.186.158.157:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.2.93.18:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.153.91.253:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.42.26.41:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.245.45.153:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.95.147.84:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.71.120.39:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.78.15.213:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.224.200.167:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.175.79.2:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.24.41.112:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.209.28.178:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.120.242.17:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.61.31.221:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.195.83.29:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.37.105.43:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.193.100.168:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.110.216.91:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.66.239.10:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.148.210.163:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.148.169.106:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.214.12.104:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.114.97.120:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.102.216.87:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.25.50.164:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.204.129.24:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.245.75.244:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.181.158.109:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.41.118.53:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.77.209.73:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.102.103.201:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.133.186.112:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.103.68.148:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.152.196.40:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.115.230.207:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.233.138.71:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.145.14.6:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.153.140.79:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.37.189.73:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.11.16.179:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.21.223.223:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.85.209.163:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.207.87.133:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.112.84.164:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.174.13.71:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.3.2.230:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.47.63.120:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.184.62.236:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.39.254.7:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.161.139.195:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.235.214.160:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.68.179.136:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.24.28.188:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.55.41.121:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.168.107.25:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.139.115.11:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.223.215.67:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.125.220.203:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.211.118.188:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.98.122.134:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.175.17.168:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.111.55.118:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.78.127.38:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.234.162.97:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.189.227.124:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.109.44.149:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.95.200.132:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.60.252.10:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.81.168.115:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.220.233.138:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.151.16.164:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.226.85.210:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.4.225.120:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.235.190.253:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.37.179.152:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.144.204.35:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.2.195.217:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.218.238.41:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.27.20.14:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.192.67.174:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.142.187.83:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.189.100.99:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.175.64.165:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.85.165.49:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.208.246.36:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.28.27.247:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.38.231.181:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.220.36.48:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.93.6.186:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.148.123.232:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.175.204.17:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.58.224.177:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.185.184.19:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.103.160.125:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.47.238.56:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.178.134.21:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.152.39.125:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.176.80.160:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.140.127.35:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.202.194.139:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.119.54.72:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.209.209.164:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -> 156.76.233.35:37215
              Source: global trafficTCP traffic: 192.168.2.23:13110 -&